Android FIPS compatibility?

[tomleavy]

Problem:

When -FIPS=ON is set for Android it results in a build failure

Relevant details

AWS-LC commit: 7ada846

Host Platform:

• Arch: x86_64
• OS: Ubuntu 18.04 (docker)

Target Platform:

• Arch: x86_64 + armv8a
• OS: Android NDK 20

Build log:

-- Check for working C compiler: /usr/opt/android/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin/clang
-- Check for working C compiler: /usr/opt/android/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin/clang -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /usr/opt/android/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin/clang++
-- Check for working CXX compiler: /usr/opt/android/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin/clang++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Test stdalign_check.c passed, enabling AWS_LC_STDALIGN_AVAILABLE
-- Test builtin_swap_check.c passed, enabling AWS_LC_BUILTIN_SWAP_SUPPORTED
-- The ASM compiler identification is Clang
-- Found assembler: /usr/opt/android/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin/clang
-- Configuring done
-- Generating done
-- Build files have been written to: /usr/share/build/build_android/build_android_armeabi-v7a/third-party/openssl/aws-lc/openssl-prefix/src/openssl-build
[ 29%] Performing build step for 'openssl'
[  1%] Generating crypto_test_data.cc
Scanning dependencies of target crypto_test_data
[  1%] Building CXX object CMakeFiles/crypto_test_data.dir/crypto_test_data.cc.o
[  1%] Built target crypto_test_data
Scanning dependencies of target boringssl_gtest
[  1%] Building CXX object CMakeFiles/boringssl_gtest.dir/third_party/googletest/src/gtest-all.cc.o
[  2%] Linking CXX static library libboringssl_gtest.a
[  2%] Built target boringssl_gtest
Scanning dependencies of target global_target
[  2%] Built target global_target
Scanning dependencies of target test_support_lib
[  2%] Building CXX object crypto/test/CMakeFiles/test_support_lib.dir/abi_test.cc.o
[  2%] Building CXX object crypto/test/CMakeFiles/test_support_lib.dir/file_test.cc.o
[  2%] Building CXX object crypto/test/CMakeFiles/test_support_lib.dir/malloc.cc.o
[  3%] Building CXX object crypto/test/CMakeFiles/test_support_lib.dir/test_util.cc.o
[  3%] Building CXX object crypto/test/CMakeFiles/test_support_lib.dir/wycheproof_util.cc.o
[  3%] Linking CXX static library libtest_support_lib.a
[  3%] Built target test_support_lib
Scanning dependencies of target fipsmodule
[  3%] Building C object crypto/fipsmodule/CMakeFiles/fipsmodule.dir/fips_shared_support.c.o
[  3%] Built target fipsmodule
Scanning dependencies of target bcm_c_generated_asm
[  3%] Building C object crypto/fipsmodule/CMakeFiles/bcm_c_generated_asm.dir/bcm.c.o
clang: error: argument unused during compilation: '-Wa,--noexecstack' [-Werror,-Wunused-command-line-argument]
crypto/fipsmodule/CMakeFiles/bcm_c_generated_asm.dir/build.make:62: recipe for target 'crypto/fipsmodule/CMakeFiles/bcm_c_generated_asm.dir/bcm.c.o' failed

[bryce-shang]

clang: error: argument unused during compilation: '-Wa,--noexecstack' [-Werror,-Wunused-command-line-argument]

Thank you for reporting this issue.

Currently, awslc FIPS build is just POC(Proof of concept) and only tested with clang-7 on Ubuntu 20.04(x86 and aarch) and AL2(x86 and aarch). awslc FIPS validation is in progress and does not plan to cover Android.

But we do expect awslc FIPS with clang-7 is buildable on the Android. Would you share the docker image (for reproduce)?

[tomleavy]

You can take a look at my repo here: https://github.com/WickrInc/wickr-crypto-c

There is a branch for AWS-LC support and there is a script in the root directory that builds a docker image for the build and then executes it.

Thanks!