self-tests for ecdh-nist-p256-generic (ecdh-nist-p256) failed in fips mode

[dcasota]

Describe the bug

I get the following kernel panic information when booting from Ph6 beta nightly build.

The issue appears with VMware-optimized and STIG-hardened settings only.

=========================================================================
Kernel                       | STIG hardening   | resulting boot behavior
-------------------------------------------------------------------------
generic                      |     no           | vm boots successfully
generic                      |     yes          | vm boots successfully
VMware hypervisor optimised  |     no           | vm boots successfully
VMware hypervisor optimised  |     yes          | vm boot fails
=========================================================================

Reproduction steps

1. Make build of full iso from branch 6.0, photon-5.0-b21a7d438.x86_64.iso, b21a7d4
2. create a new vm with following settings [20gb harddisk, 8gb ram, boot from photon-5.0-b21a7d438.x86_64.iso, mbr boot]
3. Ph6 setup: Install, Accept EULA, 20gb disk, Photon minimal, configure network automatically, VMware hypervisor optimised, apply STIG hardening yes, hostname, password twice, finish. Installation finishes successfully.
4. reboot.
   --
   Workstation vmware.log

Expected behavior

successful setup

Additional context

Observations

Case 1: Kernel: generic, STIG hardening: no

login window appears.

The kauditd hold queue overflow warning can be solved e.g. by adding audit_backlog_limit=8192 to /boot/photon.cfg.

if ! grep -q 'audit_backlog_limit=8192' /boot/photon.cfg; then
    sed -i.bak 's/audit=1/audit=1 audit_backlog_limit=8192/' /boot/photon.cfg
fi

Case 2: Kernel: generic, STIG hardening: yes

login window appears.

Case 2b: Kernel: generic, STIG hardening: yes, firmware type switched to uefi

login window appears.

Case 3: Kernel: VMware hypervisor-optimised, STIG hardening: no

login window appears.

[YustasSwamp]

The issue is acknowledged.

We are working on LKCM 6.12 fips canister development in generic flavor, as a side effect linux-esx is broken in fips mode. Once canister done, we will verify its applicability on top of other kernel flavors.

[dcasota]

Awesome! the issue seems fixed.

I've tested following x86_64 combinations:

• Firmware type
  • mbr (fips mode disabled)
  • uefi (fips mode enabled)
• Flavor
  • minimal
  • developer
• Trusted Platform Module
  • no tpm
  • with VMware Workstation software-tpm

=========================================================================
Kernel                       | STIG hardening   | resulting boot behavior
-------------------------------------------------------------------------
generic                      |     no           | vm boots successfully
generic                      |     yes          | vm boots successfully
VMware hypervisor optimised  |     no           | vm boots successfully
VMware hypervisor optimised  |     yes          | vm boots successfully
=========================================================================

But, there are differences:

• 6.12.41-2.ph5-esx
  In this nightly build (photon-5.0-5b2cd1191.x86_64), there are no "approved service" messages in journal log, only "self-tests passed" messages.

• 6.1.130-2.ph5-esx
  In this nightly build (photon-5.0-f7e5808d2.x86_64), there are "self-tests passed" messages and additionally "approved service" messages.

---

---

various findings

Console in 6.12.41-2.ph5-esx

• In Mbr mode, the console changes to:
• In Uefi mode, the console changes to:

The higher value in Mbr would be nice for Uefi as well.

miscellaneous warnings