Chapter 1. Switching RHEL to FIPS mode

Procedure

1. Add the fips=1 option to the kernel command line at the start of the system installation when the Red Hat Enterprise Linux boot window opens and displays available boot options.

   1. On UEFI systems, press the e key, move the cursor to the end of the linuxefi kernel command line, and add fips=1 to the end of this line, for example:

      linuxefi /images/pxeboot/vmlinuz inst.stage2=hd:LABEL=RHEL-10-0-BaseOS-x86_64 rd.live.\
      check quiet fips=1

      Copy to Clipboard

   2. On BIOS systems, press the Tab key, move the cursor to the end of the kernel command line, and add fips=1 to the end of this line, for example:

      > vmlinuz initrd=initrd.img inst.stage2=hd:LABEL=RHEL-10-0-BaseOS-x86_64 rd.live.check quiet fips=1

      Copy to Clipboard
2. During the software selection stage, do not install any third-party software.
3. After the installation, the system starts in FIPS mode automatically.

Procedure

1. Create a plain text file in the Tom’s Obvious, Minimal Language (TOML) format with the following content:

   name = "system-fips-mode-enabled"
   description = "blueprint with FIPS enabled "
   version = "0.0.1"
   
   [customizations]
   fips = true
   
   [[customizations.user]]
   name = "admin"
   password = "admin"
   groups = ["users", "wheel"]

   Copy to Clipboard

2. Import the blueprint to the RHEL image builder server:

   # composer-cli blueprints push blueprint-name.toml

   Copy to Clipboard

3. List the existing blueprints to check whether the created blueprint is successfully imported and exists:

   # composer-cli blueprints show blueprint-name

   Copy to Clipboard

4. Check whether the components and versions listed in the blueprint and their dependencies are valid:

   # composer-cli blueprints depsolve blueprint-name

   Copy to Clipboard

5. Build the customized RHEL image:

   # composer-cli compose start \ blueprint-name \ image-type \

   Copy to Clipboard

6. Review the image status:

   # composer-cli compose status
   …
   $ UUID FINISHED date blueprint-name blueprint-version image-type
   …

   Copy to Clipboard

7. Download the image:

   # composer-cli compose image UUID

   Copy to Clipboard

   RHEL image builder downloads the image to the current directory path. The UUID number and the image size are displayed alongside:

   $ UUID-image-name.type: size MB

   Copy to Clipboard

Verification

1. Log in to the system image with the username and password that you configured in your blueprint.

2. Check if FIPS mode is enabled:

   $ cat /proc/sys/crypto/fips_enabled
   1

   Copy to Clipboard

Procedure

1. Create a 01-fips.toml to configure FIPS enablement, for example:

   # Enable FIPS
   kargs = ["fips=1"]

   Copy to Clipboard

2. Create a Containerfile with the following instructions to enable the fips=1 kernel argument and adjust the cryptographic policies:

   FROM registry.redhat.io/rhel10/rhel-bootc:latest
   # Enable fips=1 kernel argument: https://bootc-dev.github.io/bootc/building/kernel-arguments.html
   COPY 01-fips.toml /usr/lib/bootc/kargs.d/
   # Install and enable the FIPS crypto policy
   RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS

   Copy to Clipboard

3. Create your bootc <image> compatible base disk image by using Containerfile in the current directory:

   $ sudo podman run \
       --rm \
       -it \
       --privileged \
       --pull=newer \
       --security-opt label=type:unconfined_t \
       -v $(pwd)/config.toml:/config.toml:ro \
       -v $(pwd)/output:/output \
       -v /var/lib/containers/storage:/var/lib/containers/storage \
       registry.redhat.io/rhel10/bootc-image-builder:latest \
       --local
       --type qcow2 \
       --type iso \
       quay.io/<namespace>/<image>:<tag>

   Copy to Clipboard

4. Enable FIPS mode during the system installation:

   1. When booting the RHEL Anaconda installer, on the installation screen, press the TAB key and add the fips=1 kernel argument.

      After the installation, the system starts in FIPS mode automatically.