Upgraded Kernel 6 in Panic after enabling FIPS mode

Rocky Linux General
1

I have succesfully installed Rocky Linux 9.2 minimal (offline install and upgrade) wit a default kernel.
Everything worked well including the enabled FIPS module (after installation, offline) and the oscap-scanner (after installation, offline).

After upgrading to a ELRepo kernel 6 the OS refuses to boot in FIPS mode, I am able to launch it only with the FIPS mode disabled. After enabling Fips I got error message during the boot after Starting dracut pre-udev hook… saying:

crc32c_intel: module verifiction failed: signature and/or required key missing - tainting kernel
Kernel panic - not syncing: Module crc32c_intel signature verification failed in FIPS mode

(Btw, I have an AMD, not Intel.)

Does any one have any hint, how to get kernel 6 work in a FIPS mode and secure the machine with SCAP, please?

Thank you in advance!

2

Do you have secureboot enabled on that machine? if it’s enabled, elrepo kernel isn’t signed with our secureboot keys and in this case you may need to enrol elrepo certs

It might be related to FIPS as well, but I would check secureboot first

3

Yep, I have SB enabled. I have also enrolled the keys via mokuti, but I did not signed the elrepo kernel I have the .der secure boot file, I am just not sure how is the procedure to signe the kernel with it like.
Please is there some documentation for signing it? Is it directly at elrepo.org documentation? I hav tried to google it out but without success.

Thenks a lot!

4

I think this has something in common with my secureboot settings in BIOS, I will go throug again.

5