Fix crypto policy check/remediation on RHCOS 10 (CMP-4632) - #15095
Open
yuumasato wants to merge 1 commit into
Open
Fix crypto policy check/remediation on RHCOS 10 (CMP-4632)#15095yuumasato wants to merge 1 commit into
yuumasato wants to merge 1 commit into
Conversation
On RHEL 10 the DEFAULT crypto policy already disables SHA-1, and the NO-SHA1 subpolicy module no longer exists. On RHCOS 10 nodes the e8 profile pins var_system_crypto_policy=DEFAULT:NO-SHA1, so: - the MachineConfig remediation runs "update-crypto-policies --set DEFAULT:NO-SHA1", which fails with "Unknown policy NO-SHA1", and - the OVAL check exact-matches DEFAULT:NO-SHA1 against the on-disk policy, which is DEFAULT, leaving configure_crypto_policy stuck at FAIL after remediation. The rhcos4 product spans RHEL8/9 and RHEL10 nodes under one profile, so the expected value cannot be set per-node via the profile variable. Fix it scan-time, scoped to rhcos4: - kubernetes/shared.yml: the MachineConfig ExecStart now detects the RHEL base from /etc/os-release and strips a trailing :NO-SHA1 on VERSION_ID >= 10 before applying the policy. No-op on RHEL8/9 and on rhel/fedora datastreams (their profiles never request :NO-SHA1). - oval/rhcos4.xml (new): product-specific OVAL override that keeps the exact DEFAULT:NO-SHA1 match on RHEL8/9-based nodes and, on RHEL10-based nodes (gated by installed_OS_is_rhcos4_rhel10), compares the on-disk policy against the :NO-SHA1-stripped effective value. The shared OVAL is untouched, so rhel9/rhel10 datastreams are unchanged. bash and ansible remediations are left as-is (RHCOS applies only the MachineConfig remediation). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
This datastream diff is auto generated by the check Click here to see the full diffkubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_configure_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_crypto_policy
@@ -14,7 +14,7 @@
Before=kubelet.service
[Service]
Type=oneshot
- ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+ ExecStart=/bin/bash -c 'source /etc/os-release; policy="{{.var_system_crypto_policy}}"; if [ "${VERSION_ID%%.*}" -ge 10 ]; then policy="${policy%%:NO-SHA1}"; fi; update-crypto-policies --set "$policy"'
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target |
Member
Author
Additional verification — RHCOS 9 regression (OCP 4.22 / RHCOS 9.8)Re-ran the same A/B on a RHEL9-based cluster to confirm the fix is a no-op on el9 and that the el10 relaxation does not leak. On-node (RHCOS 9.8): Operator A/B, all nodes at
Identical results — fixed behaves exactly like shipped on el9, and plain This is the intended contrast with the el10 run:
|
taimurhafeez
approved these changes
Sep 9, 2026
Contributor
|
Tested on OCP 5.0
Trigger Failure: To test remediation, crypto policy was changed to FUTURE on one worker node: Rescan Remediation Generated MachineConfig Content Verification Applying Remediation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
On RHEL 10 the
DEFAULTcrypto policy already disables SHA-1, and theNO-SHA1subpolicy module no longer exists. Therhcos4e8profile pinsvar_system_crypto_policy=DEFAULT:NO-SHA1, so on RHCOS 10 nodes:update-crypto-policies --set DEFAULT:NO-SHA1, which fails withUnknown policy 'NO-SHA1': file 'NO-SHA1.pmod' not found, andDEFAULT:NO-SHA1against the on-disk policy (which isDEFAULT),leaving
configure_crypto_policystuck at FAIL after remediation.The
rhcos4product spans RHEL8/9 and RHEL10 nodes under one profile, so the expected value cannot be set per-node via the profile variable. This fixes it at scan time, scoped torhcos4.Changes
configure_crypto_policy/kubernetes/shared.yml— the MachineConfigExecStartnow detects the RHEL base from/etc/os-releaseand strips a trailing:NO-SHA1onVERSION_ID >= 10before applying the policy. Functional no-op on RHEL8/9 and on the rhel/fedora datastreams (their profiles never request:NO-SHA1).configure_crypto_policy/oval/rhcos4.xml(new) — product-specific OVAL override that keeps the exactDEFAULT:NO-SHA1match on RHEL8/9-based nodes and, on RHEL10-based nodes (gated byinstalled_OS_is_rhcos4_rhel10), compares the on-disk policy against the:NO-SHA1-stripped effective value. The shared OVAL is untouched, so rhel9/rhel10 datastreams are unchanged.bashandansibleremediations are left as-is — RHCOS applies only the MachineConfig remediation.Rationale
This mirrors the existing
enable_fips_mode/oval/rhcos4.xmlproduct-override precedent and reuses the already-presentinstalled_OS_is_rhcos4_rhel10inventory check. It keeps RHEL8/9 rhcos4 behavior byte-identical and leaves the rhel9/rhel10 products entirely unchanged.Verification
Build:
./build_product rhcos4 --rule-id configure_crypto_policyand./build_product rhel10 --rule-id configure_crypto_policybuild clean.regex_captureeffective-value variable, and the version-detectingExecStart; rhel10 OVAL is unchanged and its k8s fix is a functional no-op.On a live OCP 5.0.0 / RHCOS 10.2 cluster with the Compliance Operator:
update-crypto-policies --set DEFAULT:NO-SHA1→ exit 1 (Unknown policy 'NO-SHA1').DEFAULT→update-crypto-policies --set DEFAULT→ exit 0.rhcos4-e8→ FAIL (master & worker); fixed content → PASS (master & worker).🤖 Generated with Claude Code