Skip to content

Commit 1165b48

Browse files
committed
configs: Ensure FIPS settings defined
We want to hard set the x86_64 FIPS required configs rather than rely on default settings in the kernel, should these ever change without our knowing it would not be something we would have actively checked. The configs are a limited set of configs that is expanded out when building using `make olddefconfig` a common practice in kernel building. Note had to manually add the following since its normaly set by the RPM build process. CONFIG_CRYPTO_FIPS_NAME="Rocky Linux 9 Kernel Cryptographic API" Signed-off-by: Jonathan Maple <[email protected]>
1 parent 5023d24 commit 1165b48

File tree

2 files changed

+22
-0
lines changed

2 files changed

+22
-0
lines changed

configs/kernel-x86_64-debug-rhel.config

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7194,3 +7194,14 @@ CONFIG_ZSWAP=y
71947194
# CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD is not set
71957195
CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD=y
71967196
# CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC is not set
7197+
7198+
CONFIG_X509_CERTIFICATE_PARSER=y
7199+
CONFIG_PKCS7_MESSAGE_PARSER=y
7200+
CONFIG_FIPS_SIGNATURE_SELFTEST=y
7201+
CONFIG_FIPS_SIGNATURE_SELFTEST_RSA=y
7202+
CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA=y
7203+
CONFIG_CRYPTO_DRBG=y
7204+
CONFIG_CRYPTO_FIPS=y
7205+
CONFIG_CRYPTO_FIPS_CUSTOM_VERSION=y
7206+
CONFIG_CRYPTO_FIPS_VERSION="rocky9.20250725"
7207+
CONFIG_CRYPTO_FIPS_NAME="Rocky Linux 9 Kernel Cryptographic API"

configs/kernel-x86_64-rhel.config

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7171,3 +7171,14 @@ CONFIG_ZSWAP=y
71717171
# CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD is not set
71727172
CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD=y
71737173
# CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC is not set
7174+
7175+
CONFIG_X509_CERTIFICATE_PARSER=y
7176+
CONFIG_PKCS7_MESSAGE_PARSER=y
7177+
CONFIG_FIPS_SIGNATURE_SELFTEST=y
7178+
CONFIG_FIPS_SIGNATURE_SELFTEST_RSA=y
7179+
CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA=y
7180+
CONFIG_CRYPTO_DRBG=y
7181+
CONFIG_CRYPTO_FIPS=y
7182+
CONFIG_CRYPTO_FIPS_CUSTOM_VERSION=y
7183+
CONFIG_CRYPTO_FIPS_VERSION="rocky9.20250725"
7184+
CONFIG_CRYPTO_FIPS_NAME="Rocky Linux 9 Kernel Cryptographic API"

0 commit comments

Comments
 (0)