FIPS-MODE-SETUP(8)

🌸 FIPS-MODE-SETUP 💅

okay so bestie, welcome to fips-mode-setup — that's section 8 of the manual, if you're keeping track 🎀 — the little tool that checks or enables the system FIPS mode. yes, that FIPS mode. we're doing crypto compliance today and honestly? it's giving responsible queen energy 👑

---

✨ SYNOPSIS ✨

fips-mode-setup [COMMAND]

🦋 DESCRIPTION 🦋

fips-mode-setup(8) is literally your remote control for the system FIPS mode — checking it, controlling it, the whole vibe check 💖

When you enable the system FIPS mode, the command finishes installing the FIPS modules if that's needed, and it does that by calling fips-finish-install. then it switches the system crypto policy over to FIPS — unless the policy was already set to FIPS plus subpolicies layered on top, in which case it just keeps the subpolicies that are currently active (no need to redo the whole thing, we respect a queen who's already set up 💅).

after that, it goes and edits the boot loader configuration to add fips=1 and boot=<boot-device> options to the kernel command line. slay.

When you disable the system FIPS mode, the system crypto policy gets switched to DEFAULT and the kernel command line option fips=0 is set. that's it, that's the whole mood 🙈

🚨 real talk on transactional systems: enabling the system in FIPS mode with the fips-mode-setup tool is not implemented on these. no cap. it's just not a thing there. if you wanna enable FIPS mode on one of these systems, you have to do it manually with these steps:

1. install the FIPS pattern on a running system:

# transactional-update pkg install -t pattern microos-fips

2. reboot your system.
3. add the kernel command line parameter fips=1 to the boot loader configuration. to do so, edit the file /etc/default/grub and add fips=1 to the GRUB_CMDLINE_LINUX_DEFAULT variable.
4. after logging in to the system, run:

# transactional-update grub.cfg

5. reboot your system.

see? not scary, just a little more homework 📝✨

---

🌈 OPTIONS 🌈

the following options are available in the fips-mode-setup tool. let's go through them bestie:

• --enable — enables the system FIPS mode. the main character option, honestly 👑
• --disable — undo some of the FIPS-enablement steps. but listen 👀: module installation cannot be undone without reformatting and overwriting, at least once, the platform's hard drive or other permanent storage media. this option is not meant to be used in production, is not supported, and is implemented for testing purposes only. so like... be careful, fr fr 💀
• --check — checks for inconsistently enabled FIPS mode. it exits successfully (0) for both consistently-enabled FIPS mode and consistently-disabled FIPS mode, and returns error code (1) if inconsistencies are detected. so 0 = we're consistent, 1 = something's messy 😭. for checking whether FIPS mode is enabled, see --is-enabled below.
• --is-enabled — checks the system FIPS mode status and returns a failure error code if it's disabled (2) or inconsistent (1). two different flavors of nope, iykyk 🫶
• --no-bootcfg — the tool will not reconfigure the boot loader, and instead will print out the options that need to be added to the kernel command line. lowkey convenient ✨. exception: it still attempts executing zipl(8) on s390x, because otherwise the system might become unbootable. yeah, that's a "please don't break my boot" situation, so it stays 🔥

---

🎀 FILES 🎀

• /proc/sys/crypto/fips_enabled — the kernel FIPS mode flag. tiny file, big responsibilities 🌸

---

💜 SEE ALSO 💜

update-crypto-policies(8), fips-finish-install(8)

go read those too, bestie, they're part of the lore 📚

---

⭐ AUTHOR ⭐

written by Tomáš Mráz. absolute icon, we stan 🫶

---

okay that's the whole page!! 💖 this was fips-mode-setup, from the FIPS-MODE-SETUP(8) manual, dated 02/07/2025. go forth and be FIPS-compliant, bestie 🌈👑✨