Skip to content

crypt module fails to import in FIPS mode #95231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
sshedi opened this issue Jul 25, 2022 · 7 comments · Fixed by #94742
Closed

crypt module fails to import in FIPS mode #95231

sshedi opened this issue Jul 25, 2022 · 7 comments · Fixed by #94742
Labels
3.10 only security fixes 3.11 only security fixes 3.12 only security fixes stdlib Python modules in the Lib dir triaged The issue has been accepted as valid by a triager. type-bug An unexpected behavior, bug, or error

Comments

@sshedi
Copy link
Contributor

sshedi commented Jul 25, 2022 •
edited by tiran
Loading

Bug report

If kernel fips is enabled, we get permission error upon doing import crypt.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.

            import crypt
            Traceback (most recent call last):
            File "", line 1, in
            File "/usr/lib/python3.9/crypt.py", line 117, in
            _add_method('MD5', '1', 8, 34)
            File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
            result = crypt('', salt)
            File "/usr/lib/python3.9/crypt.py", line 82, in crypt
            return _crypt.crypt(word, salt)
            PermissionError: [Errno 1] Operation not permitted

Your environment

VMware Photon OS 4.0
x86_64 machine
Python-3.9.1
Kernel fips is enabled
@sshedi sshedi added the type-bug An unexpected behavior, bug, or error label Jul 25, 2022
@sshedi
Copy link
Contributor Author

sshedi commented Jul 25, 2022

Tried to fix it here: #94742

@sshedi sshedi mentioned this issue Jul 25, 2022
Merged
@erlend-aasland erlend-aasland linked a pull request Jul 25, 2022 that will close this issue
gh-95231: Disable md5 & crypt modules if FIPS is enabled #94742
Merged
@tiran tiran changed the title import crypto fails in kernel fips enabled machines crypt module fails to import in FIPS mode Jul 25, 2022
@tiran
Copy link
Member

tiran commented Jul 25, 2022

I have updated ticket to use the correct module name crypt instead of crypto.

@hugovk hugovk added stdlib Python modules in the Lib dir triaged The issue has been accepted as valid by a triager. labels Jul 25, 2022
@tiran tiran added 3.11 only security fixes 3.10 only security fixes 3.12 only security fixes labels Jul 25, 2022
@bedevere-bot bedevere-bot mentioned this issue Aug 15, 2022
Merged
miss-islington pushed a commit that referenced this issue Aug 15, 2022
@sshedi
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
2fa03b1 
If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Aug 15, 2022
@sshedi @miss-islington
pythongh-95231: Disable md5 & crypt modules if FIPS is enabled (pytho…
386b8aa 
…nGH-94742)

If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <[email protected]>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Aug 15, 2022
@sshedi @miss-islington
pythongh-95231: Disable md5 & crypt modules if FIPS is enabled (pytho…
1f49da6 
…nGH-94742)

If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <[email protected]>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <[email protected]>
@bedevere-bot bedevere-bot mentioned this issue Aug 15, 2022
Merged
miss-islington added a commit that referenced this issue Aug 15, 2022
@miss-islington @sshedi
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
3fa97b8 
If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <[email protected]>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <[email protected]>
@erlend-aasland
Copy link
Contributor

Resolved by:

Thanks for the PR, Shreenidhi!

miss-islington added a commit that referenced this issue Aug 30, 2022
@miss-islington @sshedi
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
069fefd 
If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <[email protected]>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <[email protected]>
@ArcticSnowman
Copy link

@erlend-aasland Given this is a security issue, surely this change should be added to 3.7 to 3.9?

@erlend-aasland
Copy link
Contributor

@erlend-aasland Given this is a security issue, surely this change should be added to 3.7 to 3.9?

I don't think so. IMO, it is not a security issue; it is just a matter of failing gracefully instead of raising a (possibly) confusing exception.

@malvidin malvidin mentioned this issue Mar 7, 2023
Closed
@jiridanek jiridanek mentioned this issue Jan 2, 2024
Open
@mixmind
Copy link

mixmind commented May 3, 2024

Hi everyone, any chance of backport it to 3.9 too??

@erlend-aasland
Copy link
Contributor

Hi everyone, any chance of backport it to 3.9 too??

Unfortunately not; see #95231 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
3.10 only security fixes 3.11 only security fixes 3.12 only security fixes stdlib Python modules in the Lib dir triaged The issue has been accepted as valid by a triager. type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

gh-95231: Disable md5 & crypt modules if FIPS is enabled
6 participants
@tiran @hugovk @erlend-aasland @ArcticSnowman @mixmind @sshedi