From: Herbert Xu <herbert.xu@xxxxxxxxxx> not upstream: Disable vdso getrandom when FIPS is enabled In order to ensure that the FIPS-certified RNG is always used, disable the vdso getrandom code by always making it fall back to getrandom(2) when FIPS mode is enabled. Signed-off-by: Herbert Xu <herbert.xu@xxxxxxxxxx> diff --git a/drivers/char/random.c b/drivers/char/random.c index blahblah..blahblah 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -55,6 +55,7 @@ #include <linux/suspend.h> #include <linux/siphash.h> #include <linux/sched/isolation.h> +#include <linux/fips.h> #include <crypto/chacha.h> #include <crypto/blake2s.h> #ifdef CONFIG_VDSO_GETRANDOM @@ -741,7 +742,8 @@ static void __cold _credit_init_bits(size_t bits) queue_work(system_unbound_wq, &set_ready); atomic_notifier_call_chain(&random_ready_notifier, 0, NULL); #ifdef CONFIG_VDSO_GETRANDOM - WRITE_ONCE(_vdso_rng_data.is_ready, true); + if (!fips_enabled) + WRITE_ONCE(_vdso_rng_data.is_ready, true); #endif wake_up_interruptible(&crng_init_wait); kill_fasync(&fasync, SIGIO, POLL_IN); -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3311 -- _______________________________________________ kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
