feat(openssl): force SymCrypt as FIPS provider in kernel FIPS mode

[Tobias Brick (tobiasb-ms)]

Replaces Fedora's fips.so/fips_local.cnf activation with Azure Linux's SymCrypt provider.

In kernel FIPS mode, openssl now forces activation of symcryptprovider and base, and merges best-effort ?fips=yes into the existing default property query (preserving any application-configured properties).

AB#23016

• Patch80 hard-codes symcryptprovider/symcrypt_prov_sect, matching the drop-in shipped by SymCrypt-OpenSSL.
• openssl-libs now requires SymCrypt-OpenSSL instead of openssl-fips-provider.
• Drops the obsolete fips_local.cnf symlink and %files entry.

Validation:

• Builds locally and on build server.
• Created a new VM with a local dnf repo with the updated openssl rpms. Updated openssl, put the machine into kernel FIPS mode and rebooted. I was able to ssh into the machine, do general openssl operations and dnf --refresh install something (which is a real-world usage of openssl).

[Copilot]

Pull request overview

Replaces Fedora’s OpenSSL FIPS provider integration with Azure Linux’s SymCrypt provider.

Changes:

• Adds kernel-FIPS SymCrypt activation and property-query tests.
• Replaces the provider dependency and removes obsolete FIPS configuration.
• Refreshes rendered output and the component lock.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
base/comps/openssl/openssl.comp.toml	Defines SymCrypt overlays.
base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch	Implements and tests FIPS behavior.
specs/o/openssl/openssl.spec	Contains rendered packaging changes.
specs/o/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch	Contains the rendered patch.
locks/openssl.lock	Refreshes the input fingerprint.

Suppressed comments (1)

base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch:498

• This test codifies a fail-open path: with config_diagnostics = 0, failure to find or activate mandatory SymCrypt is ignored and OpenSSL continues without SymCrypt or the merged FIPS property query. Kernel FIPS mode should make forced-provider activation failures fatal; update initialization accordingly and assert this command fails when the section/provider is unavailable.

+$ENV{OPENSSL_FORCE_FIPS_MODE} = 1;
+$ENV{OPENSSL_CONF} = srctop_file("test", "prov_conf_symcrypt_missing.cnf");
+
+ok(run(app(["openssl", "list", "-providers"])),
+   "real init retains Fedora's ignored provider-module failure behavior");

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (3)

base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch:111

• In kernel FIPS mode, a custom OPENSSL_CONF that omits the system drop-in now makes this module return failure instead of loading SymCrypt. Because the shipped/default behavior uses config_diagnostics = 0, OPENSSL_init_crypto() ignores that failure (the new real-init test explicitly relies on this), so the process can continue without SymCrypt, base, or ?fips=yes. This defeats the promised forced activation. Load the packaged SymCrypt configuration from a trusted fixed path, or fall back to activating symcryptprovider by name when the ambient section is absent.

+        if (NCONF_get_section(cnf, AZL_FIPS_PROVIDER_SECTION) == NULL) {
+            ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_SECTION_ERROR,
+                           "section=%s not found", AZL_FIPS_PROVIDER_SECTION);
+            return 0;

base/comps/openssl/overlays/0001-force-symcrypt-fips.overlay.toml:15

• The unversioned dependency can be satisfied by an engine-only SymCrypt-OpenSSL release: this repository's own changelog records that the OpenSSL 3 provider was introduced in 1.4.0 (specs/s/SymCrypt-OpenSSL/SymCrypt-OpenSSL.spec:184-186). Such a transaction would satisfy RPM while leaving the required module/config section absent. Require at least the provider-bearing version whose OpenSSL 3.5 configuration was verified (preferably the current 1.11.0).

replacement = 'Requires: SymCrypt-OpenSSL'

base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch:498

• This “real init” test only checks a zero exit status while deliberately supplying a configuration with no SymCrypt section; it therefore passes when provider initialization fails and that failure is ignored. The other tests use p_test.so and a nondefault library context, so no test exercises successful global initialization against the packaged provider contract. Add a valid real-init case that asserts symcryptprovider and base are listed and the merged property is effective.

+$ENV{OPENSSL_FORCE_FIPS_MODE} = 1;
+$ENV{OPENSSL_CONF} = srctop_file("test", "prov_conf_symcrypt_missing.cnf");
+
+ok(run(app(["openssl", "list", "-providers"])),
+   "real init retains Fedora's ignored provider-module failure behavior");

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch:127

• The merge happens while the providers config module is running, but config modules execute in file order and the shipped openssl_init lists providers before alg_section (0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch:95-120). If an application sets default_properties in that same config, the later alg module calls evp_set_default_properties_int() and replaces this merged query, so kernel FIPS mode ends without ?fips=yes. The tests hide this by loading the property config in a separate call first. Apply the FIPS merge after alg_section processing (or otherwise after all config modules), and add a single-config ordering test.

+        if (evp_default_properties_merge(libctx, "?fips=yes", 0) != 1)

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch:127

• The FIPS property can be overwritten later in the same configuration load. OpenSSL runs modules in [openssl_init] order, and the shipped config places providers before alg_section; when an application sets default_properties, alg_module_init() subsequently replaces the global query, removing this ?fips=yes. The test avoids this path by loading app_cnf in a separate earlier call. Reapply the FIPS merge after algorithm configuration and add a single-config test with providers before alg_section.

+        if (evp_default_properties_merge(libctx, "?fips=yes", 0) != 1)

[Tobias Brick (tobiasb-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

base/comps/openssl/0080-azl-force-symcrypt-in-kernel-fips-mode.patch:127

• ?fips=yes is optional, and OpenSSL 3.5.4's ossl_property_is_enabled() explicitly returns false for optional clauses. Consequently EVP_default_properties_is_fips_enabled() (and FIPS_mode()) remains false in kernel FIPS mode, disabling existing FIPS-gated behavior such as the RSA cipher restrictions, FIPS RNG path, PKCS#12 defaults, and weak-curve filtering. Please retain a mandatory FIPS indicator or introduce a separate kernel-FIPS state for those checks while keeping optional provider fallback, and add a regression assertion for the FIPS-mode API.

+        if (evp_default_properties_merge(libctx, "?fips=yes", 0) != 1)

[Tobias Brick (tobiasb-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.