The install of Tumbleweed from the modified install disk proceeded successfully to completion last night, and the system is running as I write. I look forward to examining it more closely. To confirm the hypothesis that the fips module required the sse2 instruction I tried activating it. Before doing so, openssl was functional. Afterwards: **** # zypper install libopenssl1_0_0-hmac (...proceeds to completion)
openssl fips.c(484): OpenSSL internal error, assertion failed: FATAL FIPS SELFTEST FAILURE Abort (core dumped)
****
Of course, then even zypper is so broken one cannot use it to remove
the packages until the /lib/.lib* files are removed manually.
So that's the problem - the install iso's will not work on non-sse2
cpus because the fips module has been compiled to use sse2
instructions, and has been activated in the included initrd.
Thanks for your interest and support.
On Sun, Apr 2, 2017 at 5:22 AM, Cyrus Rahman
I recently tried to install the latest NET installation iso on a Pentium 3 system which does not support the sse2 instruction set.
I was unable to boot the install iso's (either the full or the NET); the installation aborted during boot with a kernel panic.
On the other hand, the live and rescue iso's worked fine. I was able to run KDE, etc.
After a bit of work I discovered the problem was that the linuxrc program used as the init program in the installation iso's was exiting upon startup with the "FATAL FIPS SELFTEST FAILURE" message from OpenSSL.
I am not sure but I expect this is occuring because the crypto module used for fips compliance has probably been built with the sse2 assembly code.
I was able to successfully build and boot an installation iso by removing the two files that activate fips: libcrypto.so.*.hmac and .libssl.so.*.hmac from /lib in the initrd archive on the iso. I then produced a new iso with this modified initrd file and booted it successfully.
I will try to complete the install tomorrow and if I experience any additional problems I will document them - but it has proceeded far enough that I think all will be well.
-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org