2

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros.

Is SELinux somehow related to FIPS requirements? FIPS requires roles-based authorization, which to my understanding is supported on SELinux (or AppArmor).

2

SELinux is not related to FIPS 140-2. You can use SELinux as part of a FIPS-compliant product; you can equally not use SELinux as part of a FIPS-compliant product. Whether it's a good idea to use SELinux depends on the complexity of your product and on how much work has already been done (by you or others) in defining relevant SELinux policies.

FIPS 140 level 2 requires at least role-based authentication. User authentication, as provided by the most basic Linux system, is sufficient. Role-based authentication means that you're allowed to have shared accounts (e.g. a direct login to root), but you don't have to use any shared accounts.

  • Gilles, Thanks. fips states that 2 roles are required : User Role - The role assumed to perform general security services, Crypto Officer Role: The role assumed to perform cryptographic initialization or management functions So if I create a user on linux with user priv. and a root that can access all function, seems like I'm all set ? – user3087632 Apr 9 '17 at 20:45
  • 1
    @user3087632 Root may or may not map to the crypto officer role, depending on what functionality you're certifying. FIPS 140 was written for crypto devices which were boxes where a crypto officer would turn knobs to set a key (think Enigma machines). The terminology doesn't always make much sense when things happen in software. The crypto officer is whoever sets the keys, that may or may not be root. It may or may not be a user that maps to a human, in fact. The company who's handling your certification should be able to advise you how to define your product in FIPS terms, it's rather special. – Gilles Apr 9 '17 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.