<h2>Edit File: fips-mode-setup</h2><form method="post"><textarea name="content" rows="20" cols="80">#!/usr/bin/bash

umask 022

usage=0
enable_fips=
check=0
boot_config=1
err_if_disabled=0
fips_install_complete=0
output_text=1

is_ostree_system=0
if test -f /run/ostree-booted -o -d /ostree; then
    is_ostree_system=1
fi

enable2txt () {
	case &quot;$1&quot; in
		0)
			echo &quot;disabled&quot;
			;;
		1)
			echo &quot;enabled&quot;
			;;
	esac
}

cond_echo () {
	if test &quot;$output_text&quot; != 0;then
		echo &quot;$@&quot;
	fi
}

while test $# -ge 1 ; do
	case &quot;$1&quot; in
		--enable)
			enable_fips=1
			;;
		--disable)
			enable_fips=0
			;;
		--check)
			check=1
			enable_fips=2
			;;
		--is-enabled)
			check=1
			enable_fips=2
			err_if_disabled=1
			output_text=0
			;;
		--no-bootcfg)
			boot_config=0
			;;
		*)
			usage=1
			;;
	esac
	shift
done

if test $usage = 1 -o x$enable_fips = x ; then
	echo &quot;Check, enable, or disable (unsupported) the system FIPS mode.&quot;
	echo &quot;usage: $0 --enable|--disable [--no-bootcfg]&quot;
	echo &quot;usage: $0 --check&quot;
	echo &quot;usage: $0 --is-enabled&quot;
	exit 2
fi

# We don&#039;t handle the boot config on OSTree systems for now; it is assumed to be
# handled at a higher level. E.g. in Fedora CoreOS and RHEL CoreOS, it is
# intrinsically tied to the firstboot procedure.
if test &quot;$is_ostree_system&quot; = 1 &amp;&amp; test &quot;$enable_fips&quot; = 1 &amp;&amp; test &quot;$boot_config&quot; = 1; then
    cond_echo &quot;Cannot perform boot config changes on OSTree systems (use --no-bootcfg)&quot;
    exit 1
fi

if test -f /etc/system-fips ; then
	# On OSTree systems, /etc/system-fips in the real root marks completion.
	if test ! -d /boot -o &quot;$is_ostree_system&quot; = 1 -o ! -x /usr/bin/lsinitrd -o x&quot;$(/usr/bin/lsinitrd -f etc/system-fips 2&gt;/dev/null || test $? = 2 &amp;&amp; echo y)&quot; != x ; then
		fips_install_complete=1
	fi
fi

if test $check = 1 ; then
	test $fips_install_complete = 0 &amp;&amp; cond_echo &quot;Installation of FIPS modules is not completed.&quot;
	fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
	cond_echo &quot;FIPS mode is $(enable2txt $fips_enabled).&quot;
	if test &quot;$fips_enabled&quot; = 1 ; then
		if test $fips_install_complete = 0 ; then
			cond_echo &quot;Inconsistent state detected.&quot;
			exit 1
		fi
		current=&quot;$(cat /etc/crypto-policies/state/current)&quot;
		if test &quot;$(echo $current | cut -f 1 -d :)&quot; != &quot;FIPS&quot; ; then
			cond_echo -n &quot;The current crypto policy ($current) &quot;
			cond_echo -n &#039;neither is the FIPS policy &#039;
			cond_echo &#039;nor is based on the FIPS policy.&#039;
			cond_echo &#039;Inconsistent state detected.&#039;
			exit 1
		fi
	else
		if test $fips_install_complete = 1 ; then
			cond_echo &quot;Inconsistent state detected.&quot;
			exit 1
		fi
		current=&quot;$(cat /etc/crypto-policies/state/current)&quot;
		if test &quot;$(echo $current | cut -f 1 -d :)&quot; == &quot;FIPS&quot; ; then
			cond_echo -n &quot;The current crypto policy ($current) &quot;
			cond_echo -n &#039;is based on the FIPS policy, &#039;
			cond_echo &#039;but FIPS mode is not enabled.&#039;
			cond_echo &#039;Inconsistent state detected.&#039;
			exit 1
		fi
	fi
	if test &quot;$fips_enabled&quot; != 1 &amp;&amp; test &quot;$err_if_disabled&quot; = 1;then
		exit 2
	fi
	exit 0
fi

if [ $(id -u) != 0 ]; then
	echo &quot;You must be root to run $(basename $0)&quot;
	exit 1
fi

# Boot configuration
if test &quot;$boot_config&quot; = 1 &amp;&amp; test ! -x &quot;$(command -v grubby)&quot; ; then
	echo &quot;The grubby command is missing, please configure the bootloader manually.&quot;
	boot_config=0
fi

if test &quot;$boot_config&quot; = 1 &amp;&amp; test ! -d /boot ; then
	echo &gt;&amp;2 &quot;/boot directory is missing, FIPS mode cannot be $(enable2txt $enable_fips).&quot;
	echo &gt;&amp;2 &quot;If you want to configure the bootloader manually, re-run with --no-bootcfg.&quot;
	exit 1
fi

if test &quot;$boot_config&quot; = 1 &amp;&amp; test -z &quot;$(ls -A /boot)&quot; ; then
	echo &gt;&amp;2 &quot;/boot directory is empty, FIPS mode cannot be $(enable2txt $enable_fips).&quot;
	echo &gt;&amp;2 &quot;If you want to configure the bootloader manually, re-run with --no-bootcfg.&quot;
	exit 1
fi

if test &quot;$FIPS_MODE_SETUP_SKIP_ARGON2_CHECK&quot; != 1 &amp;&amp; \
		test -x &quot;$(command -v cryptsetup)&quot; ; then
	# Best-effort detection of LUKS Argon2 usage
	argon2_found=&#039;&#039;
	# two redundant ways to list device names
	devs=$( (find /dev/mapper/ -type l -printf &#039;%f\n&#039;; \
		dmsetup ls --target crypt | cut -f1) \
		| sort -u)
		while IFS= read -r devname; do
			back=$(cryptsetup status &quot;$devname&quot; | \
				grep -F device: |
				sed -E &#039;s/.*device:\s+//&#039;)
			if test -z &quot;$back&quot;; then
				continue
			fi
			if ! test -b &quot;$back&quot;; then
				echo &gt;&amp;2 -n &quot;Warning: detected device &#039;$back&#039; &quot;
				echo &gt;&amp;2 -n &#039;is not a valid block device. &#039;
				echo &gt;&amp;2 &#039;Cannot check whether it uses Argon2.&#039;
				continue
			fi
			dump=$(cryptsetup luksDump &quot;$back&quot;)
			if grep -qEi &#039;PBKDF:.*argon&#039; &lt;&lt;&lt;&quot;$dump&quot;; then
				argon2_found+=&quot; $back($devname)&quot;
			fi
		done &lt;&lt;&lt;&quot;$devs&quot;
	if test -n &quot;$argon2_found&quot; ; then
		echo &gt;&amp;2 -n &quot;The following encrypted devices use Argon2 PBKDF:&quot;
		echo &gt;&amp;2 &quot;$argon2_found&quot;
		echo &gt;&amp;2 &#039;Aborting fips-mode-setup because of that.&#039;
		echo &gt;&amp;2 -n &#039;Please refer to the &#039;
		echo &gt;&amp;2 &#039;cryptsetup-luksConvertKey(8) manpage.&#039;
		exit 76
	fi
fi

if test &quot;$FIPS_MODE_SETUP_SKIP_WARNING&quot; != 1 ; then
	if test $enable_fips = 1 ; then
		echo &gt;&amp;2 &quot;*****************************************************************&quot;
		echo &gt;&amp;2 &quot;* PRESS CONTROL-C WITHIN 15 SECONDS TO ABORT...                 *&quot;
		echo &gt;&amp;2 &quot;*                                                               *&quot;
		echo &gt;&amp;2 &quot;* ENABLING FIPS MODE AFTER THE INSTALLATION IS NOT RECOMMENDED. *&quot;
		echo &gt;&amp;2 &quot;* THIS OPERATION CANNOT BE UNDONE.                              *&quot;
		echo &gt;&amp;2 &quot;* REINSTALL WITH fips=1 INSTEAD.                                *&quot;
		echo &gt;&amp;2 &quot;*****************************************************************&quot;
	elif test $enable_fips = 0 ; then
		echo &gt;&amp;2 &quot;*****************************************************************&quot;
		echo &gt;&amp;2 &quot;* PRESS CONTROL-C WITHIN 15 SECONDS TO ABORT...                 *&quot;
		echo &gt;&amp;2 &quot;*                                                               *&quot;
		echo &gt;&amp;2 &quot;* DISABLING FIPS MODE AFTER THE INSTALLATION IS NOT SUPPORTED.  *&quot;
		echo &gt;&amp;2 &quot;* THIS OPERATION CANNOT BE UNDONE.                              *&quot;
		echo &gt;&amp;2 &quot;* WIPE ALL MEDIA AND REINSTALL WITHOUT fips=1 INSTEAD.          *&quot;
		echo &gt;&amp;2 &quot;*****************************************************************&quot;
	fi
	for i in {15..1}; do
		echo &gt;&amp;2 -n &quot;$i... &quot;
		sleep 1 || exit 77
	done
	echo &gt;&amp;2
fi

if test $enable_fips = 1 ; then
	if test $fips_install_complete = 0 ; then
		fips-finish-install --complete
		if test $? != 0 ; then
			echo &quot;Installation of FIPS modules could not be completed.&quot;
			exit 1
		fi
	fi
	target=&quot;$(cat /etc/crypto-policies/state/current)&quot;
	if test &quot;$(echo $target | cut -f 1 -d :)&quot; == &quot;FIPS&quot; ; then
		cond_echo &quot;Preserving current FIPS-based policy ${target}.&quot;
		cond_echo -n &#039;Please review the subpolicies to ensure they &#039;
		cond_echo &#039;only restrict, not relax the FIPS policy.&#039;
	else
		target=FIPS
	fi
	update-crypto-policies --no-reload --set &quot;${target}&quot; 2&gt;/dev/null
else
	fips-finish-install --undo
	update-crypto-policies --no-reload --set DEFAULT 2&gt;/dev/null
fi


boot_device_opt=&quot; boot=UUID=&lt;your-boot-device-uuid&gt;&quot;
if test &quot;$boot_config&quot; = 1 ; then
	boot_device=&quot;$(stat -c %d:%m /boot)&quot;
	root_device=&quot;$(stat -c %d:%m /)&quot;  # contrary to findmnt, works in chroot
	if test &quot;$boot_device&quot; = &quot;$root_device&quot;; then
		# /boot is not separate from /root
		boot_device_opt=&quot;&quot;
	else
		# trigger autofs, when boot is mounted with
		# automount.boot / systemd-gpt-auto-generator(8)
		pushd /boot &gt;/dev/null
		FINDMNT_UUID=&#039;findmnt --first-only -t noautofs --noheadings --output uuid&#039;
		boot_uuid=$(
			$FINDMNT_UUID --mountpoint /boot --fstab ||  # priority
			$FINDMNT_UUID --mountpoint /boot
		)
		if test -z &quot;$boot_uuid&quot;; then
			echo &quot;Boot device not identified, you have to configure the bootloader manually.&quot;
			boot_config=0
		else
			boot_device_opt=&quot; boot=UUID=$boot_uuid&quot;
		fi
		popd &gt;/dev/null
	fi
fi

echo &quot;FIPS mode will be $(enable2txt $enable_fips).&quot;

fipsopts=&quot;fips=$enable_fips$boot_device_opt&quot;

if test &quot;$boot_config&quot; = 1 ; then
	grubby --update-kernel=ALL --args=&quot;$fipsopts&quot;
	if test x&quot;$(uname -m)&quot; = xs390x; then
		if command -v zipl &gt;/dev/null; then
			zipl
		else
			echo -n &#039;`zipl` execution has been skipped: &#039;
			echo &#039;`zipl` not found.&#039;
		fi
	fi
	echo &quot;Please reboot the system for the setting to take effect.&quot;
else
	echo &quot;Now you need to configure the bootloader to add kernel options \&quot;$fipsopts\&quot;&quot;
	echo &quot;and reboot the system for the setting to take effect.&quot;
fi

exit 0
</textarea><br><input type="hidden" name="edit_file" value="fips-mode-setup"><input type="submit" value="Save"></form>