token2/snapd
0
0
Fork 0
mirror of https://github.com/token2/snapd.git synced 2026-03-13 11:15:47 -07:00
Code Issues Packages Projects Releases Wiki Activity

snapdtool: tweak name of env variable passed to indicate FIPS bootstrap

Browse Source 
Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
This commit is contained in:
Maciej Borzecki
2024-06-24 20:29:31 +02:00
committed by Maciej Borzecki
parent d5027fe4ea
commit 4a5b76fe54
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
snapdtool/fips_linux.go
+3 -3
View File
@@ -74,7 +74,7 @@ func MaybeSetupFIPS() error {
logger.Debugf("FIPS mode enabled system wide")
if os.Getenv("SNAPD_FIPS_BOOTSTRAP_DONE") == "1" {
if os.Getenv("SNAPD_FIPS_BOOTSTRAP") == "1" {
// we've already been reexeced into FIPS mode and bootstrap was
// performed
logger.Debugf("FIPS bootstrap complete")
@@ -84,7 +84,7 @@ func MaybeSetupFIPS() error {
// variables, other processes which may be invoked by snapd will
// perform the initialization cycle on their own when needed
os.Unsetenv("GOFIPS")
os.Unsetenv("SNAPD_FIPS_BOOTSTRAP_DONE")
os.Unsetenv("SNAPD_FIPS_BOOTSTRAP")
os.Unsetenv("OPENSSL_MODULES")
os.Unsetenv("GO_OPENSSL_VERSION_OVERRIDE")
return nil
@@ -120,7 +120,7 @@ func MaybeSetupFIPS() error {
lib, mod := findFIPSLibsAndModules(currentRevSnapdSnap)
env := append(os.Environ(), []string{
"SNAPD_FIPS_BOOTSTRAP_DONE=1",
"SNAPD_FIPS_BOOTSTRAP=1",
// make FIPS mod required at runtime, if the module was not
// found or the setup is incorrect snapd will fail in a
// predictable way
snapdtool/fips_linux_test.go
+6 -6
View File
@@ -139,7 +139,7 @@ func (s *fipsSuite) TestMaybeSetupFIPSFullWithReexecClassic(c *C) {
"OPENSSL_MODULES="+filepath.Join(dirs.SnapMountDir, "snapd/123/usr/lib/x86_64-linux-gnu/ossl-modules-3"))
c.Check(observedEnv, testutil.Contains, "GO_OPENSSL_VERSION_OVERRIDE=3")
// bootstrap done
c.Check(observedEnv, testutil.Contains, "SNAPD_FIPS_BOOTSTRAP_DONE=1")
c.Check(observedEnv, testutil.Contains, "SNAPD_FIPS_BOOTSTRAP=1")
}
func (s *fipsSuite) TestMaybeSetupFIPSFullWithReexecCore(c *C) {
@@ -181,7 +181,7 @@ func (s *fipsSuite) TestMaybeSetupFIPSFullWithReexecCore(c *C) {
"OPENSSL_MODULES="+filepath.Join(dirs.SnapMountDir, "snapd/123/usr/lib/x86_64-linux-gnu/ossl-modules-3"))
c.Check(observedEnv, testutil.Contains, "GO_OPENSSL_VERSION_OVERRIDE=3")
// bootstrap done
c.Check(observedEnv, testutil.Contains, "SNAPD_FIPS_BOOTSTRAP_DONE=1")
c.Check(observedEnv, testutil.Contains, "SNAPD_FIPS_BOOTSTRAP=1")
}
func (s *fipsSuite) TestMaybeSetupFIPSNoModulesButStillReexec(c *C) {
@@ -224,7 +224,7 @@ func (s *fipsSuite) TestMaybeSetupFIPSNoModulesButStillReexec(c *C) {
}
}
// bootstrap is done
c.Check(observedEnv, testutil.Contains, "SNAPD_FIPS_BOOTSTRAP_DONE=1")
c.Check(observedEnv, testutil.Contains, "SNAPD_FIPS_BOOTSTRAP=1")
}
func (s *fipsSuite) TestMaybeSetupFIPSBootstrapAlreadyDone(c *C) {
@@ -237,12 +237,12 @@ func (s *fipsSuite) TestMaybeSetupFIPSBootstrapAlreadyDone(c *C) {
defer func() {
os.Unsetenv("GOFIPS")
os.Unsetenv("SNAPD_FIPS_BOOSTRAP_DONE")
os.Unsetenv("SNAPD_FIPS_BOOSTRAP")
os.Unsetenv("OPENSSL_MODULES")
os.Unsetenv("GO_OPENSSL_VERSION_OVERRIDE")
}()
os.Setenv("SNAPD_FIPS_BOOTSTRAP_DONE", "1")
os.Setenv("SNAPD_FIPS_BOOTSTRAP", "1")
os.Setenv("GOFIPS", "1")
os.Setenv("OPENSSL_MODULES", "bogus-dir")
os.Setenv("GO_OPENSSL_VERSION_OVERRIDE", "123-xyz")
@@ -250,7 +250,7 @@ func (s *fipsSuite) TestMaybeSetupFIPSBootstrapAlreadyDone(c *C) {
err := snapdtool.MaybeSetupFIPS()
c.Assert(err, IsNil)
c.Check(os.Getenv("SNAPD_FIPS_BOOTSTRAP_DONE"), Equals, "")
c.Check(os.Getenv("SNAPD_FIPS_BOOTSTRAP"), Equals, "")
c.Check(os.Getenv("GOFIPS"), Equals, "")
c.Check(os.Getenv("OPENSSL_MODULES"), Equals, "")
c.Check(os.Getenv("GO_OPENSSL_VERSION_OVERRIDE"), Equals, "")