FIPSCHECK(8)

📦 version 1.7.0, in opensuse-leap 16.0

💅 NAME 💅

okay bestie, welcome to FIPSCHECK(8) — the manual page for fipscheck, which does a FIPS-140-2 validation check of one or more files. literally its whole personality is checksum validation, and it ate. ✨

✨ SYNTAX ✨

fipscheck [-s <hmac-suffix>] file1 [file2 ...]

that's the whole invocation — optional -s, then your file1, then any extra [file2 ...] files. 🫶

🦋 DESCRIPTION 🦋

okay so fipscheck performs a FIPS-140-2 validation of a file using a stored checksum of that file. The file containing the checksum value is first looked up in the /usr/lib{64,}/fipscheck directory, and if it's not found there, it will be searched for in the same directory as the file which is being checksummed. no cap, that's the lookup order. 🔍

The checksum file has naming rules and they are not optional: it must have . prepended and .hmac appended to the original file name. But the . must not be prepended to the file names in the /usr/lib{64,}/fipscheck directory. so directory files skip the leading dot, same-directory files don't — iykyk. 💅

If invoked correctly, the fipscheck command will not print anything to the standard output or error, and it sets the return code based on the test result. A return code of 0 means the file passed the checksum test. A value of non-zero means the checksum failed. silent but extremely loud in the exit code, honestly. 😭

  • -s <hmac-suffix> — lets you specify the suffix of the hmac file names. The default value .hmac is used when this option is not specified. so if you don't pass -s, it's .hmac o'clock. 🕰️

🔥 RETURN CODES 🔥

fipscheck can return the following return codes, and every single one is doing its own thing:

  • 0 — Checksum OK. slay. ✅
  • 1 — Checksum mismatch. 💀
  • 2 — Missing filename. 🙈
  • 3 — Cannot open the checksum file. 🚫
  • 4 — Cannot read the file to be checksummed, or the checksum computation failed. 😭
  • 5 — Memory allocation error. 🧠
  • 10 and higher — Failure during self-checking the libfipscheck.so shared library. ⚠️
  • 20 and higher — Failure during self-checking the fipscheck binary. ⚠️

🌸 ENVIRONMENT VARIABLES 🌸

If you set the environment variable FIPSCHECK_DEBUG to "error", all error messages are sent to stderr. Setting this variable to "syslog" will send all error messages to the syslog daemon. debug mode is giving “tell me everything” energy. 👀

🌈 FIPS MODE 🌈

A kernel compiled with CONFIG_CRYPTO_FIPS=y can be booted in fips mode by specifying fips=1 as kernel parameter. If the /boot directory resides on a different partition, this needs to be specified, for example boot=/dev/sda2. kernel vibes only. 🐧

🎀 SEE ALSO 🎀

these are your next tabs, bestie. 🌟

💜 AUTHOR 💜

Tomas Mraz <tmraz@redhat.com>.

Man page by Paul Wouters <pwouters@redhat.com>.

Copyright 2008, 2012 Red Hat, Inc. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

that's the whole manual page, bestie — source/version fipscheck, dated April 11, 2012, and the page is FIPSCHECK(8). stay validated, stay iconic. 💖

📦 where this page comes from