How to set /proc/sys/crypto/fips_enabled fips=1

eric.vanh · 07-31-2019, 05:10 PM

note that when I

Code:

nano /etc/default/grub

I see that the code line is different from what I see when I "-e" at startup.
Meaning that the /etc/default/grub text is not the one used at boot.

berndbausch · 07-31-2019, 05:19 PM

I would google the error message "FIPS integrity test failed". There are several results.

Quote:

Originally Posted by eric.vanh

note that when I

Code:

nano /etc/default/grub

I see that the code line is different from what I see when I "-e" at startup.
Meaning that the /etc/default/grub text is not the one used at boot.

Which code line? And how do the lines differ?

eric.vanh · 07-31-2019, 05:20 PM

And I can no longer access the boot loader settings via YAST ...

Code:

Internal error. Please report a bug report with logs.
Run save_y2logs to get complete logs.

Caller: /usr/lib64/ruby/gems/2.5.0/gems/cfa-0.7.0/lib/cfa/augeas_parser.rb:455:in `report_activity_error!'

Details: Augeas parsing error: Get did not match entire input at /etc/default/grub:11:0, lens /usr/share/augeas/lenses/dist/sysconfig.aug:65.12-.71:

is it because the change with "-e" at boot time ?

eric.vanh · 07-31-2019, 05:45 PM

What I have when I "-e" at boot time is definitely not what's in /etc/default/grub

Now I have to "-e" the boot line everytime I boot

berndbausch · 07-31-2019, 06:01 PM

Quote:

Originally Posted by eric.vanh

Details: Augeas parsing error: Get did not match entire input at /etc/default/grub:11:0

Syntax error in /etc/grub/default, perhaps? At line 11, or around that line?

Also check if this dracut error could be related:

Code:

/boot/.vmlinuz-4.12(...)-default.hmac does not exist

I do have the suspicion that your attempts to generate a grub configuration fail. Does the grub.cfg file correspond to the default? Are you sure that you are configuring the correct grub.cfg?

eric.vanh · 07-31-2019, 06:38 PM

Quote:

Originally Posted by berndbausch

I would google the error message "FIPS integrity test failed". There are several results.

Which code line? And how do the lines differ?

In "-e" at boot, I see that fips=1 is still in 2nd position
=> In /etc/default/grab I definitely have it at the very end, as I've been (corrected) told

In "-e" at boot, I see that "splash=verbose" and "quiet" are still there,
=> In /etc/default/grab I've removed them

In "-e" at boot, I see that "boot=/dev/sda1" is not here
=> In /etc/default/grab I have that "boot=/dev/sda1" just before fips=1 at the end

Now my only way to boot is to -e and remove fips=1 each time

eric.vanh · 07-31-2019, 06:50 PM

Quote:

Originally Posted by berndbausch

Syntax error in /etc/grub/default, perhaps? At line 11, or around that line?

Could very well be, but I can't access it ... because of the error.
I want to access bootloder via YAST because I'm pretty sure that what I write in YAST doesn't go to etc/defaut/grub

Quote:

Originally Posted by berndbausch

Also check if this dracut error could be related:

Code:

/boot/.vmlinuz-4.12(...)-default.hmac does not exist

That error message comes up only when I boot with fips=1.
I can't go any further as the system halts (won't boot)

Quote:

Originally Posted by berndbausch

I do have the suspicion that your attempts to generate a grub configuration fail. Does the grub.cfg file correspond to the default? Are you sure that you are configuring the correct grub.cfg?

I mod the /etc/default/grub/grub.conf file, but didn't touch any grub.cfg file, so yes, it correspond to the default

EDIT: BTW: I see that /etc/default/grub2 is empty despite I use grub2 ??

eric.vanh · 07-31-2019, 07:40 PM

from: https://www.suse.com/documentation/s...rub_basic.html

Code:

/etc/grub.conf

    This file contains the commands, parameters and options the GRUB shell needs for installing the boot loader correctly. 
/etc/sysconfig/bootloader

    This file is read by the perl-bootloader library which is used when configuring the boot loader with YaST and every time a new kernel is installed. It contains configuration options (such as kernel parameters) that will be added by default to the boot loader configuration file.

I think I mod "/etc/sysconfig/bootloader" when I accessed through YAST the bootloader menu

And these changes have not been transfered to /etc/default/grub

eric.vanh · 07-31-2019, 08:00 PM

After having edited /etc/default/grub, update the main configuration file with grub2-mkconfig -o /boot/grub2/grub.cfg

Did the trick, my grab config file was indeed not transferred to the boot menu.

Anyway, now I can boot again, but still with no fips.
I will go back to look into FIPS integrity test failed

BTW: How to I "recall" what was on the splash screen ?

eric.vanh · 07-31-2019, 09:12 PM

Quote:

Originally Posted by berndbausch

Syntax error in /etc/grub/default, perhaps? At line 11, or around that line?

I've mod my /etc/default/grab file to the bare minimum

Code:

GRUB_CMDLINE_LINUX_DEFAULT="
resume=/dev/disk/by-uuid/e0221bcd-7f4a-4cbc-a14e-87190cb99ae7 mitigations=auto"
GRUB_CMDLINE_LINUX=""

And updated it into boot with grub2-mkconfig -o /boot/grub2/grub.cfg

But still can't access bootloader via YAST, same error/bug report:

Quote:

Internal error. Please report a bug report with logs.
Run save_y2logs to get complete logs.

Caller: /usr/lib64/ruby/gems/2.5.0/gems/cfa-0.7.0/lib/cfa/augeas_parser.rb:455:in `report_activity_error!'

Details: Augeas parsing error: Get did not match entire input at /etc/default/grub:11:0, lens /usr/share/augeas/lenses/dist/sysconfig.aug:65.12-.71:

eric.vanh · 08-01-2019, 09:23 AM

I've created a bug report for the PERL error reading YAST bootloader.
I've seen this error mentioned in different versions, and for differents reasons
https://bugzilla.opensuse.org/show_bug.cgi?id=1143853

I will wait to have this solved before resuming my fips=1 thread/try

eric.vanh · 08-01-2019, 12:10 PM

my /etc/default/grub file is now :

Code:

GRUB_CMDLINE_LINUX_DEFAULT="resume=/dev/disk/by-uuid/e0221bcd-7f4a-4cbc-a14e-87190cb99ae7 mitigations=auto fips=1 boot=uuid=DAF4-B957"
GRUB_CMDLINE_LINUX=""

and it boots !
Still have a red error message on the splash but still can't read it (too fast)
Still doesn't have /proc/sys/crypto created (and therefore /proc/sys/crypto/fips_enabled doesn't exist)
So even though the system does boots (with parameter fips=1) the FIPS mode is not enabled

I think I will give up ...

berndbausch · 08-01-2019, 07:13 PM

You mix too many symptoms. There is something wrong with your Yast and/or /etc/default/grub. You system didn't boot (I see that it does now). When it boots, FIPS is not enabled.

Personally, I am lost because of the problem mix. When I ask you for clarification, you reply back with other problems.

My suggestion: Focus on one error at the time. If Yast doesn't work, configure Grub manually and address the Yast problem later.

If an error message goes past too quickly while booting, try booting into single user mode. Check the kernel message buffer (dmesg command) for any error or warning, or any message related to crypto.

There are still messages like "FIPS integrity test failed" and "hmac file not found", which you reported earlier. Search for these messages on the internet and identify search results that fit your system.

eric.vanh · 08-02-2019, 12:13 AM

Quote:

Originally Posted by berndbausch

You mix too many symptoms. There is something wrong with your Yast and/or /etc/default/grub. You system didn't boot (I see that it does now). When it boots, FIPS is not enabled.

Personally, I am lost because of the problem mix. When I ask you for clarification, you reply back with other problems.

My suggestion: Focus on one error at the time. If Yast doesn't work, configure Grub manually and address the Yast problem later.

If an error message goes past too quickly while booting, try booting into single user mode. Check the kernel message buffer (dmesg command) for any error or warning, or any message related to crypto.

There are still messages like "FIPS integrity test failed" and "hmac file not found", which you reported earlier. Search for these messages on the internet and identify search results that fit your system.

I do have many problems with Leap since day one, yes, and I've solved some so far, but many remains ...
For the YAST vs. /etc/default/grub, I can't access YAST "bootloader" option (perl reading error) but I can edit -and did- the grab file and uploaded it into the bootloader with grub2-mkconfig -o /boot/grub2/grub.cfg

Now (remaining problem 1) I have fips=1 in my grub and my system does boot (it didn't before) but systctl doesn't write /crypto/fips_enabled in /proc/sys/ so fips mode is not on.

other problems are:
YAST doesn't allow me to access bootloader option
(dmesg command) doesn't show me any error message I see during boot splash