Plasmashell FIPS Violation

Hi!

I took a look in the KSystemlog today. To my surprise every second a new alert appears:

[W]==> csdk_fips_violation_cb:88> SHA-1 algorithm is not FIPS-approved, this WILL fail when FIPS is ON!

I have no idea what to do. Google didn’t find anything useful.

I hope that someone can help.

EDIT:
Citrix Workspace (“mobiler Standardclient”) seems to be the reason. When I close Citrix the alerts in the log stop immediatly.
But I still don’t know what the message tries to say to me or how to solve this.

Thanx,
JimTom

Here is my INXI-output:

System:
  Kernel: 6.1.31-2-MANJARO arch: x86_64 bits: 64 compiler: gcc v: 13.1.1
    parameters: BOOT_IMAGE=/boot/vmlinuz-6.1-x86_64
    root=UUID=e9bd9615-4b23-4ecb-a8af-4d1e69968a61 rw quiet splash
    resume=UUID=af4460d3-b0d6-4d87-9b2a-367682229788 udev.log_priority=3
  Desktop: KDE Plasma v: 5.27.5 tk: Qt v: 5.15.9 wm: kwin_x11 vt: 1 dm: SDDM
    Distro: Manjaro Linux base: Arch Linux
Machine:
  Type: Desktop System: Gigabyte product: H67A-UD3H-B3 v: N/A
    serial: <superuser required> Chassis: type: 3 serial: <superuser required>
  Mobo: Gigabyte model: H67A-UD3H-B3 serial: <superuser required> BIOS: Award
    v: F8 date: 03/27/2012
Battery:
  Device-1: hidpp_battery_0 model: Logitech Wireless Mouse MX Master 3
    serial: <filter> charge: 100% (should be ignored) rechargeable: yes
    status: discharging
CPU:
  Info: model: Intel Core i7-2600K bits: 64 type: MT MCP arch: Sandy Bridge
    gen: core 2 level: v2 built: 2010-12 process: Intel 32nm family: 6
    model-id: 0x2A (42) stepping: 7 microcode: 0x2F
  Topology: cpus: 1x cores: 4 tpc: 2 threads: 8 smt: enabled cache:
    L1: 256 KiB desc: d-4x32 KiB; i-4x32 KiB L2: 1024 KiB desc: 4x256 KiB
    L3: 8 MiB desc: 1x8 MiB
  Speed (MHz): avg: 1998 high: 3087 min/max: 1600/3800 scaling:
    driver: intel_cpufreq governor: schedutil cores: 1: 1596 2: 2841 3: 1596
    4: 1978 5: 1651 6: 3087 7: 1643 8: 1597 bogomips: 54295
  Flags: avx ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
  Vulnerabilities:
  Type: itlb_multihit status: KVM: VMX disabled
  Type: l1tf mitigation: PTE Inversion; VMX: conditional cache flushes, SMT
    vulnerable
  Type: mds mitigation: Clear CPU buffers; SMT vulnerable
  Type: meltdown mitigation: PTI
  Type: mmio_stale_data status: Unknown: No mitigations
  Type: retbleed status: Not affected
  Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via
    prctl
  Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer
    sanitization
  Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, IBRS_FW,
    STIBP: conditional, RSB filling, PBRSB-eIBRS: Not affected
  Type: srbds status: Not affected
  Type: tsx_async_abort status: Not affected
Graphics:
  Device-1: AMD Lexa PRO [Radeon 540/540X/550/550X / RX 540X/550/550X]
    vendor: Sapphire driver: amdgpu v: kernel arch: GCN-4 code: Arctic Islands
    process: GF 14nm built: 2016-20 pcie: gen: 2 speed: 5 GT/s lanes: 8
    link-max: gen: 3 speed: 8 GT/s ports: active: DP-1 empty: DVI-D-1,HDMI-A-1
    bus-ID: 01:00.0 chip-ID: 1002:699f class-ID: 0300 temp: 45.0 C
  Display: x11 server: X.Org v: 21.1.8 compositor: kwin_x11 driver: X:
    loaded: amdgpu unloaded: modesetting alternate: fbdev,vesa dri: radeonsi
    gpu: amdgpu display-ID: :0 screens: 1
  Screen-1: 0 s-res: 3440x1440 s-dpi: 96 s-size: 910x381mm (35.83x15.00")
    s-diag: 987mm (38.84")
  Monitor-1: DP-1 mapped: DisplayPort-0 model: Mi Monitor built: 2020
    res: 3440x1440 dpi: 110 gamma: 1.2 size: 797x334mm (31.38x13.15")
    diag: 864mm (34") modes: max: 3440x1440 min: 720x400
  API: OpenGL v: 4.6 Mesa 23.0.4 renderer: AMD Radeon RX 550 / 550 Series
    (polaris12 LLVM 15.0.7 DRM 3.49 6.1.31-2-MANJARO) direct-render: Yes
Audio:
  Device-1: Intel 6 Series/C200 Series Family High Definition Audio
    vendor: Gigabyte 6 driver: snd_hda_intel v: kernel bus-ID: 00:1b.0
    chip-ID: 8086:1c20 class-ID: 0403
  Device-2: AMD Baffin HDMI/DP Audio [Radeon RX 550 640SP / 560/560X]
    vendor: Sapphire driver: snd_hda_intel v: kernel pcie: gen: 2 speed: 5 GT/s
    lanes: 8 link-max: gen: 3 speed: 8 GT/s bus-ID: 01:00.1 chip-ID: 1002:aae0
    class-ID: 0403
  API: ALSA v: k6.1.31-2-MANJARO status: kernel-api with: aoss
    type: oss-emulator tools: alsactl,alsamixer,amixer
  Server-1: JACK v: 1.9.22 status: off tools: N/A
  Server-2: PipeWire v: 0.3.70 status: active with: 1: pipewire-pulse
    status: active 2: pipewire-media-session status: active 3: pipewire-alsa
    type: plugin tools: pactl,pw-cat,pw-cli
Network:
  Device-1: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet
    vendor: Gigabyte driver: r8168 v: 8.050.03-NAPI modules: r8169 pcie: gen: 1
    speed: 2.5 GT/s lanes: 1 port: de00 bus-ID: 03:00.0 chip-ID: 10ec:8168
    class-ID: 0200
  IF: enp3s0 state: up speed: 1000 Mbps duplex: full mac: <filter>
Drives:
  Local Storage: total: 931.51 GiB used: 425.54 GiB (45.7%)
  SMART Message: Unable to run smartctl. Root privileges required.
  ID-1: /dev/sda maj-min: 8:0 vendor: Samsung model: SSD 870 QVO 1TB
    size: 931.51 GiB block-size: physical: 512 B logical: 512 B speed: 6.0 Gb/s
    tech: SSD serial: <filter> fw-rev: 2B6Q scheme: MBR
Partition:
  ID-1: / raw-size: 913.51 GiB size: 898.1 GiB (98.31%)
    used: 425.53 GiB (47.4%) fs: ext4 dev: /dev/sda1 maj-min: 8:1
Swap:
  Kernel: swappiness: 2 (default 60) cache-pressure: 100 (default)
  ID-1: swap-1 type: partition size: 18 GiB used: 3.8 MiB (0.0%) priority: -2
    dev: /dev/sda2 maj-min: 8:2
Sensors:
  System Temperatures: cpu: 44.0 C mobo: 33.0 C gpu: amdgpu temp: 45.0 C
  Fan Speeds (RPM): cpu: 790 fan-1: 665 fan-3: 0 fan-4: 0 gpu: amdgpu
    fan: 1291
  Power: 12v: N/A 5v: N/A 3.3v: 3.38 vbat: 3.14 gpu: amdgpu watts: 8.11
Info:
  Processes: 323 Uptime: 1h 15m wakeups: 8 Memory: available: 11.67 GiB
  used: 6.17 GiB (52.9%) Init: systemd v: 253 default: graphical
  tool: systemctl Compilers: gcc: 13.1.1 clang: 15.0.7 Packages: 1584
  pm: pacman pkgs: 1554 libs: 386 tools: pamac,yay pm: flatpak pkgs: 27
  pm: snap pkgs: 3 Shell: Zsh v: 5.9 default: Bash v: 5.1.16
  running-in: konsole inxi: 3.3.27

Not much to do about an information message.

I don’t know what you searched, but try to search “SHA-1 algorithm is not FIPS-approved, this WILL fail when FIPS is ON!”, you will get results. Anyway this is not a Plasmashell issue. From what I understand, as message says, you should not use SHA-1 somewhere in your configuration of the application you use.

1 Like

Thank you for your answer.
I will try to configure Citrix, but there is not very much to configure. At least I haven’t found it until now.

JimTom

I don’t know anything relating to citrix, or something - anything - with that, or about it, but the very first result when I Google that error:

I installed icaclient_22.7.0.20_amd64.deb on Debian 11, and encountered the same message when I tried to add my company “store”, which certificate is accepted, I assume.

sudo /opt/Citrix/ICAClient/util/storebrowse --addstore https://uap.dhl.com
FIPS violation detected at crypto/evp/digest.c:219, reason: SHA-1 hash algorithm is not allowed in FIPS mode.
Error adding store:AM_ERROR_HTTP_SERVER_CERTIFICATE_NOT_TRUSTED[65150]

SOLVED FOR ME

- Omitted `storebrowse --addstore`

- Started `/opt/Citrix/ICAClient/selfservice --icaroot /opt/Citrix/ICAClient` and ignored window
- Opened Firefox at store URL 

I don’t know what it means, but maybe it helps you.


And yes, this isn’t related to Manjaro in any way at all.