Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypt module fails to import in FIPS mode #95231

Closed
sshedi opened this issue Jul 25, 2022 · 5 comments · Fixed by #94742
Closed

crypt module fails to import in FIPS mode #95231

sshedi opened this issue Jul 25, 2022 · 5 comments · Fixed by #94742
Labels
3.10 3.11 3.12 stdlib Python modules in the Lib dir triaged The issue has been accepted as valid by a triager. type-bug An unexpected behavior, bug, or error

Comments

@sshedi
Copy link
Contributor

sshedi commented Jul 25, 2022 •
edited by tiran

Bug report

If kernel fips is enabled, we get permission error upon doing import crypt.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.

            import crypt
            Traceback (most recent call last):
            File "", line 1, in
            File "/usr/lib/python3.9/crypt.py", line 117, in
            _add_method('MD5', '1', 8, 34)
            File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
            result = crypt('', salt)
            File "/usr/lib/python3.9/crypt.py", line 82, in crypt
            return _crypt.crypt(word, salt)
            PermissionError: [Errno 1] Operation not permitted

Your environment

VMware Photon OS 4.0
x86_64 machine
Python-3.9.1
Kernel fips is enabled
@sshedi sshedi added the type-bug An unexpected behavior, bug, or error label Jul 25, 2022
@sshedi
Copy link
Contributor Author

sshedi commented Jul 25, 2022

Tried to fix it here: #94742

@sshedi sshedi mentioned this issue Jul 25, 2022
Merged
@erlend-aasland erlend-aasland linked a pull request Jul 25, 2022 that will close this issue
gh-95231: Disable md5 & crypt modules if FIPS is enabled #94742
Merged
@tiran tiran changed the title import crypto fails in kernel fips enabled machines crypt module fails to import in FIPS mode Jul 25, 2022
@tiran
Copy link
Member

tiran commented Jul 25, 2022

I have updated ticket to use the correct module name crypt instead of crypto.

@hugovk hugovk added stdlib Python modules in the Lib dir triaged The issue has been accepted as valid by a triager. labels Jul 25, 2022
sshedi added a commit to sshedi/cpython that referenced this issue Aug 2, 2022
@sshedi
pythongh-95231: Handle the EPERM error gracefully in crypt.py.
a047443 
If kernel fips is enabled, we get permission error upon doing
`import crypt`.

Logs after reproducing the issue:
Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
sshedi added a commit to sshedi/cpython that referenced this issue Aug 8, 2022
@sshedi
pythongh-95231: Handle the EPERM error gracefully in crypt.py.
8ad9007 
If kernel fips is enabled, we get permission error upon doing
`import crypt`.

Logs after reproducing the issue:
Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
@bedevere-bot bedevere-bot mentioned this issue Aug 15, 2022
Merged
miss-islington pushed a commit that referenced this issue Aug 15, 2022
@sshedi
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
2fa03b1 
If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Aug 15, 2022
@sshedi @miss-islington
pythongh-95231: Disable md5 & crypt modules if FIPS is enabled (pytho…
386b8aa 
…nGH-94742)

If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <53473811+sshedi@users.noreply.github.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Aug 15, 2022
@sshedi @miss-islington
pythongh-95231: Disable md5 & crypt modules if FIPS is enabled (pytho…
1f49da6 
…nGH-94742)

If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <53473811+sshedi@users.noreply.github.com>
@bedevere-bot bedevere-bot mentioned this issue Aug 15, 2022
Merged
miss-islington added a commit that referenced this issue Aug 15, 2022
@miss-islington @sshedi
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
3fa97b8 
If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <53473811+sshedi@users.noreply.github.com>
@erlend-aasland
Copy link
Contributor

erlend-aasland commented Aug 15, 2022

Resolved by:

Thanks for the PR, Shreenidhi!

miss-islington added a commit that referenced this issue Aug 30, 2022
@miss-islington @sshedi
gh-95231: Disable md5 & crypt modules if FIPS is enabled (GH-94742)
069fefd 
If kernel fips is enabled, we get permission error upon doing
`import crypt`. So, if kernel fips is enabled, disable the
unallowed hashing methods.

Python 3.9.1 (default, May 10 2022, 11:36:26)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import crypt
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.9/crypt.py", line 117, in <module>
    _add_method('MD5', '1', 8, 34)
  File "/usr/lib/python3.9/crypt.py", line 94, in _add_method
    result = crypt('', salt)
  File "/usr/lib/python3.9/crypt.py", line 82, in crypt
    return _crypt.crypt(word, salt)
PermissionError: [Errno 1] Operation not permitted

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
(cherry picked from commit 2fa03b1)

Co-authored-by: Shreenidhi Shedi <53473811+sshedi@users.noreply.github.com>
@ArcticSnowman
Copy link

ArcticSnowman commented Nov 18, 2022

@erlend-aasland Given this is a security issue, surely this change should be added to 3.7 to 3.9?

@erlend-aasland
Copy link
Contributor

erlend-aasland commented Nov 22, 2022

@erlend-aasland Given this is a security issue, surely this change should be added to 3.7 to 3.9?

I don't think so. IMO, it is not a security issue; it is just a matter of failing gracefully instead of raising a (possibly) confusing exception.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
3.10 3.11 3.12 stdlib Python modules in the Lib dir triaged The issue has been accepted as valid by a triager. type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

gh-95231: Disable md5 & crypt modules if FIPS is enabled sshedi/cpython
5 participants
@tiran @hugovk @erlend-aasland @ArcticSnowman @sshedi