Repository navigation
crypt module fails to import in FIPS mode #95231
Description
Bug report
If kernel fips is enabled, we get permission error upon doing import crypt.
Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
import crypt
Traceback (most recent call last):
File "", line 1, in
File "/usr/lib/python3.9/crypt.py", line 117, in
_add_method('MD5', '1', 8, 34)
File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
result = crypt('', salt)
File "/usr/lib/python3.9/crypt.py", line 82, in crypt
return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted
Your environment
VMware Photon OS 4.0
x86_64 machine
Python-3.9.1
Kernel fips is enabled
Activity
sshedi commentedon Jul 25, 2022
Tried to fix it here: #94742
[-]`import crypto` fails in kernel fips enabled machines[/-][+]crypt module fails to import in FIPS mode[/+]tiran commentedon Jul 25, 2022
I have updated ticket to use the correct module name
cryptinstead ofcrypto.gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
pythongh-95231: Disable md5 & crypt modules if FIPS is enabled (pytho…
pythongh-95231: Disable md5 & crypt modules if FIPS is enabled (pytho…
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
erlend-aasland commentedon Aug 15, 2022
Resolved by:
Thanks for the PR, Shreenidhi!
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
ArcticSnowman commentedon Nov 18, 2022
@erlend-aasland Given this is a security issue, surely this change should be added to 3.7 to 3.9?
erlend-aasland commentedon Nov 22, 2022
I don't think so. IMO, it is not a security issue; it is just a matter of failing gracefully instead of raising a (possibly) confusing exception.
mixmind commentedon May 3, 2024
Hi everyone, any chance of backport it to 3.9 too??
erlend-aasland commentedon May 3, 2024
Unfortunately not; see #95231 (comment)