1FIPS-MODE-SETUP(8)                                          FIPS-MODE-SETUP(8)
2
3
4

NAME

6       fips-mode-setup - Check or enable the system FIPS mode.
7

SYNOPSIS

9       fips-mode-setup [COMMAND]
10

DESCRIPTION

12       fips-mode-setup(8) is used to check and control the system FIPS mode.
13
14       When enabling the system FIPS mode, the command completes the
15       installation of FIPS modules if needed by calling fips-finish-install
16       and changes the system crypto policy to FIPS (unless the policy has
17       already been set to FIPS plus subpolicies on top, in which case the
18       currently active subpolicies is retained).
19
20       Then the command modifies the boot loader configuration to add fips=1
21       and boot=<boot-device> options to the kernel command line.
22
23       When disabling the system FIPS mode the system crypto policy is
24       switched to DEFAULT and the kernel command line option fips=0 is set.
25

OPTIONS

27       The following options are available in fips-mode-setup tool.
28
29       •   --enable: Enables the system FIPS mode.
30
31       •   --disable: Undo some of the FIPS-enablement steps (unsupported).
32
33       •   --check: Checks for inconsistently enabled FIPS mode. Exits
34           successfully (0) for both consistently-enabled FIPS mode and
35           consistently-disabled FIPS mode, returns error code (1) if
36           inconsistencies are detected. For checking whether FIPS mode is
37           enabled, see --is-enabled below.
38
39       •   --is-enabled: Checks the system FIPS mode status and returns
40           failure error code if disabled (2) or inconsistent (1).
41
42       •   --no-bootcfg: The tool will not reconfigure the boot loader, and,
43           instead, will print the options that need to be added to the kernel
44           command line. Exception: it still attempts executing zipl(8) on
45           s390x, as the system might become unbootable otherwise.
46

FILES

48       /proc/sys/crypto/fips_enabled
49           The kernel FIPS mode flag.
50

SEE ALSO

52       update-crypto-policies(8), fips-finish-install(8)
53

AUTHOR

55       Written by Tomáš Mráz.
56
57
58
59fips-mode-setup                   03/01/2023                FIPS-MODE-SETUP(8)