Re: [PATCH] Allow hmac(sha512) for unpriviledged users

[Eric Biggers <ebiggers@kernel.org>]

On Sat, Oct 03, 2026 at 11:05:31AM -0600, Justin Forbes wrote:
> On Sat, Oct 03, 2026 at 06:18:59PM +0200, Eric Biggers wrote:
> > On Sat, Oct 03, 2026 at 10:03:02AM -0600, Justin M. Forbes wrote:
> > > By default users cannot run sha512hmac with the current set up. This
> > > is problematic because our kernel builds call this for FIPS compliance.
> > > Rather than have anyone turn off af_alg_restrict all together, let's
> > > allow a common use case.
> > > 
> > > Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
> > 
> > The fips hook in dracut was taken into account already, and it runs as
> > root.  So this patch shouldn't be needed.  Can you clarify why you think
> > it is needed?
> > 
> > - Eric
> 
> Specifically for the case of Fedora and all Red Hat kernels, we call
> sha512hmac to sign the kernel, and a couple of UKI images that are
> created during the kernel build. Users on Fedora 45 and newer are now
> unable to build the kernel from spec without turning off af_alg_restrict
> all together, while any user can build a kernel on Fedora 44 or older.

I see, it's in redhat/kernel.spec.template in the Fedora kernel source
tree which is used when packaging the kernel into an RPM package.
Please make that super clear in your commit message, because it wasn't
clear you were talking about something different from the use in dracut.

I guess the actual diff is fine then, since something like this that's
being used should continue to be allowed.

Of course, this is yet another gratuitous use of AF_ALG, as I've
explained previously
(https://lore.kernel.org/r/20260504173952.GA2291@sol/).  Depending
AF_ALG to build the kernel (vs. just using OpenSSL for example) is even
more misguided than using it in the integrity check itself, as at least
there are FIPS boundary considerations for the integrity check itself,
but those are irrelevant for the build tools.

So even though this will keep being allowed for now, please work to get
this fixed to not need AF_ALG.  Note also that Fedora 45 explicitly
deprecates AF_ALG (https://lwn.net/Articles/1088489/) on top of the
already-documented upstream deprecation.

- Eric