http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c1 Andreas Schneider changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com --- Comment #1 from Andreas Schneider --- It is triggered by authenticating via Kerberos, but the problem is the OpenSSL FIPS test if you have libopenssl1_1-hmac installed: KRB5_TRACE=/dev/stderr firefox ExceptionHandler::GenerateDump cloned child 11160 ExceptionHandler::SendContinueSignalToChild sent continue signal to child ExceptionHandler::WaitForContinueSignal waiting for continue signal... crypto/fips/fips.c:521: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE Redirecting call to abort() to mozalloc_abort -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c3 --- Comment #3 from Andreas Schneider --- Yes, it does: OPENSSL_FORCE_FIPS_MODE=1 openssl OpenSSL> -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c7 --- Comment #7 from Marcus Meissner --- Created attachment 833812 --> http://bugzilla.suse.com/attachment.cgi?id=833812&action=edit firefox-fips.patch i am currently building it and will submit -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c9 --- Comment #9 from Andreas Schneider --- I'm sorry, but this doesn't fix it ... (gdb) bt full #0 0x00005555555bb9ae in mozalloc_abort () #1 0x0000555555563e84 in () #2 0x00007fffaac466fc in OPENSSL_die (message=<optimized out>, file=<optimized out>, line=<optimized out>) at crypto/cryptlib.c:421 #3 0x00007fffaabe3ac3 in NONFIPS_selftest_check () at crypto/fips/fips.c:521 rv = <optimized out> hmacpath = 0x7fffa1557820 '\345' , "\370a1\365\377\177" path = "/usr/lib64/libcrypto.so.1.1", '\000' #4 0x00007fffaab660e1 in init_fips_mode () at crypto/o_init.c:49 buf = "0" fd = -1 done = 1 #5 0x00007fffaab660e1 in OPENSSL_init_library () at crypto/o_init.c:69 done = 1 #6 0x00007ffff7fe20aa in call_init.part () at /lib64/ld-linux-x86-64.so.2 #7 0x00007ffff7fe21a9 in _dl_init () at /lib64/ld-linux-x86-64.so.2 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c11 --- Comment #11 from Marcus Meissner --- yeah, the definition is "if the fIPS module is complete, self tests need to run". It is not clear which self test fails. Can you get an strace of some form or attach gdb earlier? Or how I can reproduce this krb5 setup? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c13 --- Comment #13 from Marcus Meissner --- $ rpm -q libopenssl1_1 libopenssl1_1-hmac MozillaFirefox libopenssl1_1-1.1.1d-7.1.x86_64 libopenssl1_1-hmac-1.1.1d-7.1.x86_64 MozillaFirefox-74.0-2.1.x86_64 I setup krb5 as abvoe and created a fedoraproject.org account and logged into it and opened bodhi.fedoraproject.org and logged in there... $ klist Ticket cache: DIR::/run/user/1000/krb5cc/tkt Default principal: marcusmeissner@FEDORAPROJECT.ORG Valid starting Expires Service principal 04/04/2020 16:47:36 04/05/2020 16:47:32 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG 04/04/2020 16:48:29 04/05/2020 16:47:32 HTTP/id.fedoraproject.org@FEDORAPROJECT.ORG $ So far no crashing firefox. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c15 --- Comment #15 from Marcus Meissner --- I am still going down the rabbit hole with printf debugging. Still think it is the firefox sandbox blocking something at some level of the code. :/ -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Firefox crashes if you try |openssl drbgtest exit |to authenticate using |problems: (Was: Firefox |Kerberos |crashes if you try to | |authenticate using | |Kerberos) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|meissner@suse.com |vcizek@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1167132 http://bugzilla.suse.com/show_bug.cgi?id=1167132#c17 Vítězslav Čížek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS CC| |vcizek@suse.com --- Comment #17 from Vítězslav Čížek --- Thanks for the debugging and the patch. We could also just disable the fork test. Our DRBG selftest is already quite extensive anyway. test_rand_drbg_reseed (which calls test_drbg_reseed_after_fork) is disabled in SP2, as it required entropy and caused problems during boot (bug 1165274). I must have forgotten to sync the patches. -- You are receiving this mail because: You are on the CC list for the bug.