Feature: _fips
Description
Enables Federal Information Processing Standard (FIPS) 140-3 mode for cryptographic operations in Garden Linux.
What it does
_fips configures the system to operate in FIPS 140-3 compliance mode. It installs the required FIPS-validated cryptographic providers (openssl-provider-fips, libgnutls28-dev, libssl-dev, gnutls-bin) and places configuration files that activate the OpenSSL FIPS provider, enable FIPS mode for libgcrypt, and add fips=1 to the kernel command line. A dracut configuration ensures the FIPS modules are included in the initrd.
The exec.config and exec.late scripts adjust runtime configuration, and the file.include.markers.yaml maps coverage markers to tests that verify FIPS is correctly activated.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Configures the image at build time to activate FIPS providers and finalize the FIPS setup. |
exec.late (ref) | Applies final FIPS-related changes after all packages are installed. |
file.include.markers.yaml (ref) | Maps files in this feature to test-coverage marker IDs for FIPS verification tests. |
info.yaml (ref) | Declares type: flag and included/excluded features. |
pkg.include (ref) | Installs FIPS-validated cryptographic libraries and tools, including openssl-provider-fips and gnutls-bin. |
file.include/etc/system-fips (file.include) | Marker file that signals to system components that FIPS mode is active. |
file.include/etc/dracut.conf.d/10-fips.conf (file.include) | Instructs dracut to include the fips module so FIPS mode is initialized before the root filesystem mounts. |
file.include/etc/gcrypt/fips_enabled (file.include) | Enables FIPS mode for libgcrypt-based applications. |
file.include/etc/kernel/cmdline.d/30-fips.cfg (file.include) | Adds fips=1 to the kernel command line to enforce FIPS mode at boot. |
file.include/etc/update-motd.d/06-logo (file.include) | Adds a FIPS-mode indicator to the message of the day displayed at login. |
Related features
This feature has no include or exclude relationships.