Chapter 9. Enabling the FIPS mode while building a bootc image

Procedure

1. Create a 01-fips.toml to configure FIPS enablement, for example:

   # Enable FIPS
   kargs = ["fips=1"]

   Copy to Clipboard Toggle word wrap

2. Create a Containerfile with the following instructions to enable the fips=1 kernel argument:

   FROM registry.redhat.io/rhel9/rhel-bootc:latest
   # Enable fips=1 kernel argument: https://bootc-dev.github.io/bootc/building/kernel-arguments.html
   COPY 01-fips.toml /usr/lib/bootc/kargs.d/
   # Enable the FIPS system-wide cryptographic policy
   # crypto-policies-scripts is not installed by default in RHEL-10
   RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS

   Copy to Clipboard Toggle word wrap

3. Create your bootc <image> compatible base disk image by using Containerfile in the current directory:

   $ podman build -t quay.io/<namespace>/<image>:<tag> .

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a 01-fips.toml to configure FIPS enablement, for example:

   # Enable FIPS
   kargs = ["fips=1"]

   Copy to Clipboard Toggle word wrap

2. Create a Containerfile with the following instructions to enable the fips=1 kernel argument:

   FROM registry.redhat.io/rhel9/rhel-bootc:latest
   # Enable fips=1 kernel argument: https://bootc-dev.github.io/bootc/building/kernel-arguments.html
   COPY 01-fips.toml /usr/lib/bootc/kargs.d/
   # Install and enable the FIPS system-wide cryptographic policy
   RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS

   Copy to Clipboard Toggle word wrap

3. Create your bootc <image> compatible base disk image by using Containerfile in the current directory:

   $ sudo podman run \
       --rm \
       -it \
       --privileged \
       --pull=newer \
       --security-opt label=type:unconfined_t \
       -v $(pwd)/config.toml:/config.toml:ro \
       -v $(pwd)/output:/output \
       -v /var/lib/containers/storage:/var/lib/containers/storage \
       registry.redhat.io/rhel9/bootc-image-builder:latest \
       --local
       --type iso \
       quay.io/<namespace>/<image>:<tag>

   Copy to Clipboard Toggle word wrap

4. Enable FIPS mode during the system installation:

   1. When booting the RHEL Anaconda installer, on the installation screen, press the TAB key and add the fips=1 kernel argument.

      After the installation, the system starts in FIPS mode automatically.