Skip to content

kernel-6.12: enable FIPS support - #263

Merged
ginglis13 merged 1 commit into
bottlerocket-os:developfrom
ginglis13:kernel-612-fips
Sep 4, 2025
Merged

kernel-6.12: enable FIPS support#263
ginglis13 merged 1 commit into
bottlerocket-os:developfrom
ginglis13:kernel-612-fips

Conversation

@ginglis13

@ginglis13 ginglis13 commented Sep 3, 2025

Copy link
Copy Markdown
Contributor

Issue number:

Closes #262

Description of changes:

Remove FIPS conflict and update FIPS module lists to enable FIPS for kernel 6.12.

FIPS module list changes found following these steps for both architectures:

  1. Launch AL2023 instance
  2. Enable FIPS mode on the instance following https://docs.aws.amazon.com/linux/al2023/ug/fips-mode.html
  3. Extract initramfs with lsinitrd --unpack
  4. List of modules provided in <initramfs>/etc/fipsmodules

Testing done:

Custom aarch64 k8s-1.33-fips variant:

[ssm-user@control]$ apiclient report fips
Benchmark name:  FIPS Security Policy
Version:         v1.0.0
Reference:       https://csrc.nist.gov/
Benchmark level: 1
Start time:      2025-09-03T21:48:30.825448753Z

[PASS] 1.0       FIPS mode is enabled. (Automatic)
[PASS] 1.1       FIPS module is Amazon Linux 2023 Kernel Cryptographic API. (Automatic)
[PASS] 1.2       FIPS self-tests passed. (Automatic)

Passed:          3
Failed:          0
Skipped:         0
Total checks:    3

Compliance check result: PASS
[ssm-user@control]$ apiclient get os
{
  "os": {
    "arch": "aarch64",
    "build_id": "431fe75a-dirty",
    "pretty_name": "Bottlerocket OS 1.46.0 (aws-k8s-1.33-fips)",
    "variant_id": "aws-k8s-1.33-fips",
    "version_id": "1.46.0"
  }
}

Custom x86_64 k8s-1.33-fips variant:

[ssm-user@control]$ apiclient report fips
Benchmark name:  FIPS Security Policy
Version:         v1.0.0
Reference:       https://csrc.nist.gov/
Benchmark level: 1
Start time:      2025-09-03T21:43:02.091923361Z

[PASS] 1.0       FIPS mode is enabled. (Automatic)
[PASS] 1.1       FIPS module is Amazon Linux 2023 Kernel Cryptographic API. (Automatic)
[PASS] 1.2       FIPS self-tests passed. (Automatic)

Passed:          3
Failed:          0
Skipped:         0
Total checks:    3

Compliance check result: PASS
[ssm-user@control]$ apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "431fe75a-dirty",
    "pretty_name": "Bottlerocket OS 1.46.0 (aws-k8s-1.33-fips)",
    "variant_id": "aws-k8s-1.33-fips",
    "version_id": "1.46.0"
  }
}

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

Remove FIPS conflict and update FIPS module lists to enable FIPS
for kernel 6.12.

Signed-off-by: Gavin Inglis <giinglis@amazon.com>
@ginglis13
ginglis13 merged commit 4890a3f into bottlerocket-os:develop Sep 4, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Enable support for FIPS mode in kernel-6.12

4 participants