Skip to content

feat(kernel): enable baseline FIPS crypto configs for AZL4 #18029

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
christopherco merged 1 commit into from
Jul 18, 2026
Merged

feat(kernel): enable baseline FIPS crypto configs for AZL4 #18029

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions base/comps/kernel/6.18-aarch64-azl.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13558,6 +13558,9 @@ CONFIG_CRYPTO=y
#
# Crypto core or helper
#
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_FIPS_NAME="Linux Kernel Cryptographic API"
# CONFIG_CRYPTO_FIPS_CUSTOM_VERSION is not set
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
Expand All @@ -13580,13 +13583,14 @@ CONFIG_CRYPTO_HKDF=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
CONFIG_CRYPTO_USER=m
# CONFIG_CRYPTO_SELFTESTS is not set
CONFIG_CRYPTO_SELFTESTS=y
# CONFIG_CRYPTO_SELFTESTS_FULL is not set
CONFIG_CRYPTO_NULL=y
CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=m
CONFIG_CRYPTO_AUTHENC=m
CONFIG_CRYPTO_KRB5ENC=m
# CONFIG_CRYPTO_BENCHMARK is not set
CONFIG_CRYPTO_BENCHMARK=m

@jbarneswebme jbarneswebme Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CONFIG_CRYPTO_BENCHMARK is a current requirement for dracut. I don't see a need for it once dracut is refactored to remove self tests. It was originally required for FIPS self-tests prior to first use. Because the fips-allowed crypto modules listed in lsinitrd /boot/initramfs-$(uname -r).img etc/fipsmodules are now compiled into the kernel, they are automatically loaded and the testmgr invokes self-tests which, when booted with fips=1 parameter, causes the testmgr to panic the kernel when the self-tests fail.

If you are interested in benchmarks, keep it, (but with the dracut refactor, it can be =y too). Otherwise this config is not really necessary.

CONFIG_CRYPTO_ENGINE=m
# end of Crypto core or helper

Expand Down Expand Up @@ -13698,16 +13702,21 @@ CONFIG_CRYPTO_ZSTD=m
#
# Random number generation
#
CONFIG_CRYPTO_ANSI_CPRNG=m
# CONFIG_CRYPTO_ANSI_CPRNG is not set
CONFIG_CRYPTO_DRBG_MENU=y
CONFIG_CRYPTO_DRBG_HMAC=y
CONFIG_CRYPTO_DRBG_HASH=y
CONFIG_CRYPTO_DRBG_CTR=y
CONFIG_CRYPTO_DRBG=y
CONFIG_CRYPTO_JITTERENTROPY=y
CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_1024 is not set
# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
CONFIG_CRYPTO_JITTERENTROPY_OSR=1
CONFIG_CRYPTO_JITTERENTROPY_OSR=3
# CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
CONFIG_CRYPTO_KDF800108_CTR=y
# end of Random number generation

Expand All @@ -13729,7 +13738,7 @@ CONFIG_CRYPTO_NHPOLY1305_NEON=m
# Accelerated Cryptographic Algorithms for CPU (arm64)
#
CONFIG_CRYPTO_GHASH_ARM64_CE=m
CONFIG_CRYPTO_SHA3_ARM64=m
CONFIG_CRYPTO_SHA3_ARM64=y
CONFIG_CRYPTO_SM3_NEON=m
CONFIG_CRYPTO_SM3_ARM64_CE=m
CONFIG_CRYPTO_POLYVAL_ARM64_CE=m
Expand Down
17 changes: 13 additions & 4 deletions base/comps/kernel/6.18-x86_64-azl.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7679,6 +7679,9 @@ CONFIG_CRYPTO=y
#
# Crypto core or helper
#
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_FIPS_NAME="Linux Kernel Cryptographic API"
# CONFIG_CRYPTO_FIPS_CUSTOM_VERSION is not set
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
Expand All @@ -7701,13 +7704,14 @@ CONFIG_CRYPTO_HKDF=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
CONFIG_CRYPTO_USER=m
# CONFIG_CRYPTO_SELFTESTS is not set
CONFIG_CRYPTO_SELFTESTS=y
# CONFIG_CRYPTO_SELFTESTS_FULL is not set
CONFIG_CRYPTO_NULL=y
CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=m
CONFIG_CRYPTO_AUTHENC=m
CONFIG_CRYPTO_KRB5ENC=m
# CONFIG_CRYPTO_BENCHMARK is not set
CONFIG_CRYPTO_BENCHMARK=m
CONFIG_CRYPTO_ENGINE=m
# end of Crypto core or helper

Expand Down Expand Up @@ -7818,16 +7822,21 @@ CONFIG_CRYPTO_ZSTD=m
#
# Random number generation
#
CONFIG_CRYPTO_ANSI_CPRNG=m
# CONFIG_CRYPTO_ANSI_CPRNG is not set
CONFIG_CRYPTO_DRBG_MENU=y
CONFIG_CRYPTO_DRBG_HMAC=y
CONFIG_CRYPTO_DRBG_HASH=y
CONFIG_CRYPTO_DRBG_CTR=y
CONFIG_CRYPTO_DRBG=y
CONFIG_CRYPTO_JITTERENTROPY=y
CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y
# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_128 is not set
# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_1024 is not set
# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_8192 is not set
CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
CONFIG_CRYPTO_JITTERENTROPY_OSR=1
CONFIG_CRYPTO_JITTERENTROPY_OSR=3
# CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
CONFIG_CRYPTO_KDF800108_CTR=y
# end of Random number generation

Expand Down
5 changes: 4 additions & 1 deletion base/comps/kernel/kernel.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ without = [

[components.kernel.build.defines]
# RPM release number for the Azure Linux kernel package
azl_pkgrelease = "5"
azl_pkgrelease = "6"
# 4th version component from the AZL kernel source (6.18.31.1). Included in specrelease so it appears
# in the RPM Release tag, uname -r, and /lib/modules/ path (e.g. 6.18.31-1.1.azl4.aarch64).
kextraversion = "1"
Expand Down Expand Up @@ -360,6 +360,9 @@ description = "Prepend AZL changelog entries (one per lock-fingerprint change) a
type = "spec-prepend-lines"
section = "%changelog"
lines = [
"* Wed Jul 15 2026 Rachel Menge <rachelmenge@microsoft.com> - 6.18.31-1.6",
"- feat(kernel): enable FIPS crypto configs and checker CI",
"",
"* Wed May 27 2026 Daniel McIlvaney <damcilva@microsoft.com> - 6.18.31-1.5",
"- feat(kernel): add hand-curated changelog entry",
"",
Expand Down
2 changes: 1 addition & 1 deletion locks/kernel.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@
version = 1
import-commit = '5271a1b047ef402ddee40242e02eda23fc273044'
upstream-commit = '5271a1b047ef402ddee40242e02eda23fc273044'
input-fingerprint = 'sha256:35fd40d8d7ed26e4e80c412fbe33499ead22ceac032a92c1be2f3c2f729f7df3'
input-fingerprint = 'sha256:675f6f9765008aa2cc155bb581fb3da60d93cc181480ff67a08d115b363841bd'
resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
Loading
Loading