Sign Beats RPMs w/ SHA256 header for FIPS-enabled Operating Systems

[n0othing]

Describe the enhancement:

Beats RPMs will fail to install on RHEL 8 w/ FIPS mode enabled because the RPMs aren't signed with a SHA256 header (see BZ#1581990 [1].

[robbie@rob-nix-06 ~]$ sudo rpm -ivh auditbeat-7.9.2-x86_64.rpm
warning: auditbeat-7.9.2-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
        package auditbeat-7.9.2-1.x86_64 does not verify: no digest

It's possible to get around this by installing with --nodigest --nofiledigest arguments [2], but such a workaround may not be acceptable for certain organizations.

[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.0_release_notes/index
[2] https://access.redhat.com/solutions/4460971

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[ruflin]

There is currently some work ongoing in Elasticsearch, see elastic/elasticsearch#75731 and the related issues / pull requests. We need to figure out we make this best happen as part of the build process.

[breskeby]

just for clarification. I think apart from the sha256 header digest also sha256 payload digest. Furthermore file digest needs to be switched from md5 (rpm default) to sha256. how are the beats rpms currently build? ES is using the nebula ospackage plugin which relies on redline, a java library for building rpms. We needed to patch this redline library to get sha256 header and sha256 payload + file digests in our ES RPMS

[andrewkroh]

The RPMs from beats are built using fpm. FPM does have an --rpm-digest flag that appears to control the _binary_filedigest_algorithm.

https://github.com/jordansissel/fpm/blob/067f4ccfd07d228256ff313be4f9dc36e61055ee/templates/rpm.erb#L23-L27

beats/dev-tools/mage/pkgtypes.go

Lines 712 to 758 in 5481b06

	args = append(args,
	"--rm",
	"-w", "/app",
	"-v", CWD()+":/app",
	beatsFPMImage+":"+fpmVersion,
	"fpm", "--force",
	"--input-type", "tar",
	"--output-type", fpmPackageType,
	"--name", spec.ServiceName,
	"--architecture", spec.Arch,
	)
	if packageType == RPM {
	args = append(args, "--rpm-rpmbuild-define", "_build_id_links none")
	}
	if spec.Version != "" {
	args = append(args, "--version", spec.Version)
	}
	if spec.Vendor != "" {
	args = append(args, "--vendor", spec.Vendor)
	}
	if spec.License != "" {
	args = append(args, "--license", strings.Replace(spec.License, " ", "-", -1))
	}
	if spec.Description != "" {
	args = append(args, "--description", spec.Description)
	}
	if spec.URL != "" {
	args = append(args, "--url", spec.URL)
	}
	if spec.localPreInstallScript != "" {
	args = append(args, "--before-install", spec.localPreInstallScript)
	}
	if spec.localPostInstallScript != "" {
	args = append(args, "--after-install", spec.localPostInstallScript)
	}
	for _, pf := range spec.Files {
	if pf.Config {
	args = append(args, "--config-files", pf.Target)
	}
	if pf.Owner != "" {
	args = append(args, "--rpm-attr", fmt.Sprintf("%04o,%s,%s:%s", pf.Mode, pf.Owner, pf.Owner, pf.Target))
	}
	}
	args = append(args,
	"-p", spec.OutputFile,
	inputTar,
	)

[andrewkroh]

Does this look like what we want?

# rpm --checksig -v filebeat-*rpm
filebeat-8.0.0-SNAPSHOT-x86_64.rpm:
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK

I updated the FPM container image to include rpm 4.14.2 (it had 4.12). And then I added --rpm-digest sha256 to the args we use in Beats.

[andrewkroh]

Here's the update for FPM: elastic/golang-crossbuild#118

[breskeby]

@andrewkroh that looks good IMO. For elasticsearch we have this output for the rpm I've tested succesfully on centos tips enabled:

rpm --checksig -v elasticsearch-8.0.0-SNAPSHOT-x86_64.rpm
elasticsearch-8.0.0-SNAPSHOT-x86_64.rpm:
    Header V4 RSA/SHA512 Signature, key ID d88e42b4: OK
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V4 RSA/SHA512 Signature, key ID d88e42b4: OK

[breskeby]

one thing I also needed to change is to use filedigestalgo to sha256 (defaults to md5) to get our rpm working. You should be able to test the RPM on one of our centos 8 fips enabled CI images

[andrewkroh]

And this is the change to Beats to add the --rpm-digest flag to FPM. #27103