F31 Self-Contained Change proposal: Custom Crypto Policies

[Ben Cotton]

https://fedoraproject.org/wiki/Changes/CustomCryptoPolicies

== Summary ==
This new feature of crypto-policies allows system administrators and
third party providers to modify and adjust the existing system-wide
crypto policies to enable or disable algorithms and protocols.

== Owner ==
* Name: [[User:Tmraz | Tomáš Mráz]]
* Email: tmraz(a)redhat.com

== Detailed Description ==

The crypto-policies package will be enhanced to allow system
administrators to modify the existing system-wide crypto policy levels
by removing or adding enabled algorithms and protocols. For example it
will be possible to easily modify the existing DEFAULT policy to
disable the SHA1 support or enable support for a national crypto
algorithm that is supported by the crypto libraries but is disabled in
the policies. System administrator will be able to add a simple
configuration file that will achieve this after calling the
update-crypto-policies command.

== Benefit to Fedora ==

This will enable advanced users of Fedora to adjust the
crypto-policies of the system to their particular needs and
requirements.

It will also enable using Fedora where the national crypto algorithms
are required without need to manually tinker with configurations of
various software components to enable the national crypto algorithms.

== Scope ==
* Proposal owners:
The design of the feature and prototype is already finished upstream.
We still need to convert the existing back-end policy generators to
the new framework and convert the existing policy definitions to the
new format. Then the crypto-policies package will be rebased to the
version with the custom crypto policies support included.

* Other developers: N/A (not a System Wide Change)
* Release engineering: N/A (not a System Wide Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)

== Upgrade/compatibility impact ==

No impact. The crypto policies will continue to work as expected and
worked before if a custom policy is not set.

== How To Test ==

This will be tested as part of the upstream crypto-policies testsuite.

== User Experience ==

Unless the user will choose to create and/or apply a custom crypto
policy on the system, there will be no noticeable user experience
change.

== Dependencies ==

N/A (not a System Wide Change)

== Contingency Plan ==

* Contingency mechanism: (What to do?  Who will do it?) N/A (not a
System Wide Change)

== Documentation ==

N/A (not a System Wide Change)

== Release Notes ==

The crypto-policies package was enhanced to allow system
administrators to modify the existing system-wide crypto policy levels
by removing or adding enabled algorithms and protocols. For example it
is now possible to easily modify the existing DEFAULT policy to
disable the SHA1 support or enable support for a national crypto
algorithm that is supported by the crypto libraries but is disabled in
the policies. This can be achieved by adding a simple configuration
file and calling the update-crypto-policies command.

-- 
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis

[Vít Ondruch]

Dne 18. 06. 19 v 21:50 Ben Cotton napsal(a):
>  https://fedoraproject.org/wiki/Changes/CustomCryptoPolicies
>
>  == Summary ==
>  This new feature of crypto-policies allows system administrators and
>  third party providers to modify and adjust the existing system-wide
>  crypto policies to enable or disable algorithms and protocols.
>
>  == Owner ==
>  * Name: [[User:Tmraz | Tomáš Mráz]]
>  * Email: tmraz(a)redhat.com
>
>  == Detailed Description ==
>
>  The crypto-policies package will be enhanced to allow system
>  administrators to modify the existing system-wide crypto policy levels
>  by removing or adding enabled algorithms and protocols. For example it
>  will be possible to easily modify the existing DEFAULT 

I just wonder what is the strategy here? Does it means that the
"DEFAULT" definition will be store permanently somewhere in /usr/ and
I'll be able to copy the DEFAULT into /etc and modify it according to my
needs?

I am just asking, because AFAIK, currently the crypto policies
configuration is stored just in /etc and modifying the "DEFAULT" profile
would make the updates problematic, requiring someone to file with
.rpmnew files etc. That would be unfortunate.


Vít



>   policy to
>  disable the SHA1 support or enable support for a national crypto
>  algorithm that is supported by the crypto libraries but is disabled in
>  the policies. System administrator will be able to add a simple
>  configuration file that will achieve this after calling the
>  update-crypto-policies command.
>
>  == Benefit to Fedora ==
>
>  This will enable advanced users of Fedora to adjust the
>  crypto-policies of the system to their particular needs and
>  requirements.
>
>  It will also enable using Fedora where the national crypto algorithms
>  are required without need to manually tinker with configurations of
>  various software components to enable the national crypto algorithms.
>
>  == Scope ==
>  * Proposal owners:
>  The design of the feature and prototype is already finished upstream.
>  We still need to convert the existing back-end policy generators to
>  the new framework and convert the existing policy definitions to the
>  new format. Then the crypto-policies package will be rebased to the
>  version with the custom crypto policies support included.
>
>  * Other developers: N/A (not a System Wide Change)
>  * Release engineering: N/A (not a System Wide Change)
>  * Policies and guidelines: N/A (not a System Wide Change)
>  * Trademark approval: N/A (not needed for this Change)
>
>  == Upgrade/compatibility impact ==
>
>  No impact. The crypto policies will continue to work as expected and
>  worked before if a custom policy is not set.
>
>  == How To Test ==
>
>  This will be tested as part of the upstream crypto-policies testsuite.
>
>  == User Experience ==
>
>  Unless the user will choose to create and/or apply a custom crypto
>  policy on the system, there will be no noticeable user experience
>  change.
>
>  == Dependencies ==
>
>  N/A (not a System Wide Change)
>
>  == Contingency Plan ==
>
>  * Contingency mechanism: (What to do?  Who will do it?) N/A (not a
>  System Wide Change)
>
>  == Documentation ==
>
>  N/A (not a System Wide Change)
>
>  == Release Notes ==
>
>  The crypto-policies package was enhanced to allow system
>  administrators to modify the existing system-wide crypto policy levels
>  by removing or adding enabled algorithms and protocols. For example it
>  is now possible to easily modify the existing DEFAULT policy to
>  disable the SHA1 support or enable support for a national crypto
>  algorithm that is supported by the crypto libraries but is disabled in
>  the policies. This can be achieved by adding a simple configuration
>  file and calling the update-crypto-policies command.
>

[Tomas Mraz]

On Wed, 2019-06-19 at 10:19 +0200, Vít Ondruch wrote:
>  Dne 18. 06. 19 v 21:50 Ben Cotton napsal(a):
>  > https://fedoraproject.org/wiki/Changes/CustomCryptoPolicies
>  > 
>  > == Summary ==
>  > This new feature of crypto-policies allows system administrators
>  > and
>  > third party providers to modify and adjust the existing system-wide
>  > crypto policies to enable or disable algorithms and protocols.
>  > 
>  > == Owner ==
>  > * Name: [[User:Tmraz | Tomáš Mráz]]
>  > * Email: tmraz(a)redhat.com
>  > 
>  > == Detailed Description ==
>  > 
>  > The crypto-policies package will be enhanced to allow system
>  > administrators to modify the existing system-wide crypto policy
>  > levels
>  > by removing or adding enabled algorithms and protocols. For example
>  > it
>  > will be possible to easily modify the existing DEFAULT
>  
>  I just wonder what is the strategy here? Does it means that the
>  "DEFAULT" definition will be store permanently somewhere in /usr/ and
>  I'll be able to copy the DEFAULT into /etc and modify it according to
>  my
>  needs?
>  
>  I am just asking, because AFAIK, currently the crypto policies
>  configuration is stored just in /etc and modifying the "DEFAULT"
>  profile
>  would make the updates problematic, requiring someone to file with
>  .rpmnew files etc. That would be unfortunate. 
The configuration files will be created by a simple python application
(which the update-crypto-policies will transform into). You will
specify just the modifications that should be done to the base policy.

Please see 
https://gitlab.com/redhat-crypto/fedora-crypto-policies/tree/custom-policies 
to get the idea.

We might continue shipping the "unmodified" configurations in
/usr/share but I do not see much benefit in that except for being able
for the sysadmin to look at how the unmodified individual
configurations look like without applying the policy to the system.

-- 
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]

[Vít Ondruch]

Dne 19. 06. 19 v 12:00 Tomas Mraz napsal(a):
>  On Wed, 2019-06-19 at 10:19 +0200, Vít Ondruch wrote:
> > Dne 18. 06. 19 v 21:50 Ben Cotton napsal(a):
> >> https://fedoraproject.org/wiki/Changes/CustomCryptoPolicies
> >>
> >> == Summary ==
> >> This new feature of crypto-policies allows system administrators
> >> and
> >> third party providers to modify and adjust the existing system-wide
> >> crypto policies to enable or disable algorithms and protocols.
> >>
> >> == Owner ==
> >> * Name: [[User:Tmraz | Tomáš Mráz]]
> >> * Email: tmraz(a)redhat.com
> >>
> >> == Detailed Description ==
> >>
> >> The crypto-policies package will be enhanced to allow system
> >> administrators to modify the existing system-wide crypto policy
> >> levels
> >> by removing or adding enabled algorithms and protocols. For example
> >> it
> >> will be possible to easily modify the existing DEFAULT
> > I just wonder what is the strategy here? Does it means that the
> > "DEFAULT" definition will be store permanently somewhere in /usr/ and
> > I'll be able to copy the DEFAULT into /etc and modify it according to
> > my
> > needs?
> >
> > I am just asking, because AFAIK, currently the crypto policies
> > configuration is stored just in /etc and modifying the "DEFAULT"
> > profile
> > would make the updates problematic, requiring someone to file with
> > .rpmnew files etc. That would be unfortunate.
>  The configuration files will be created by a simple python application
>  (which the update-crypto-policies will transform into). You will
>  specify just the modifications that should be done to the base policy.
>
>  Please see 
>  https://gitlab.com/redhat-crypto/fedora-crypto-policies/tree/custom-policies 
>  to get the idea.
>
>  We might continue shipping the "unmodified" configurations in
>  /usr/share but I do not see much benefit in that except for being able
>  for the sysadmin to look at how the unmodified individual
>  configurations look like without applying the policy to the system.
>  
Looking at "unmodified" configuration is great benefit on itself.

Being able to `rm -rf /etc/cryptopolicies` (or whatever is the right
folder) to restore the original configuration would be even better. But
maybe the "update-crypto-policies" creates configuration files for
several cryptolibraries, so this might not be possible without
modification of those libraries, dunno.


Vít

[Tomas Mraz]

On Wed, 2019-06-19 at 12:49 +0200, Vít Ondruch wrote:
>  Dne 19. 06. 19 v 12:00 Tomas Mraz napsal(a):
>  > On Wed, 2019-06-19 at 10:19 +0200, Vít Ondruch wrote:
>  > > Dne 18. 06. 19 v 21:50 Ben Cotton napsal(a):
>  > > > https://fedoraproject.org/wiki/Changes/CustomCryptoPolicies
>  > > > 
>  > > > == Summary ==
>  > > > This new feature of crypto-policies allows system
>  > > > administrators
>  > > > and
>  > > > third party providers to modify and adjust the existing system-
>  > > > wide
>  > > > crypto policies to enable or disable algorithms and protocols.
>  > > > 
>  > > > == Owner ==
>  > > > * Name: [[User:Tmraz | Tomáš Mráz]]
>  > > > * Email: tmraz(a)redhat.com
>  > > > 
>  > > > == Detailed Description ==
>  > > > 
>  > > > The crypto-policies package will be enhanced to allow system
>  > > > administrators to modify the existing system-wide crypto policy
>  > > > levels
>  > > > by removing or adding enabled algorithms and protocols. For
>  > > > example
>  > > > it
>  > > > will be possible to easily modify the existing DEFAULT
>  > > I just wonder what is the strategy here? Does it means that the
>  > > "DEFAULT" definition will be store permanently somewhere in /usr/
>  > > and
>  > > I'll be able to copy the DEFAULT into /etc and modify it
>  > > according to
>  > > my
>  > > needs?
>  > > 
>  > > I am just asking, because AFAIK, currently the crypto policies
>  > > configuration is stored just in /etc and modifying the "DEFAULT"
>  > > profile
>  > > would make the updates problematic, requiring someone to file
>  > > with
>  > > .rpmnew files etc. That would be unfortunate.
>  > The configuration files will be created by a simple python
>  > application
>  > (which the update-crypto-policies will transform into). You will
>  > specify just the modifications that should be done to the base
>  > policy.
>  > 
>  > Please see 
>  > https://gitlab.com/redhat-crypto/fedora-crypto-policies/tree/custom-policies 
>  > to get the idea.
>  > 
>  > We might continue shipping the "unmodified" configurations in
>  > /usr/share but I do not see much benefit in that except for being
>  > able
>  > for the sysadmin to look at how the unmodified individual
>  > configurations look like without applying the policy to the system.
>  > 
>  
>  Looking at "unmodified" configuration is great benefit on itself. 
Unmodified from what? What I meant above were the unmodified pristine
DEFAULT, LEGACY, FUTURE or FIPS configurations, not something like 
library default configuration without crypto policies.

>  Being able to `rm -rf /etc/cryptopolicies` (or whatever is the right
>  folder) to restore the original configuration would be even better.
>  But
>  maybe the "update-crypto-policies" creates configuration files for
>  several cryptolibraries, so this might not be possible without
>  modification of those libraries, dunno. 
But no such thing was ever possible since crypto policies were
introduced and there is currently no plan to do that.

This is certainly out of scope for the Custom Crypto Policies change.

I am also not sure what do you mean exactly by "original configuration"
- do you mean the configuration if there was no crypto-policies on the
system? Then that would require more configuration handling changes on
the individual crypto backend libraries/applications.

-- 
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]

[Vít Ondruch]

Dne 18. 06. 19 v 21:50 Ben Cotton napsal(a):
>  == How To Test ==
>
>  This will be tested as part of the upstream crypto-policies testsuite. 

I think this section should describe, how I, as a Fedora user, am
supposed to test this. E.g.

1) Get this test package

2) Modify this file

3) Run this command

4) And as a result, you can now verify by this command that this new
crypto-policy is applied.


Vít

[Tomas Mraz]

On Wed, 2019-06-19 at 12:38 +0200, Vít Ondruch wrote:
>  Dne 18. 06. 19 v 21:50 Ben Cotton napsal(a):
>  > == How To Test ==
>  > 
>  > This will be tested as part of the upstream crypto-policies
>  > testsuite.
>  
>  I think this section should describe, how I, as a Fedora user, am
>  supposed to test this. E.g.
>  
>  1) Get this test package
>  
>  2) Modify this file
>  
>  3) Run this command
>  
>  4) And as a result, you can now verify by this command that this new
>  crypto-policy is applied. 
As this is self-contained change I am not sure this is necessary.
However I might provide test instructions or rather some kind of how-to 
as part of the crypto-policies documentation.

-- 
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]