| 1 | =================
|
| 2 | /proc/sys/crypto/
|
| 3 | =================
|
| 4 |
|
| 5 | These files show up in ``/proc/sys/crypto/``, depending on the
|
| 6 | kernel configuration:
|
| 7 |
|
| 8 | .. contents:: :local:
|
| 9 |
|
| 10 | .. _af_alg_restrict:
|
| 11 |
|
| 12 | af_alg_restrict
|
| 13 | ===============
|
| 14 |
|
| 15 | Controls the level of restriction of AF_ALG.
|
| 16 |
|
| 17 | AF_ALG is a deprecated and rarely-used userspace interface that is a
|
| 18 | frequent source of vulnerabilities. It also unnecessarily exposes a
|
| 19 | large number of kernel implementation details. For more information
|
| 20 | about AF_ALG, see :ref:`Documentation/crypto/userspace-if.rst
|
| 21 | <crypto_userspace_interface>`.
|
| 22 |
|
| 23 | Starting in Linux v7.3, AF_ALG supports only a limited set of
|
| 24 | algorithms by default. This sysctl allows the system administrator to
|
| 25 | remove this restriction when needed for compatibility reasons, or to
|
| 26 | go further and disable AF_ALG entirely. The default value is 1.
|
| 27 |
|
| 28 | === ==================================================================
|
| 29 | 0 AF_ALG is unrestricted.
|
| 30 |
|
| 31 | 1 AF_ALG is supported with a limited list of algorithms. The list
|
| 32 | is designed for compatibility with known users such as iwd and
|
| 33 | bluez that haven't yet been fixed to use userspace crypto code.
|
| 34 |
|
| 35 | Specifically, there is an allowlist for unprivileged processes
|
| 36 | and a somewhat longer allowlist for processes that hold
|
| 37 | CAP_SYS_ADMIN or CAP_NET_ADMIN in the initial user namespace.
|
| 38 |
|
| 39 | Attempts to bind() an AF_ALG socket with a disallowed algorithm
|
| 40 | fail with ENOENT.
|
| 41 |
|
| 42 | 2 AF_ALG is completely disabled. Attempts to create an AF_ALG
|
| 43 | socket fail with EAFNOSUPPORT.
|
| 44 | === ==================================================================
|
| 45 |
|
| 46 | fips_enabled
|
| 47 | ============
|
| 48 |
|
| 49 | Read-only flag that indicates whether FIPS mode is enabled.
|
| 50 |
|
| 51 | - ``0``: FIPS mode is disabled (default).
|
| 52 | - ``1``: FIPS mode is enabled.
|
| 53 |
|
| 54 | This value is set at boot time via the ``fips=1`` kernel command line
|
| 55 | parameter. When enabled, the cryptographic API will restrict the use
|
| 56 | of certain algorithms and perform self-tests to ensure compliance with
|
| 57 | FIPS (Federal Information Processing Standards) requirements, such as
|
| 58 | FIPS 140-2 and the newer FIPS 140-3, depending on the kernel
|
| 59 | configuration and the module in use.
|
| 60 |
|
| 61 | fips_name
|
| 62 | =========
|
| 63 |
|
| 64 | Read-only file that contains the name of the FIPS module currently in use.
|
| 65 | The value is typically configured via the ``CONFIG_CRYPTO_FIPS_NAME``
|
| 66 | kernel configuration option.
|
| 67 |
|
| 68 | fips_version
|
| 69 | ============
|
| 70 |
|
| 71 | Read-only file that contains the version string of the FIPS module.
|
| 72 | If ``CONFIG_CRYPTO_FIPS_CUSTOM_VERSION`` is set, it uses the value from
|
| 73 | ``CONFIG_CRYPTO_FIPS_VERSION``. Otherwise, it defaults to the kernel
|
| 74 | release version (``UTS_RELEASE``).
|
| 75 |
|
| 76 | Copyright (c) 2026, Shubham Chakraborty <[email protected]>
|
| 77 |
|
| 78 | For general info and legal blurb, please look in
|
| 79 | Documentation/admin-guide/sysctl/index.rst.
|
| 80 |
|
| 81 | |
| 82 | |
| 83 | |