[OS-BUILD PATCH] configs: enable CONFIG_CRYPTO_CTS=y so cts(cbc(aes)) is available in FIPS mode

[Vladis Dronov]

Currently the CTS algo is built as a module. This is a problem if any
ciphers using CTS are marked as FIPS-enabled and the system is booted
in FIPS mode, as dracut does not include cts.ko in the initramfs. This
change is necessary for NFS with sec=krb5{,i,p} to work in FIPS mode.
Otherwise, the following panic would result:

[    8.462065] alg: skcipher: Failed to load transform for cts(cbc(aes)): -2
[    8.463705] Kernel panic - not syncing: cts(cbc(aes)): cts(cbc(aes)) alg self test
failed in fips mode!

Fix this by embedding the CTS code into a kernel, the same way as Fedora
already does. This was tested by a reproducer in bz1855161 #c24, #c28.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1855161
Signed-off-by: Vladis Dronov <vdronov(a)redhat.com&gt;
---
 redhat/configs/ark/generic/CONFIG_CRYPTO_CTS                     | 1 -
 .../generic/s390x/zfcpdump => common/generic}/CONFIG_CRYPTO_CTS  | 0
 redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS                  | 1 -
 3 files changed, 2 deletions(-)
 delete mode 100644 redhat/configs/ark/generic/CONFIG_CRYPTO_CTS
 rename redhat/configs/{ark/generic/s390x/zfcpdump => common/generic}/CONFIG_CRYPTO_CTS
(100%)
 delete mode 100644 redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS

diff --git a/redhat/configs/ark/generic/CONFIG_CRYPTO_CTS
b/redhat/configs/ark/generic/CONFIG_CRYPTO_CTS
deleted file mode 100644
index 2529a2fa5379..000000000000
--- a/redhat/configs/ark/generic/CONFIG_CRYPTO_CTS
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_CRYPTO_CTS=m
diff --git a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS
b/redhat/configs/common/generic/CONFIG_CRYPTO_CTS
similarity index 100%
rename from redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS
rename to redhat/configs/common/generic/CONFIG_CRYPTO_CTS
diff --git a/redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS
b/redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS
deleted file mode 100644
index e7ff7297caed..000000000000
--- a/redhat/configs/fedora/generic/CONFIG_CRYPTO_CTS
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_CRYPTO_CTS=y
-- 
2.26.2

[Vladis Dronov]

I've got the following reply for this patch:

----- Original Message -----
>  From: cki-gitlab(a)redhat.com
>  
>  Hello,
>  
>  We were unable to apply this patch series to the current development branch.
>  The current head of the ark-patches branch is commit
>  17b0f7f1d49df30661b517d668715ff5ee1bab09
>  
>  Please rebase this series against the current development branch and resend it
>  or, if you prefer never seeing this email again, submit your series as a pull
>  request:
>  
>    1. Create an account and fork https://gitlab.com/cki-project/kernel-ark/.
>    2. git remote add <remote-name> <your-forked-repo>
>    3. git push <remote-name> <branch-name> --push-option=merge_request.create
> \
>         --push-option=merge_request.title="[OS-BUILD] configs: enable
>         CONFIG_CRYPTO_CTS=y so cts(cbc(aes)) is available in FIPS mode" 
I have no idea why the patch was applied to the the ark-patches branch while it
has "[OS-BUILD PATCH]" in the Subject: and should be applied to the os-build
branch, as docs say.

Anyway, I've create a merge request using GitLab:

https://gitlab.com/cki-project/kernel-ark/-/merge_requests/704

So NACK-ing this one:

Nacked-by: Vladis Dronov <vdronov(a)redhat.com&gt;

Best regards,
Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer