content icon indicating copy to clipboard operation
content copied to clipboard

Rule enable_fips_mode doesn't work on s390x architecture

Open jan-cerny opened this issue 3 years ago • 0 comments

Description of problem:

Rule enable_fips_mode on RHEL 8 checks if the kernel boot parameter is configured for FIPS mode as a part of the OVAL check, but it checks the GRUB 2 configuration, the OVAL test "test_grubenv_fips_mode" reads from /boot/grub2/grubenv, but there is no such file on s390x architecture, because this architecture uses the ZIPL bootloader instead of GRUB 2.

SCAP Security Guide Version:

Upstream as of HEAD 61b8f59

Operating System Version:

RHEL 8, s390x architecture

Steps to Reproduce:

  1. oscap xccdf eval --progress --report enable_fips.html --rule xccdf_org.ssgproject.content_rule_enable_fips_mode --profile xccdf_org.ssgproject.content_profile_ospp ssg-rhel8-ds.xml

Actual Results:

xccdf_org.ssgproject.content_rule_enable_fips_mode:fail

Expected Results:

xccdf_org.ssgproject.content_rule_enable_fips_mode:pass

Additional Information/Debugging Steps:

no

jan-cerny avatar Aug 08 '22 09:08 jan-cerny