Disable SHA1 for RPM in RHEL 9 CIS#14316
Merged
Mab879 merged 1 commit intoComplianceAsCode:masterfrom Jan 21, 2026
Merged
Conversation
The DEFAULT crypto policy on RHEL 9.7 adds SHA1 to `hash@rpm` policy, which we can see in `/etc/crypto-policies/state/CURRENT.pol`. Using SHA1 isn't compliant with CIS requirement 1.6.3 "Ensure system wide crypto policy disables sha1 hash and signature support". In this commit we will introduce a new custom crypto policy submodule that will disable SHA1 in `hash@rpm` policy. Resolves: https://issues.redhat.com/browse/RHEL-138448
jan-cerny
added
bugfix
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
ATEX Test ResultsTest artifacts have been submitted to Testing Farm. Results: View Test Results This comment was automatically generated by the ATEX workflow. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
Mab879
approved these changes
Jan 21, 2026
Mab879
approved these changes
Jan 21, 2026
jan-cerny
added a commit
to jan-cerny/scap-security-guide
that referenced
this pull request
Mar 5, 2026
We have discovered that after hardening a RHEL 9 system with CIS profile people can't install any RPM packages using dnf. Originally, we thought that the problem was caused by the recent PR ComplianceAsCode#14316 but it isn't caused by that because the problem is reproducible also with the latest released version 0.1.79. The actual reason is that the profile requires GPG checks everywhere but the GPG key isn't installed because the CIS profile doesn't contain rule `ensure_redhat_gpgkey_installed` that would install the GPG key. The rule is listed in the CIS RHEL9 control file but the requirement is manual. This is a bad user experience. In CIS Benchmark, the requirement is manual, because of GPG keys for 3rd party repositories. But, add the rule `ensure_redhat_gpgkey_installed` to the profile because the requirement 1.2.1.2 adds `ensure_gpgcheck_never_disabled` which requires GPG key checking. If the Red Hat GPG key wouldn't be installed, people won't be able to install any RPM package using dnf. Therefore, we will add the rule `ensure_redhat_gpgkey_installed` to RHEL 9 CIS.
ggbecker
added
the
Highlight
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The DEFAULT crypto policy on RHEL 9.7 adds SHA1 to
hash@rpmpolicy, which we can see in/etc/crypto-policies/state/CURRENT.pol. Using SHA1 isn't compliant with CIS requirement 1.6.3 "Ensure system wide crypto policy disables sha1 hash and signature support". In this commit we will introduce a new custom crypto policy submodule that will disable SHA1 inhash@rpmpolicy.Resolves: https://issues.redhat.com/browse/RHEL-138448
Review hints
Harden a RHEL 9 system with this profile. Then run
update-crypto-policies --showand verify the output containsNO-RPMSHA1grep SHA1 /etc/crypto-policies/state/CURRENT.pol