From 966dbf618d1ba129f3fda3059223b89d9449eeec Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Nov 14 2024 22:21:50 +0000 Subject: [PATCH 1/2] Semantic breaks. --- diff --git a/guidelines/modules/ROOT/pages/CryptoPolicies.adoc b/guidelines/modules/ROOT/pages/CryptoPolicies.adoc index 21e61ce..35b3d3b 100644 --- a/guidelines/modules/ROOT/pages/CryptoPolicies.adoc +++ b/guidelines/modules/ROOT/pages/CryptoPolicies.adoc @@ -2,31 +2,104 @@ == Enforcing system crypto policies -In Fedora there are policies for the usage of cryptographic protocols such as TLS that are enforced system-wide. Each application being added in Fedora must be checked to comply with the policies. Currently the policies are restricted to major libraries such as GnuTLS, OpenSSL, NSS, libkrb5, languages such as Java and major applications like OpenSSH and bind. The rpmlint tool will warn when it detects that some action has to be taken; that detection is based on heuristics and limited to C programs, so manual inspection is recommended. Note however, that there are applications which intentionally set weaker, or custom settings on a purpose (e.g., postfix); those need not adhere to the policy. When in doubt, discuss with the https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/[Fedora crypto team]. +In Fedora there are policies for the usage of cryptographic protocols +such as TLS that are enforced system-wide. +Each application being added in Fedora must be checked +to comply with the policies. +Currently the policies are restricted to major libraries +such as GnuTLS, OpenSSL, NSS, libkrb5, +languages such as Java and major applications like OpenSSH and bind. +The rpmlint tool will warn when it detects that some action has to be taken; +that detection is based on heuristics +and limited to C programs, +so manual inspection is recommended. +Note however, +that there are applications which intentionally set weaker, +or custom settings on a purpose +(e.g., postfix); +those need not adhere to the policy. +When in doubt, +discuss with the +https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/[Fedora crypto team]. === New crypto libraries -New crypto libraries must comply with the crypto policies to enter Fedora, unless an exception has been granted by Fedora packaging committee, after consulting with https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/[Fedora crypto team]. +New crypto libraries must comply with the crypto policies to enter Fedora, +unless an exception has been granted by Fedora packaging committee, +after consulting with +https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/[Fedora crypto team]. === C/C++ applications * *OpenSSL applications*: -** _If the application provides a configuration file_ that allows to modify the cipher list string, ensure that the shipped file contains "PROFILE=SYSTEM" as default. In that case no further action is required. -** _If the application doesn't have a configuration file_, ensure that there is no default cipher list specified, or that the default list is set as "PROFILE=SYSTEM". That is, check the source code for *SSL_CTX_set_cipher_list*(). If it is not present then nothing needs to be done (the default is used). Otherwise, if that call is present and provided a fixed string which does not contain PSK or SRP, replace the string with "PROFILE=SYSTEM", or remove the call. +** _If the application provides a configuration file_ +that allows to modify the cipher list string, +ensure that the shipped file contains "PROFILE=SYSTEM" as default. +In that case no further action is required. + +** _If the application doesn't have a configuration file_, +ensure that there is no default cipher list specified, +or that the default list is set as "PROFILE=SYSTEM". +That is, check the source code for *SSL_CTX_set_cipher_list*(). +If it is not present then nothing needs to be done (the default is used). +Otherwise, if that call is present +and provided a fixed string which does not contain PSK or SRP, +replace the string with "PROFILE=SYSTEM", +or remove the call. * *GnuTLS applications*: -** _If the application provides a configuration file_ that allows to modify the cipher priority string, the shipped file contains "@SYSTEM" as default. In that case no further action is required. -** _If the application doesn't have a configuration file_, ensure that it uses gnutls_set_default_priority(), or that the default priority string is "@SYSTEM". That is, check the source code for *gnutls_priority_set_direct*(), *gnutls_priority_init*(); if they are not present and gnutls_set_default_priority() is used, nothing needs to be done. Otherwise check the strings provided by the application. If it contains PSK or SRP do nothing (these applications are not currently covered by the default policy). If not, then replace gnutls_priority_set_direct() with gnutls_set_default_priority(). If gnutls_priority_init() is used instead with a fixed string, replace the string with "@SYSTEM". +** _If the application provides a configuration file_ +that allows to modify the cipher priority string, +the shipped file contains "@SYSTEM" as default. +In that case no further action is required. +** _If the application doesn't have a configuration file_, +ensure that it uses gnutls_set_default_priority(), +or that the default priority string is "@SYSTEM". +That is, check the source code for *gnutls_priority_set_direct*(), +*gnutls_priority_init*(); +if they are not present and gnutls_set_default_priority() is used, +nothing needs to be done. +Otherwise check the strings provided by the application. +If it contains PSK or SRP do nothing +(these applications are not currently covered by the default policy). +If not, then replace gnutls_priority_set_direct() +with gnutls_set_default_priority(). +If gnutls_priority_init() is used instead with a fixed string, +replace the string with "@SYSTEM". -Applications utilizing other cryptographic libraries do not adhere to the system wide crypto policies (note that adherence to the system-wide policies is work in progress for NSS libraries). Applications in Fedora should use one of these libraries when there is choice, and preferrably the version recommended by upstream. +Applications utilizing other cryptographic libraries +do not adhere to the system wide crypto policies +(note that adherence to the system-wide policies +is work in progress for NSS libraries) + Applications in Fedora should use one of these libraries +when there is choice, +and preferrably the version recommended by upstream. === Perl applications * *IO::Socket::SSL Perl applications*: -** Check the source code for passing *SSL_cipher_list* argument to *IO::Socket::SSL*'s methods like *new()*, *start_SSL()*, *new_from_fd()*, *set_defaults()*, *set_client_defaults()*, and *set_server_defaults()*. If it is not present then nothing needs to be done (the default is used). Otherwise, if that argument is present, remove the argument or change its value as described in OpenSSL section. +** Check the source code for passing *SSL_cipher_list* argument +to *IO::Socket::SSL*'s methods like *new()*, +*start_SSL()*, +*new_from_fd()*, +*set_defaults()*, +*set_client_defaults()*, +and *set_server_defaults()*. +If it is not present then nothing needs to be done (the default is used). +Otherwise, if that argument is present, +remove the argument or change its value as described in OpenSSL section. * *Net::SSLeay Perl applications*: -** Check the source code for *CTX_set_cipher_list()*, *set_cipher_list()*, and *set_pref_cipher()* subroutine calls from *Net::SSLeay* name space. If such a call presents, follow instructions described in the OpenSSL section. +** Check the source code for *CTX_set_cipher_list()*, +*set_cipher_list()*, +and *set_pref_cipher()* subroutine calls +from *Net::SSLeay* name space. +If such a call presents, +follow instructions described in the OpenSSL section. * *LWP::UserAgent Perl applications*: -** Check the source code for passing *SSL_cipher_list* argument to *ssl_opts()* method call on a *LWP::UserAgent* object. If such a call presents, follow instructions described in the OpenSSL section. +** Check the source code for passing *SSL_cipher_list* argument +to *ssl_opts()* method call +on a *LWP::UserAgent* object. +If such a call presents, +follow instructions described in the OpenSSL section. From 461d671c1a56fcb5382f604297e9c6bbd16db1d8 Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Nov 14 2024 22:21:50 +0000 Subject: [PATCH 2/2] Reword exception procedure The procedure for requesting an exception was a bit unclear. Reword it to clarify that the crypto team must approve before FPC becomes involved. --- diff --git a/guidelines/modules/ROOT/pages/CryptoPolicies.adoc b/guidelines/modules/ROOT/pages/CryptoPolicies.adoc index 35b3d3b..b9c033b 100644 --- a/guidelines/modules/ROOT/pages/CryptoPolicies.adoc +++ b/guidelines/modules/ROOT/pages/CryptoPolicies.adoc @@ -25,9 +25,14 @@ https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/ === New crypto libraries New crypto libraries must comply with the crypto policies to enter Fedora, -unless an exception has been granted by Fedora packaging committee, -after consulting with +unless an exception has been granted by Fedora packaging committee. +If you wish to submit a package which does not comply with the crypto policies, +you MUST first consult with the https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/[Fedora crypto team]. +Once their approval has been granted, +open a ticket with the +https://pagure.io/packaging-committee[Fedora Packaging Committee] +requesting an exemption. Please link to any relevant discussion. === C/C++ applications