From patchwork Thu Feb 1 13:19:35 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dimitri John Ledkov X-Patchwork-Id: 1893932 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TQfdp5bwxz1yQ0 for ; Fri, 2 Feb 2024 00:19:58 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rVWyr-0007cG-Sr; Thu, 01 Feb 2024 13:19:49 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rVWyn-0007bt-7l for kernel-team@lists.ubuntu.com; Thu, 01 Feb 2024 13:19:45 +0000 Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id D095F3FE35 for ; Thu, 1 Feb 2024 13:19:42 +0000 (UTC) Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-40ef75bea84so5295315e9.2 for ; Thu, 01 Feb 2024 05:19:42 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706793582; x=1707398382; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=SBhyLMRV/nwYcAo7AZRMkEhlyiaiSbWQ5u09sXyjuc0=; b=rMPnaw3L7TSzUw6GkYGdMakZMAr5Y4n7pgILvLrCFxXr0CddUbnXG6Ru3qjHynYrrm 5IUL5poUtDT7SOUfDrZl2lyWpClaedCSxm3dK/L1MhK1xyO6ORzGWbXlFiGWz7gBIZSY cZDrqEj682szmxaXJh1nb37hGzVNL489OxbKGjoXmj9suPodZIj7mGscVa0mimne9ob8 Ccz9FnX8P7uV03205R4kKQD1wyHupn3bn+zfSxr0boroQPmg3rRbaay1dNcGNEDnA/TM aB3bblHssf1yLgVI7M+VX41YNsOHvwrrM3XyBMZkH2FY4Rp4gYHJcPugiCn4ASfQc8/Y x52w== X-Gm-Message-State: AOJu0YyC25OzOrzvhDKxY+1gZZSkXDFdcr1lWz9z5mrsnzji4v15lI1q LRS6mZtbJCrxM5tTAkibuhhw6CskyKzrThQuDA9j+QhLIr7jLqhriqi6iw2GRw2rcq8yFNeC8Xp aqNf4xfDEcdiqIya6l57553a+VPbCzXos4+y2d0PFwEvOZhh3ZH+VUXuePszDmFNqugpoqWm9gL rl3tH5verMuw== X-Received: by 2002:a05:600c:3b93:b0:40f:b64e:d28a with SMTP id n19-20020a05600c3b9300b0040fb64ed28amr3626242wms.10.1706793582024; Thu, 01 Feb 2024 05:19:42 -0800 (PST) X-Google-Smtp-Source: AGHT+IEFEHW+R7NOWbQKQXTia6Z3fIa+J6AcUPLHzRoFEC3ybkNVUByCCDYdekXr1s0TCiQ4CwqOFg== X-Received: by 2002:a05:600c:3b93:b0:40f:b64e:d28a with SMTP id n19-20020a05600c3b9300b0040fb64ed28amr3626227wms.10.1706793581628; Thu, 01 Feb 2024 05:19:41 -0800 (PST) Received: from localhost ([2a01:4b00:85fd:d700:f982:e941:45f6:bc25]) by smtp.gmail.com with ESMTPSA id i7-20020a05600c290700b0040ecdd672fasm4342226wmd.13.2024.02.01.05.19.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Feb 2024 05:19:41 -0800 (PST) From: Dimitri John Ledkov To: kernel-team@lists.ubuntu.com Subject: [PATCH][UNSTABLE] UBUNTU: SAUCE: Enable fips mode by default, in FIPS kernels only Date: Thu, 1 Feb 2024 13:19:35 +0000 Message-Id: <20240201131935.120162-1-dimitri.ledkov@canonical.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" BugLink: https://bugs.launchpad.net/bugs/2049082 Ensure that kernels built with CONFIG_CRYPTO_FIPS=y default to fips mode. Such that testing FIPS kernels in FIPS mode requires no additional bootloader configuration. This will ease testing, deployment, downgrades/upgrades, certification. Tested by building unstable kernel with a minimal FIPS configuration enabled, and observing that default boot goes into fips mode, as well as when fips=1 passed on the cmdline. Also verified that fips=0 turns off fips mode correctly. Signed-off-by: Dimitri John Ledkov # Acked-by: Andrei Gherzan Acked-by: Tim Gardner --- crypto/fips.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/fips.c b/crypto/fips.c index 92fd506abb..f358524aa3 100644 --- a/crypto/fips.c +++ b/crypto/fips.c @@ -14,7 +14,8 @@ #include #include -int fips_enabled; +/* LP: #2049082 UBUNTU: SAUCE: FIPS kernels default to FIPS mode */ +int fips_enabled = 1; EXPORT_SYMBOL_GPL(fips_enabled); ATOMIC_NOTIFIER_HEAD(fips_fail_notif_chain);