From 50de3f0a5f2023549aaa9caa2184795e692741b0 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 18/50] FIPS: disable fipsinstall Patch-name: 0034.fipsinstall_disable.patch Patch-id: 34 Patch-status: | # # Comment out fipsinstall command-line utility From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- apps/fipsinstall.c | 3 + doc/man1/openssl-fipsinstall.pod.in | 485 +------------------------- doc/man1/openssl.pod | 4 - doc/man5/config.pod | 1 - doc/man5/fips_config.pod | 228 +----------- doc/man7/OSSL_PROVIDER-FIPS.pod | 1 - test/recipes/00-prep_fipsmodule_cnf.t | 10 +- test/recipes/01-test_fipsmodule_cnf.t | 7 +- test/recipes/03-test_fipsinstall.t | 2 + 9 files changed, 22 insertions(+), 719 deletions(-) mode change 100644 => 100755 test/recipes/00-prep_fipsmodule_cnf.t mode change 100644 => 100755 test/recipes/01-test_fipsmodule_cnf.t mode change 100644 => 100755 test/recipes/03-test_fipsinstall.t diff --git a/apps/fipsinstall.c b/apps/fipsinstall.c index 0daa55a1b8..b4e29ac301 100644 --- a/apps/fipsinstall.c +++ b/apps/fipsinstall.c @@ -590,6 +590,9 @@ int fipsinstall_main(int argc, char **argv) EVP_MAC *mac = NULL; CONF *conf = NULL; + BIO_printf(bio_err, "This command is not enabled in the Red Hat Enterprise Linux OpenSSL build, please consult Red Hat documentation to learn how to enable FIPS mode\n"); + return 1; + if ((opts = sk_OPENSSL_STRING_new_null()) == NULL) goto end; diff --git a/doc/man1/openssl-fipsinstall.pod.in b/doc/man1/openssl-fipsinstall.pod.in index 9dd4f5a49f..9a063022a9 100644 --- a/doc/man1/openssl-fipsinstall.pod.in +++ b/doc/man1/openssl-fipsinstall.pod.in @@ -8,488 +8,9 @@ openssl-fipsinstall - perform FIPS configuration installation =head1 SYNOPSIS B -[B<-help>] -[B<-in> I] -[B<-out> I] -[B<-module> I] -[B<-provider_name> I] -[B<-section_name> I] -[B<-verify>] -[B<-mac_name> I] -[B<-macopt> I:I] -[B<-noout>] -[B<-quiet>] -[B<-pedantic>] -[B<-no_conditional_errors>] -[B<-no_security_checks>] -[B<-hmac_key_check>] -[B<-kmac_key_check>] -[B<-ems_check>] -[B<-no_drbg_truncated_digests>] -[B<-signature_digest_check>] -[B<-hkdf_digest_check>] -[B<-tls13_kdf_digest_check>] -[B<-tls1_prf_digest_check>] -[B<-sshkdf_digest_check>] -[B<-sskdf_digest_check>] -[B<-x963kdf_digest_check>] -[B<-dsa_sign_disabled>] -[B<-no_pbkdf2_lower_bound_check>] -[B<-no_short_mac>] -[B<-tdes_encrypt_disabled>] -[B<-rsa_pkcs15_padding_disabled>] -[B<-rsa_pss_saltlen_check>] -[B<-rsa_sign_x931_disabled>] -[B<-hkdf_key_check>] -[B<-kbkdf_key_check>] -[B<-tls13_kdf_key_check>] -[B<-tls1_prf_key_check>] -[B<-sshkdf_key_check>] -[B<-sskdf_key_check>] -[B<-x963kdf_key_check>] -[B<-x942kdf_key_check>] -[B<-ecdh_cofactor_check>] -[B<-self_test_onload>] -[B<-self_test_oninstall>] -[B<-corrupt_desc> I] -[B<-corrupt_type> I] -[B<-config> I] - -=head1 DESCRIPTION - -This command is used to generate a FIPS module configuration file. -This configuration file can be used each time a FIPS module is loaded -in order to pass data to the FIPS module self tests. The FIPS module always -verifies its MAC, but optionally only needs to run the KAT's once, -at installation. - -The generated configuration file consists of: - -=over 4 - -=item - A MAC of the FIPS module file. - -=item - A test status indicator. - -This indicates if the Known Answer Self Tests (KAT's) have successfully run. - -=item - A MAC of the status indicator. - -=item - A control for conditional self tests errors. - -By default if a continuous test (e.g a key pair test) fails then the FIPS module -will enter an error state, and no services or cryptographic algorithms will be -able to be accessed after this point. -The default value of '1' will cause the fips module error state to be entered. -If the value is '0' then the module error state will not be entered. -Regardless of whether the error state is entered or not, the current operation -(e.g. key generation) will return an error. The user is responsible for retrying -the operation if the module error state is not entered. - -=item - A control to indicate whether run-time security checks are done. - -This indicates if run-time checks related to enforcement of security parameters -such as minimum security strength of keys and approved curve names are used. -The default value of '1' will perform the checks. -If the value is '0' the checks are not performed and FIPS compliance must -be done by procedures documented in the relevant Security Policy. - -=back - -This file is described in L. - -=head1 OPTIONS - -=over 4 - -=item B<-help> - -Print a usage message. - -=item B<-module> I - -Filename of the FIPS module to perform an integrity check on. -The path provided in the filename is used to load the module when it is -activated, and this overrides the environment variable B. - -=item B<-out> I - -Filename to output the configuration data to; the default is standard output. - -=item B<-in> I - -Input filename to load configuration data from. -Must be used if the B<-verify> option is specified. - -=item B<-verify> - -Verify that the input configuration file contains the correct information. - -=item B<-provider_name> I - -Name of the provider inside the configuration file. -The default value is C. - -=item B<-section_name> I - -Name of the section inside the configuration file. -The default value is C. - -=item B<-mac_name> I - -Specifies the name of a supported MAC algorithm which will be used. -The MAC mechanisms that are available will depend on the options -used when building OpenSSL. -To see the list of supported MAC's use the command -C. The default is B. - -=item B<-macopt> I:I - -Passes options to the MAC algorithm. -A comprehensive list of controls can be found in the EVP_MAC implementation -documentation. -Common control strings used for this command are: - -=over 4 - -=item B:I - -Specifies the MAC key as an alphanumeric string (use if the key contains -printable characters only). -The string length must conform to any restrictions of the MAC algorithm. -A key must be specified for every MAC algorithm. -If no key is provided, the default that was specified when OpenSSL was -configured is used. - -=item B:I - -Specifies the MAC key in hexadecimal form (two hex digits per byte). -The key length must conform to any restrictions of the MAC algorithm. -A key must be specified for every MAC algorithm. -If no key is provided, the default that was specified when OpenSSL was -configured is used. - -=item B:I - -Used by HMAC as an alphanumeric string (use if the key contains printable -characters only). -The string length must conform to any restrictions of the MAC algorithm. -To see the list of supported digests, use the command -C. -The default digest is SHA-256. - -=back - -=item B<-noout> - -Disable logging of the self tests. - -=item B<-pedantic> - -Configure the module so that it is strictly FIPS compliant rather -than being backwards compatible. This enables conditional errors, -security checks etc. Note that any previous configuration options will -be overwritten and any subsequent configuration options that violate -FIPS compliance will result in an error. - -=item B<-no_conditional_errors> - -Configure the module to not enter an error state if a conditional self test -fails as described above. - -=item B<-no_security_checks> - -Configure the module to not perform run-time security checks as described above. - -Enabling the configuration option "no-fips-securitychecks" provides another way to -turn off the check at compile time. - -=item B<-ems_check> - -Configure the module to enable a run-time Extended Master Secret (EMS) check -when using the TLS1_PRF KDF algorithm. This check is disabled by default. -See RFC 7627 for information related to EMS. - -=item B<-no_short_mac> - -Configure the module to not allow short MAC outputs. -See SP 800-185 8.4.2 and FIPS 140-3 ID C.D for details. - -=item B<-hmac_key_check> - -Configure the module to not allow small keys sizes when using HMAC. -See SP 800-131Ar2 for details. - -=item B<-kmac_key_check> - -Configure the module to not allow small keys sizes when using KMAC. -See SP 800-131Ar2 for details. - -=item B<-no_drbg_truncated_digests> - -Configure the module to not allow truncated digests to be used with Hash and -HMAC DRBGs. See FIPS 140-3 IG D.R for details. - -=item B<-signature_digest_check> - -Configure the module to enforce signature algorithms to use digests that are -explicitly permitted by the various standards. - -=item B<-hkdf_digest_check> - -Configure the module to enable a run-time digest check when deriving a key by -HKDF. -See NIST SP 800-56Cr2 for details. - -=item B<-tls13_kdf_digest_check> - -Configure the module to enable a run-time digest check when deriving a key by -TLS13 KDF. -See RFC 8446 for details. - -=item B<-tls1_prf_digest_check> - -Configure the module to enable a run-time digest check when deriving a key by -TLS_PRF. -See NIST SP 800-135r1 for details. - -=item B<-sshkdf_digest_check> - -Configure the module to enable a run-time digest check when deriving a key by -SSHKDF. -See NIST SP 800-135r1 for details. - -=item B<-sskdf_digest_check> - -Configure the module to enable a run-time digest check when deriving a key by -SSKDF. -See NIST SP 800-56Cr2 for details. - -=item B<-x963kdf_digest_check> - -Configure the module to enable a run-time digest check when deriving a key by -X963KDF. -See NIST SP 800-131Ar2 for details. - -=item B<-dsa_sign_disabled> - -Configure the module to not allow DSA signing (DSA signature verification is -still allowed). See FIPS 140-3 IG C.K for details. - -=item B<-tdes_encrypt_disabled> - -Configure the module to not allow Triple-DES encryption. -Triple-DES decryption is still allowed for legacy purposes. -See SP800-131Ar2 for details. - -=item B<-rsa_pkcs15_padding_disabled> - -Configure the module to not allow PKCS#1 version 1.5 padding to be used with -RSA for key transport and key agreement. See NIST's SP 800-131A Revision 2 -for details. - -=item B<-rsa_pss_saltlen_check> - -Configure the module to enable a run-time salt length check when generating or -verifying a RSA-PSS signature. -See FIPS 186-5 5.4 (g) for details. - -=item B<-rsa_sign_x931_disabled> - -Configure the module to not allow X9.31 padding to be used when signing with -RSA. See FIPS 140-3 IG C.K for details. - -=item B<-hkdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by HKDF. -See NIST SP 800-131Ar2 for details. - -=item B<-kbkdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by KBKDF. -See NIST SP 800-131Ar2 for details. - -=item B<-tls13_kdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by TLS13 KDF. -See NIST SP 800-131Ar2 for details. - -=item B<-tls1_prf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by TLS_PRF. -See NIST SP 800-131Ar2 for details. - -=item B<-sshkdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by SSHKDF. -See NIST SP 800-131Ar2 for details. - -=item B<-sskdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by SSKDF. -See NIST SP 800-131Ar2 for details. - -=item B<-x963kdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by X963KDF. -See NIST SP 800-131Ar2 for details. - -=item B<-x942kdf_key_check> - -Configure the module to enable a run-time short key-derivation key check when -deriving a key by X942KDF. -See NIST SP 800-131Ar2 for details. - -=item B<-no_pbkdf2_lower_bound_check> - -Configure the module to not perform run-time lower bound check for PBKDF2. -See NIST SP 800-132 for details. - -=item B<-ecdh_cofactor_check> - -Configure the module to enable a run-time check that ECDH uses the EC curves -cofactor value when deriving a key. This only affects the 'B' and 'K' curves. -See SP 800-56A r3 Section 5.7.1.2 for details. - -=item B<-self_test_onload> - -Do not write the two fields related to the "test status indicator" and -"MAC status indicator" to the output configuration file. Without these fields -the self tests KATS will run each time the module is loaded. This option could be -used for cross compiling, since the self tests need to run at least once on each -target machine. Once the self tests have run on the target machine the user -could possibly then add the 2 fields into the configuration using some other -mechanism. -This option defaults to 0 for any OpenSSL FIPS 140-2 provider (OpenSSL 3.0.X). -and is not relevant for an OpenSSL FIPS 140-3 provider, since this is no -longer allowed. - -=item B<-self_test_oninstall> - -The converse of B<-self_test_oninstall>. The two fields related to the -"test status indicator" and "MAC status indicator" are written to the -output configuration file. -This field is not relevant for an OpenSSL FIPS 140-3 provider, since this is no -longer allowed. - -=item B<-quiet> - -Do not output pass/fail messages. Implies B<-noout>. - -=item B<-corrupt_desc> I, -B<-corrupt_type> I - -The corrupt options can be used to test failure of one or more self tests by -name. -Either option or both may be used to select the tests to corrupt. -Refer to the entries for B and B in L for -values that can be used. - -=item B<-config> I - -Test that a FIPS provider can be loaded from the specified configuration file. -A previous call to this application needs to generate the extra configuration -data that is included by the base C configuration file. -See L for further information on how to set up a provider section. -All other options are ignored if '-config' is used. - -=back - -=head1 NOTES - -Self tests results are logged by default if the options B<-quiet> and B<-noout> -are not specified, or if either of the options B<-corrupt_desc> or -B<-corrupt_type> are used. -If the base configuration file is set up to autoload the fips module, then the -fips module will be loaded and self tested BEFORE the fipsinstall application -has a chance to set up its own self test callback. As a result of this the self -test output and the options B<-corrupt_desc> and B<-corrupt_type> will be ignored. -For normal usage the base configuration file should use the default provider -when generating the fips configuration file. - -The B<-self_test_oninstall> option was added and the -B<-self_test_onload> option was made the default in OpenSSL 3.1. - -The command and all remaining options were added in OpenSSL 3.0. - -=head1 EXAMPLES - -Calculate the mac of a FIPS module F and run a FIPS self test -for the module, and save the F configuration file: - - openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips - -Verify that the configuration file F contains the correct info: - - openssl fipsinstall -module ./fips.so -in fips.cnf -provider_name fips -verify - -Corrupt any self tests which have the description C: - - openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \ - -corrupt_desc 'SHA1' - -Validate that the fips module can be loaded from a base configuration file: - - export OPENSSL_CONF_INCLUDE= - export OPENSSL_MODULES= - openssl fipsinstall -config' 'default.cnf' - - -=head1 SEE ALSO - -L, -L, -L, -L - -=head1 HISTORY - -The B application was added in OpenSSL 3.0. - -The following options were added in OpenSSL 3.1: - -B<-ems_check>, -B<-self_test_oninstall> - -The following options were added in OpenSSL 3.2: - -B<-pedantic>, -B<-no_drbg_truncated_digests> - -The following options were added in OpenSSL 3.4: - -B<-hmac_key_check>, -B<-kmac_key_check>, -B<-signature_digest_check>, -B<-hkdf_digest_check>, -B<-tls13_kdf_digest_check>, -B<-tls1_prf_digest_check>, -B<-sshkdf_digest_check>, -B<-sskdf_digest_check>, -B<-x963kdf_digest_check>, -B<-dsa_sign_disabled>, -B<-no_pbkdf2_lower_bound_check>, -B<-no_short_mac>, -B<-tdes_encrypt_disabled>, -B<-rsa_pkcs15_padding_disabled>, -B<-rsa_pss_saltlen_check>, -B<-rsa_sign_x931_disabled>, -B<-hkdf_key_check>, -B<-kbkdf_key_check>, -B<-tls13_kdf_key_check>, -B<-tls1_prf_key_check>, -B<-sshkdf_key_check>, -B<-sskdf_key_check>, -B<-x963kdf_key_check>, -B<-x942kdf_key_check>, -B<-ecdh_cofactor_check> +This command is disabled. +Please consult Red Hat Enterprise Linux documentation to learn how to correctly +enable FIPS mode on Red Hat Enterprise =head1 COPYRIGHT diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod index edef2ff598..0762a00d74 100644 --- a/doc/man1/openssl.pod +++ b/doc/man1/openssl.pod @@ -139,10 +139,6 @@ Engine (loadable module) information and manipulation. Error Number to Error String Conversion. -=item B - -FIPS configuration installation. - =item B Generation of DSA Private Key from Parameters. Superseded by diff --git a/doc/man5/config.pod b/doc/man5/config.pod index b994081924..7a6d7fab4a 100644 --- a/doc/man5/config.pod +++ b/doc/man5/config.pod @@ -603,7 +603,6 @@ configuration files using that syntax will have to be modified. =head1 SEE ALSO L, L, L, -L, L, L, L, diff --git a/doc/man5/fips_config.pod b/doc/man5/fips_config.pod index a25ced3383..15748c5756 100644 --- a/doc/man5/fips_config.pod +++ b/doc/man5/fips_config.pod @@ -6,230 +6,10 @@ fips_config - OpenSSL FIPS configuration =head1 DESCRIPTION -A separate configuration file, using the OpenSSL L syntax, -is used to hold information about the FIPS module. This includes a digest -of the shared library file, and status about the self-testing. -This data is used automatically by the module itself for two -purposes: - -=over 4 - -=item - Run the startup FIPS self-test known answer tests (KATS). - -This is normally done once, at installation time, but may also be set up to -run each time the module is used. - -=item - Verify the module's checksum. - -This is done each time the module is used. - -=back - -This file is generated by the L program, and -used internally by the FIPS module during its initialization. - -The following options are supported. They should all appear in a section -whose name is identified by the B option in the B -section, as described in L. - -=over 4 - -=item B - -If present, the module is activated. The value assigned to this name is not -significant. - -=item B - -The FIPS module normally enters an internal error mode if any self test fails. -Once this error mode is active, no services or cryptographic algorithms are -accessible from this point on. -Continuous tests are a subset of the self tests (e.g., a key pair test during key -generation, or the CRNG output test). -Setting this value to C<0> allows the error mode to not be triggered if any -continuous test fails. The default value of C<1> will trigger the error mode. -Regardless of the value, the operation (e.g., key generation) that called the -continuous test will return an error code if its continuous test fails. The -operation may then be retried if the error mode has not been triggered. - -=item B - -The calculated MAC of the FIPS provider file. - -=item B - -A version number for the fips install process. Should be 1. - -=item B - -An indicator that the self-tests were successfully run. -This should only be written after the module has -successfully passed its self tests during installation. -If this field is not present, then the self tests will run when the module -loads. - -=item B - -A MAC of the value of the B option, to prevent accidental -changes to that value. -It is written-to at the same time as B is updated. - -=back - -=head2 FIPS indicator options - -The following FIPS configuration options indicate if run-time checks related to -enforcement of FIPS security parameters such as minimum security strength of -keys and approved curve names are used. -A value of '1' will perform the checks, otherwise if the value is '0' the checks -are not performed and FIPS compliance must be done by procedures documented in -the relevant Security Policy. - -See L for further information related to these -options. - -=over 4 - -=item B - -See L B<-no_security_checks> - -=item B - -See L B<-ems_check> - -=item B - -See L B<-no_short_mac> - -=item B - -See L B<-no_drbg_truncated_digests> - -=item B - -See L B<-signature_digest_check> - -=item B - -See L B<-hkdf_digest_check> - -=item B - -See L B<-tls13_kdf_digest_check> - -=item B - -See L B<-tls1_prf_digest_check> - -=item B - -See L B<-sshkdf_digest_check> - -=item B - -See L B<-sskdf_digest_check> - -=item B - -See L B<-x963kdf_digest_check> - -=item B - -See L B<-dsa_sign_disabled> - -=item B - -See L B<-tdes_encrypt_disabled> - -=item B - -See L B<-rsa_pkcs15_pad_disabled> - -=item B - -See L B<-rsa_pss_saltlen_check> - -=item B - -See L B<-rsa_sign_x931_disabled> - -=item B - -See L B<-hkdf_key_check> - -=item B - -See L B<-kbkdf_key_check> - -=item B - -See L B<-tls13_kdf_key_check> - -=item B - -See L B<-tls1_prf_key_check> - -=item B - -See L B<-sshkdf_key_check> - -=item B - -See L B<-sskdf_key_check> - -=item B - -See L B<-x963kdf_key_check> - -=item B - -See L B<-x942kdf_key_check> - -=item B - -See L B<-no_pbkdf2_lower_bound_check> - -=item B - -See L B<-ecdh_cofactor_check> - -=item B - -See L B<-hmac_key_check> - -=item B - -See L B<-kmac_key_check> - -=back - -For example: - - [fips_sect] - activate = 1 - install-version = 1 - conditional-errors = 1 - security-checks = 1 - module-mac = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC - install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C - install-status = INSTALL_SELF_TEST_KATS_RUN - -=head1 NOTES - -When using the FIPS provider, it is recommended that the -B option is enabled to prevent accidental use of -non-FIPS validated algorithms via broken or mistaken configuration. -See L. - -=head1 SEE ALSO - -L -L - -=head1 HISTORY - -This functionality was added in OpenSSL 3.0. +This command is disabled in Red Hat Enterprise Linux. The FIPS provider is +automatically loaded when the system is booted in FIPS mode, or when the +environment variable B is set. See the documentation +for more information. =head1 COPYRIGHT diff --git a/doc/man7/OSSL_PROVIDER-FIPS.pod b/doc/man7/OSSL_PROVIDER-FIPS.pod index 20d35fada8..f8f219d647 100644 --- a/doc/man7/OSSL_PROVIDER-FIPS.pod +++ b/doc/man7/OSSL_PROVIDER-FIPS.pod @@ -575,7 +575,6 @@ want to operate in a FIPS approved manner. The algorithms are: =head1 SEE ALSO -L, L, L, L, diff --git a/test/recipes/00-prep_fipsmodule_cnf.t b/test/recipes/00-prep_fipsmodule_cnf.t old mode 100644 new mode 100755 index 4e3a6d85e8..48869b2568 --- a/test/recipes/00-prep_fipsmodule_cnf.t +++ b/test/recipes/00-prep_fipsmodule_cnf.t @@ -29,8 +29,10 @@ my $fipsmoduleconf = bldtop_file('test', 'fipsmodule.cnf'); plan tests => 1; +ok(1 == 1); + # Create the $fipsmoduleconf file -ok(run(app(['openssl', 'fipsinstall', '-pedantic', - '-module', $fipsmodule, '-provider_name', 'fips', - '-section_name', 'fips_sect', '-out', $fipsmoduleconf])), - "fips install"); +#ok(run(app(['openssl', 'fipsinstall', '-pedantic', +# '-module', $fipsmodule, '-provider_name', 'fips', +# '-section_name', 'fips_sect', '-out', $fipsmoduleconf])), +# "fips install"); diff --git a/test/recipes/01-test_fipsmodule_cnf.t b/test/recipes/01-test_fipsmodule_cnf.t old mode 100644 new mode 100755 index ce594817d5..4530a46dd0 --- a/test/recipes/01-test_fipsmodule_cnf.t +++ b/test/recipes/01-test_fipsmodule_cnf.t @@ -31,7 +31,8 @@ plan tests => 1; my $fipsmodule = bldtop_file('providers', platform->dso('fips')); my $fipsmoduleconf = bldtop_file('test', 'fipsmodule.cnf'); +ok(1 == 1) # verify the $fipsconf file -ok(run(app(['openssl', 'fipsinstall', - '-in', $fipsmoduleconf, '-module', $fipsmodule, '-verify'])), - "fipsinstall verify"); +#ok(run(app(['openssl', 'fipsinstall', +# '-in', $fipsmoduleconf, '-module', $fipsmodule, '-verify'])), +# "fipsinstall verify"); diff --git a/test/recipes/03-test_fipsinstall.t b/test/recipes/03-test_fipsinstall.t old mode 100644 new mode 100755 index 1f9110ef60..7e80637bd5 --- a/test/recipes/03-test_fipsinstall.t +++ b/test/recipes/03-test_fipsinstall.t @@ -22,6 +22,8 @@ use lib srctop_dir('Configurations'); use lib bldtop_dir('.'); use platform; +plan skip_all => "Fipsinstall not available in Red Hat FIPS build"; + plan skip_all => "Test only supported in a fips build" if disabled("fips"); # Compatible options for pedantic FIPS compliance -- 2.49.0