Enable FIPS Mode in GRUB2

An XCCDF Rule

Description

To ensure FIPS mode is enabled, install package dracut-fips, and rebuild initramfs by running the following commands:

$ sudo yum install dracut-fips
dracut -f

After the dracut command has been run, add the argument fips=1 to the default GRUB 2 command line for the Linux operating system in /etc/default/grub, in the manner below:

GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 fips=1"

Finally, rebuild the grub.cfg file by using the

grub2-mkconfig -o

command as follows:

On BIOS-based machines, issue the following command as root:
```
~]# grub2-mkconfig -o /boot/grub2/grub.cfg
```
On UEFI-based machines, issue the following command as root:
```
~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
```

warning alert: Functionality Warning

Running

dracut -f

will overwrite the existing initramfs file.

warning alert: Warning

The system needs to be rebooted for these changes to take effect.

warning alert: Regulatory Warning

System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

Rationale

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

ID: xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode
Severity: High
References: 12 15 8

5.10.1.2

APO13.01 DSS01.04 DSS05.02 DSS05.03

3.13.11 3.13.8

CCI-000068 CCI-000803 CCI-001199 CCI-002450 CCI-002476

4.3.3.6.6

SR 1.13 SR 2.6 SR 3.1 SR 3.5 SR 3.8 SR 4.1 SR 4.3 SR 5.1 SR 5.2 SR 5.3 SR 7.1 SR 7.6

A.11.2.6 A.13.1.1 A.13.2.1 A.14.1.3 A.6.2.1 A.6.2.2

CIP-003-8 R4.2 CIP-007-3 R5.1

CM-6(a) IA-7 SC-12 SC-12(2) SC-12(3) SC-13

PR.AC-3 PR.PT-4

SRG-OS-000033-GPOS-00014 SRG-OS-000185-GPOS-00079 SRG-OS-000396-GPOS-00176 SRG-OS-000405-GPOS-00184 SRG-OS-000478-GPOS-00223

OL07-00-021350

SV-221758r958408_rule
Updated: about 1 month ago

Remediation Templates

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy
- name: Check prelink binary installed
  stat:
    path: /usr/sbin/prelink
  register: prelink_exists
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Disable prelink
  lineinfile:
    dest: /etc/sysconfig/prelink
    regexp: ^#?PRELINKING
    line: PRELINKING=no
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - prelink_exists.stat.exists
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Revert prelinking binaries
  command: /usr/sbin/prelink -ua
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - prelink_exists.stat.exists
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Check if system supports AES-NI
  command: grep -q -m1 -o aes /proc/cpuinfo
  failed_when: aesni_supported.rc > 1
  register: aesni_supported
  check_mode: false
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Ensure dracut-fips-aesni is installed
  package:
    name: dracut-fips-aesni
    state: present
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - aesni_supported.rc == 0
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Install dracut-fips
  package:
    name: dracut-fips
    state: present
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Rebuild initramfs
  command: dracut -f
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Check fips argument exists
  command: grep 'GRUB_CMDLINE_LINUX.*fips=' /etc/default/grub
  failed_when: false
  register: fipsargcheck
  check_mode: false
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Replace existing fips argument
  replace:
    path: /etc/default/grub
    regexp: fips=.
    replace: fips=1
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - fipsargcheck.rc == 0
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Add fips argument
  replace:
    path: /etc/default/grub
    regexp: (GRUB_CMDLINE_LINUX=.*)"
    replace: \1 fips=1"
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - fipsargcheck.rc != 0
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Get boot device uuid
  command: findmnt --noheadings --output uuid --target /boot
  register: bootuuid
  check_mode: false
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Check boot argument exists
  command: grep 'GRUB_CMDLINE_LINUX.*boot=' /etc/default/grub
  failed_when: false
  register: bootargcheck
  check_mode: false
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Replace existing boot argument
  replace:
    path: /etc/default/grub
    regexp: boot=\w*-\w*-\w*-\w*-\w*
    replace: boot={{ bootuuid.stdout }}
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - bootargcheck.rc == 0
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Add boot argument
  replace:
    path: /etc/default/grub
    regexp: (GRUB_CMDLINE_LINUX=.*)"
    replace: \1 boot=UUID={{ bootuuid.stdout }}"
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  - bootargcheck.rc != 0
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Update bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="fips=1 boot=UUID={{ bootuuid.stdout
    }}"
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and "kernel" in ansible_facts.packages
    )
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.2
  - DISA-STIG-OL07-00-021350
  - NIST-800-171-3.13.11
  - NIST-800-171-3.13.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - grub2_enable_fips_mode
  - high_complexity
  - high_severity
  - medium_disruption
  - reboot_required
  - restrict_strategy

package --add=dracut-fips --add=dracut-fips-aesni

# Remediation is applicable only in certain platforms
if ( ! ( [ "${container:-}" == "bwrap-osbuild" ] ) && rpm --quiet -q kernel ) && { rpm --quiet -q grub2-common; }; then
# prelink not installed
if test -e /etc/sysconfig/prelink -o -e /usr/sbin/prelink; then
    if grep -q ^PRELINKING /etc/sysconfig/prelink
    then        sed -i 's/^PRELINKING[:blank:]*=[:blank:]*[:alpha:]*/PRELINKING=no/' /etc/sysconfig/prelink
    else
        printf '\n' >> /etc/sysconfig/prelink
        printf '%s\n' '# Set PRELINKING=no per security requirements' 'PRELINKING=no' >> /etc/sysconfig/prelink
    fi

    # Undo previous prelink changes to binaries if prelink is available.
    if test -x /usr/sbin/prelink; then
        /usr/sbin/prelink -ua
    fi
fi

if grep -q -m1 -o aes /proc/cpuinfo; then
	if ! rpm -q --quiet "dracut-fips-aesni" ; then
    yum install -y "dracut-fips-aesni"
fi
fi
if ! rpm -q --quiet "dracut-fips" ; then
    yum install -y "dracut-fips"
fi

dracut -f

# Correct the form of default kernel command line in  grub
if grep -q '^GRUB_CMDLINE_LINUX=.*fips=.*"'  /etc/default/grub; then
	# modify the GRUB command-line if a fips= arg already exists
	sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)fips=[^[:space:]]*\(.*"\)/\1 fips=1 \2/'  /etc/default/grub
else
	# no existing fips=arg is present, append it
	sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 fips=1"/'  /etc/default/grub
fi

# Get the UUID of the device mounted at root (/).
ROOT_UUID=$(findmnt --noheadings --output uuid --target /)

# Get the UUID of the device mounted at /boot.
BOOT_UUID=$(findmnt --noheadings --output uuid --target /boot)

if [ "${ROOT_UUID}" == "${BOOT_UUID}" ]; then
	# root UUID same as boot UUID, so do not modify the GRUB command-line or add boot arg to kernel command line
	# Correct the form of kernel command line for each installed kernel in the bootloader
	/sbin/grubby --update-kernel=ALL --args="fips=1"
else
	# root UUID different from boot UUID, so modify the GRUB command-line and add boot arg to kernel command line
	if grep -q '^GRUB_CMDLINE_LINUX=".*boot=.*"'  /etc/default/grub; then
		# modify the GRUB command-line if a boot= arg already exists
		sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)boot=[^[:space:]]*\(.*"\)/\1 boot=UUID='"${BOOT_UUID} \2/" /etc/default/grub
	else
		# no existing boot=arg is present, append it
		sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 boot=UUID='${BOOT_UUID}'"/'  /etc/default/grub
	fi
	# Correct the form of kernel command line for each installed kernel in the bootloader
	/sbin/grubby --update-kernel=ALL --args="fips=1 boot=UUID=${BOOT_UUID}"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable FIPS Mode in GRUB2

Description

Rationale

Remediation Templates

An Ansible Snippet

Anaconda Pre-Install Instructions

A Shell Script