rust-keylime
rust-keylime copied to clipboard
Use system-wide crypto configuration instead of setting a local one
This is a follow-up on the discussion about using the system-wide crypto configuration instead of setting a locally. See the conclusion of the discussion: https://github.com/keylime/rust-keylime/pull/761/files#r1581052015
There is no easy way to make rust-openssl to use the system-wide openssl configuration. Following the system-wide configuration has advantages:
- No need to select and maintain the local configuration, just follow the system configuration for a sane selection
- When the system-wide configuration is updated, the crypto used by the agent would be updated automatically, without changes in the code or in the configuration
- When the system is running on FIPS mode and sets a FIPS-approved configuration, the agent would follow the configuration automatically
Normally, when the system uses crypto-policies which sets the openssl configuration, it is sufficient for the application to use the default configuration to inherit the system-wide configuration. The problem is that rust-openssl does not provide an easy way to use the openssl default configuration.
Related: #761