FIPS compliance

[mudler]

• FIPS enabled Kairos flavors #361
• Documentation: enable fips from bootargs #364
• Add FIPS dracut module #363
• 📖 Create FIPS e2e examples for BYOI #362

Plan:

• Build a FIPS version of all packages
• Build one special "hardened" flavor using these packages (not the whole matrix) (as part of every release)
  (rockylinux is a good candidate because is SELinux ready and we are going to need it in the future).
• Make sure we run some of our tests on that flavor (NOTE: rockylinux doesn't boot in Qemu out of the box, needs some work, 🐧 rockylinux flavor #64 (comment))

[jimmykarily]

Useful: https://go.googlesource.com/go/+/dev.boringcrypto/README.boringcrypto.md

~/workspace/kairos/kairos-agent (main)$ GOEXPERIMENT=boringcrypto go build 
~/workspace/kairos/kairos-agent (main)$ go tool nm ./kairos  | grep FIPS
  462b80 t BORINGSSL_FIPS_abort
  45ea80 t FIPS_mode_set
  45ea90 t FIPS_read_counter
  401a30 T _cgo_d8b1bdd8e714_Cfunc__goboringcrypto_FIPS_mode
  45ea70 t _goboringcrypto_FIPS_mode
  737500 T crypto/internal/boring._Cfunc__goboringcrypto_FIPS_mode.abi0
 1d22bf0 D crypto/internal/boring._cgo_d8b1bdd8e714_Cfunc__goboringcrypto_FIPS_mode
 1d249b0 D crypto/tls.defaultCipherSuitesFIPS
 1d24a30 D crypto/tls.defaultFIPSCurvePreferences

while:

~/workspace/kairos/kairos-agent (main)$ go build 
~/workspace/kairos/kairos-agent (main)$ go tool nm ./kairos  | grep FIPS

(empty output)

[mudler]

the subtle problem of FIPS is that requires cgo enabled

[jimmykarily]

the subtle problem of FIPS is that requires cgo enabled

Does this mean we cannot cross compile anymore? This would require lots of changes in the release pipelines I assume.

[mudler]

the subtle problem of FIPS is that requires cgo enabled

Does this mean we cannot cross compile anymore? This would require lots of changes in the release pipelines I assume.

correct, at least, you can create static binaries still even with CGO enabled, however there are several limitations we have to watch out in that specific case.

[mudler]

Closing as we have full examples of BYOI to generate FIPS enabled images https://github.com/kairos-io/kairos/blob/master/examples/byoi/fedora-fips/