FIPSCHECK(3)

📦 version 1.7.0, in opensuse-leap 16.0

💖 FIPSCHECK(3) — the fipscheck girlies' guide 💖

okay so this is the fipscheck.h page, bestie — it's the whole girl gang of functions you need when you're living that FIPS mode life. we're talking FIPSCHECK_verify, FIPSCHECK_verify_ex, FIPSCHECK_verify_files, FIPSCHECK_verify_files_ex, FIPSCHECK_fips_module_installed, FIPSCHECK_get_binary_path, FIPSCHECK_get_library_path, FIPSCHECK_kernel_fips_mode — and yes, they're all in fipscheck.h. it's giving various functions relating to running in FIPS mode. slay. ✨

🌈 SYNOPSIS 🌈

like, literally just include the header and go:

#include <fipscheck.h>

int FIPSCHECK_verify(const char *libname, const char *symbolname);

int FIPSCHECK_verify_ex(const char *libname, const char *symbolname,
                        const char *hmac_suffix, int fail_if_missing);

int FIPSCHECK_verify_files(const char *files[]);

int FIPSCHECK_verify_files_ex(const char *hmac_suffix,
                              int fail_if_missing, const char *files[]);

int FIPSCHECK_fips_module_installed(const char *libname,
                                    const char *symbolname,
                                    const char *hmac_suffix);

int FIPSCHECK_get_binary_path(char *path, size_t pathlen);

int FIPSCHECK_get_library_path(const char *libname,
                               const char *symbolname, char *path,
                               size_t pathlen);

int FIPSCHECK_kernel_fips_mode(void);

no cap, that's the whole vibe check. 📋

🦋 DESCRIPTION 🦋

okay so let's meet the cast, one icon at a time. 💅

  • FIPSCHECK_kernel_fips_mode() — this one tests for the FIPS-140-2 mode in kernel. that's it, that's the whole job. queen of knowing things. 👑
  • FIPSCHECK_verify() — computes and compares the HMAC-SHA256 checksum by spawning the fipscheck command. yes bestie, it literally shells out. the parameters libname and symbolname determine which shared library file loaded into the process space will be checksummed. and here's the little plot twist: if these parameters are set to NULL, the executable of the calling process is the thing getting checksummed. main character energy fr. 🔥
  • FIPSCHECK_verify_ex() — same functionality as above, but with ✨options✨. it also lets you specify the full hmac_suffix, with the default value of .hmac. and it will return success if the hmac file is missing and the fail_if_missing parameter is set to 0. so generous. 🫶
  • FIPSCHECK_verify_files() — this one lets you explicitly specify a NULL terminated array of file names in the parameter files to check. you pick the squad, it checks the squad. 🎀
  • FIPSCHECK_verify_files_ex() — similarly, same functionality as above but also lets you specify the full hmac_suffix with the default value of .hmac. and it will return success if the first hmac file is missing and the fail_if_missing parameter is set to 0. (yes, first. lowercase-keyword first. don't come for me, that's what it says.) 🌸

oh and the checksum file itself? it contains the HMAC-SHA256 encoded in hexadecimal notation using lowercase letters with one EOL character appended at the end. lowercase letters only, bestie — uppercase is not the vibe. 💀

  • FIPSCHECK_fips_module_installed() — returns 1 if the hmac checksum file is found and 0 otherwise. simple, iconic, no notes. ⭐
  • FIPSCHECK_get_library_path() and FIPSCHECK_get_binary_path() — these return the shared library and executable paths in the path. the buffer pointed to by the parameter must be large enough to hold the path, otherwise the path is truncated (the audacity 😭). the size of the buffer is specified by pathlen.

🍓 RETURN VALUE 🍓

so here's the scoring system, iykyk: 🌈

  • the main functions FIPSCHECK_verify() and FIPSCHECK_verify_files() return 1 when the verification of the binaries succeeds and 0 otherwise.
  • FIPSCHECK_kernel_fips_mode() returns 1 when the kernel is in fips mode and 0 otherwise.
  • the auxiliary functions FIPSCHECK_get_binary_path() and FIPSCHECK_get_library_path() return 0 on success and -1 if the path cannot be determined.

so like, watch the polarity — the "yes it worked" answer flips between the two groups. it's giving trick question on the exam. 📝

🧚 FIPS MODE 🧚

a kernel compiled with CONFIG_CRYPTO_FIPS=y can be booted in fips mode by specifying fips=1 as kernel parameter. that's the whole incantation. ✨

bestie, please refer to the security policy of the Kernel FIPS module for further details — i'm not making that up, it's literally what the page says. go read it. 💜

🔍 SEE ALSO 🔍

go click around, the repo is right there, no gatekeeping here. 👑

👑 AUTHOR 👑

  • Tomas Mraz <tmraz@redhat.com> — the legend himself. 🔥
  • man page authors: Paul Wouters <pwouters@redhat.com> and Tomas Mraz <tmraz@redhat.com> — shoutout to the duo who wrote this out so we could all vibe. 🫶

Copyright 2008, 2012 Red Hat, Inc. All rights reserved.

so, redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met — and yes, we're quoting these properly because legal text is not a vibe to paraphrase: 📜

  1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

and that's the page, bestie! written by the fipscheck girlies and dated 16 April 2012 — vintage but still serving. mwah. 💅💖✨

📦 where this page comes from