Skip to content
This repository has been archived by the owner on May 12, 2021. It is now read-only.

Commit

Permalink
Merge pull request #2171 from amshinde/support-fips-mode
Browse files Browse the repository at this point in the history
FIPS: Add support for starting VM in FIPS mode.
  • Loading branch information
bergwolf authored Nov 11, 2019
2 parents d0615f8 + 0bd41b9 commit 31b5f96
Show file tree
Hide file tree
Showing 2 changed files with 78 additions and 0 deletions.
36 changes: 36 additions & 0 deletions pkg/katautils/create.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ package katautils
import (
"context"
"fmt"
"io/ioutil"
"strconv"
"strings"

vc "github.com/kata-containers/runtime/virtcontainers"
vf "github.com/kata-containers/runtime/virtcontainers/factory"
Expand Down Expand Up @@ -115,6 +118,10 @@ func CreateSandbox(ctx context.Context, vci vc.VC, ociSpec specs.Spec, runtimeCo
sandboxConfig.Stateful = true
}

if err := checkForFIPS(&sandboxConfig); err != nil {
return nil, vc.Process{}, err
}

if !rootFs.Mounted && len(sandboxConfig.Containers) == 1 {
if rootFs.Source != "" {
realPath, err := ResolvePath(rootFs.Source)
Expand Down Expand Up @@ -175,6 +182,35 @@ func CreateSandbox(ctx context.Context, vci vc.VC, ociSpec specs.Spec, runtimeCo
return sandbox, containers[0].Process(), nil
}

var procFIPS = "/proc/sys/crypto/fips_enabled"

func checkForFIPS(sandboxConfig *vc.SandboxConfig) error {
content, err := ioutil.ReadFile(procFIPS)
if err != nil {
// In case file cannot be found or read, simply return
return nil
}

enabled, err := strconv.Atoi(strings.Trim(string(content), "\n\t "))
if err != nil {
// Unexpected format, ignore and simply return early
return nil
}

if enabled == 1 {
param := vc.Param{
Key: "fips",
Value: "1",
}

if err := sandboxConfig.HypervisorConfig.AddKernelParam(param); err != nil {
return fmt.Errorf("Error enabling fips mode : %v", err)
}
}

return nil
}

// CreateContainer create a container
func CreateContainer(ctx context.Context, vci vc.VC, sandbox vc.VCSandbox, ociSpec specs.Spec, rootFs vc.RootFs, containerID, bundlePath, console string, disableOutput, builtIn bool) (vc.Process, error) {
var c vc.VCContainer
Expand Down
42 changes: 42 additions & 0 deletions pkg/katautils/create_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -334,6 +334,48 @@ func TestCreateSandboxFail(t *testing.T) {
assert.True(vcmock.IsMockError(err))
}

func TestCheckForFips(t *testing.T) {
assert := assert.New(t)

path, err := ioutil.TempDir("", "")
assert.NoError(err)
defer os.RemoveAll(path)

val := procFIPS
procFIPS = filepath.Join(path, "fips-enabled")
defer func() {
procFIPS = val
}()

err = ioutil.WriteFile(procFIPS, []byte("1"), 0644)
assert.NoError(err)

hconfig := vc.HypervisorConfig{
KernelParams: []vc.Param{
{Key: "init", Value: "/sys/init"},
},
}
config := vc.SandboxConfig{
HypervisorConfig: hconfig,
}
assert.NoError(checkForFIPS(&config))

params := config.HypervisorConfig.KernelParams
assert.Equal(len(params), 2)
assert.Equal(params[1].Key, "fips")
assert.Equal(params[1].Value, "1")

config.HypervisorConfig = hconfig
err = ioutil.WriteFile(procFIPS, []byte("unexpected contents"), 0644)
assert.NoError(err)
assert.NoError(checkForFIPS(&config))
assert.Equal(config.HypervisorConfig, hconfig)

assert.NoError(os.Remove(procFIPS))
assert.NoError(checkForFIPS(&config))
assert.Equal(config.HypervisorConfig, hconfig)
}

func TestCreateContainerContainerConfigFail(t *testing.T) {
assert := assert.New(t)

Expand Down

0 comments on commit 31b5f96

Please sign in to comment.