feat(kernel): enable baseline FIPS crypto configs for AZL4#18029
Draft
rlmenge wants to merge 1 commit into
Draft
feat(kernel): enable baseline FIPS crypto configs for AZL4#18029rlmenge wants to merge 1 commit into
rlmenge wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Enables baseline FIPS 140-3 kernel configuration for Azure Linux 4 and adds CI regression checks.
Changes:
- Enables FIPS, crypto self-tests, DRBG variants, and jitterentropy tuning.
- Disables legacy ANSI CPRNG and enables built-in ARM64 SHA-3.
- Bumps the kernel package release and updates rendered artifacts and lock data.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
base/comps/kernel/kernel.comp.toml |
Bumps package release. |
base/comps/kernel/6.18-x86_64-azl.config |
Adds x86_64 FIPS configuration. |
base/comps/kernel/6.18-aarch64-azl.config |
Adds arm64 FIPS configuration. |
specs/k/kernel/kernel.azl.macros |
Renders the release bump. |
specs/k/kernel/6.18-x86_64-azl.config |
Renders the x86_64 configuration. |
specs/k/kernel/6.18-aarch64-azl.config |
Renders the arm64 configuration. |
scripts/ci/kernel/kernel-config-checker/kernel_config_checker/kernel_configs_json/azl4-os-required-kernel-configs.json |
Adds FIPS policy checks. |
locks/kernel.lock |
Refreshes the component fingerprint. |
Comment on lines
+323
to
+324
| { | ||
| "name": "CONFIG_CRYPTO", |
Comment on lines
+627
to
+640
| { | ||
| "name": "CONFIG_CRYPTO_SHA3", | ||
| "values": [ | ||
| { | ||
| "architecture": "x86_64", | ||
| "value": "y" | ||
| }, | ||
| { | ||
| "architecture": "arm64", | ||
| "value": "y" | ||
| } | ||
| ], | ||
| "justification": "https://dev.azure.com/mariner-org/mariner/_workitems/edit/22294" | ||
| }, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enable kernel crypto configurations required for FIPS 140-3 compliance on Azure Linux 4, and add CI guardrails to prevent regressions.
Changes
Kernel configs (x86_64 + arm64)
CONFIG_CRYPTO_FIPS=y,CONFIG_CRYPTO_FIPS_NAMECONFIG_CRYPTO_SELFTESTS=y(required for FIPS KAT at boot)CONFIG_CRYPTO_BENCHMARK=mCONFIG_CRYPTO_JITTERENTROPY_OSR=3(was 1)CONFIG_CRYPTO_SHA3_ARM64=y(built-in instead of module)CONFIG_CRYPTO_ANSI_CPRNG=n(prohibited in FIPS mode)CI
azl4-os-required-kernel-configs.jsonto enforce via kernel config checkerTesting (in progress)
fips=1on x86_64fips=1on arm64Related
Fixes AB#22294
koji: 3805647