Skip to content

Commit 8376f8a

Browse files
committed
Sync FIPS detection with the PE installer
Prior to this commit, `peadm` used the `fips-mode-setup --is-enabled` command to detect whether FIPS mode was enabled. Unfortunately, this command does not produce a meaningful exit code. It exits with success on RHEL 8 where the `--is-enabled` flag is invalid: ``` $ fips-mode-setup --is-enabled Check, enable, or disable the system FIPS mode. usage: /usr/bin/fips-mode-setup --enable|--disable [--no-bootcfg] usage: /usr/bin/fips-mode-setup --check $ echo $? 0 ``` And exits with success when FIPS mode is disabled: ``` $ fips-mode-setup --check Installation of FIPS modules is not completed. FIPS mode is disabled. $ echo $? 0 ``` The end result is that if the `crypto-policies-scripts` package happens to be installed on a RHEL node, `peadm` will assume the node is in FIPS mode and download the wrong PE installer package. This commit updates `peadm` to use the same method for detecting FIPS as the PE installer: `cat /proc/sys/crypto/fips_enabled`
1 parent 4440bff commit 8376f8a

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

tasks/precheck.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ if grep -qi ubuntu /etc/os-release; then
77
osfamily="ubuntu"
88
elif grep -qi sles /etc/os-release; then
99
osfamily="sles"
10-
elif grep -qi redhat /etc/os-release && (which fips-mode-setup &>/dev/null && fips-mode-setup --is-enabled); then
10+
elif grep -qi redhat /etc/os-release && [[ "$(cat /proc/sys/crypto/fips_enabled)" == "1" ]]; then
1111
osfamily="redhatfips"
1212
else
1313
osfamily="el"
@@ -23,4 +23,4 @@ cat <<EOS
2323
"hostname": "${hostname}",
2424
"platform": "${osfamily}-${version}-${arch}"
2525
}
26-
EOS
26+
EOS

0 commit comments

Comments
 (0)