From: Vladis Dronov <[email protected]> Currently the CTS algo is built as a module. This is a problem if any ciphers using CTS are marked as FIPS-enabled and the system is booted in FIPS mode, as dracut does not include cts.ko in the initramfs. This change is necessary for NFS with sec=krb5{,i,p} to work in FIPS mode. Otherwise, the following panic would result:
[ 8.462065] alg: skcipher: Failed to load transform for cts(cbc(aes)): -2 [ 8.463705] Kernel panic - not syncing: cts(cbc(aes)): cts(cbc(aes)) alg self test failed in fips mode! Fix this by embedding the CTS code into a kernel, the same way as Fedora already does. This was tested by a reproducer in bz1855161 #c24, #c28. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1855161 Signed-off-by: Vladis Dronov <[email protected]> --- redhat/configs/ark/generic/CONFIG_CRYPTO_CTS | 1 - .../generic/s390x/zfcpdump => common/generic}/CONFIG_CRYPTO_CTS | 0 redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS | 1 - 3 files changed, 2 deletions(-) delete mode 100644 redhat/configs/ark/generic/CONFIG_CRYPTO_CTS rename redhat/configs/{ark/generic/s390x/zfcpdump => common/generic}/CONFIG_CRYPTO_CTS (100%) delete mode 100644 redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS diff --git a/redhat/configs/ark/generic/CONFIG_CRYPTO_CTS b/redhat/configs/ark/generic/CONFIG_CRYPTO_CTS deleted file mode 100644 index 2529a2fa5379..000000000000 --- a/redhat/configs/ark/generic/CONFIG_CRYPTO_CTS +++ /dev/null @@ -1 +0,0 @@ -CONFIG_CRYPTO_CTS=m diff --git a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS b/redhat/configs/common/generic/CONFIG_CRYPTO_CTS similarity index 100% rename from redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS rename to redhat/configs/common/generic/CONFIG_CRYPTO_CTS diff --git a/redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS b/redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS deleted file mode 100644 index e7ff7297caed..000000000000 --- a/redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS +++ /dev/null @@ -1 +0,0 @@ -CONFIG_CRYPTO_CTS=y -- GitLab _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
