Skip to content

Change the FIPS build option consistent with other features #1418

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xumia merged 1 commit into from
Jul 13, 2023
Merged

Change the FIPS build option consistent with other features #1418

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions doc/fips/SONiC-OpenSSL-FIPS-140-3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,13 +172,13 @@ export OPENSSL_CONFIG=/usr/lib/ssl/openssl-fips.cnf
### SONiC Build Options
Support to enable/disable the FIPS feature, the feature is enabled by default in rules/config as below.
```
ENABLE_FIPS_FEATURE ?= y
INCLUDE_FIPS ?= y
```
Support to enable/disable FIPS config, the flage is disabled by default. IF the option is set, then the fips is enabled by default in the image, not necesary to do the config in system level or application level.
```
ENABLE_FIPS ?= n
```
If the ENABLE_FIPS_FEATURE is not set, then the option ENABLE_FIPS is useless.
If the INCLUDE_FIPS is not set, then the option ENABLE_FIPS is useless.

## SONiC FIPS Command lines
### The command line to enable or disable FIPS
Expand All @@ -196,4 +196,4 @@ If the image is not specified, the next boot image will be used.

## Q&A
### Does SymCrypt use Linux Kernel crypto module?
SymCrypt on Linux does not rely on Kernel crypt for FIPS certification today.
SymCrypt on Linux does not rely on Kernel crypt for FIPS certification today.