configs: enable CONFIG_CRYPTO_CTS=y so cts(cbc(aes)) is available in FIPS mode

Vladis Dronovrequested to merge
(removed):mf-os-build into os-build

Currently the CTS algo is built as a module. This is a problem if any ciphers using CTS are marked as FIPS-enabled and the system is booted in FIPS mode, as dracut does not include cts.ko in the initramfs. This change is necessary for NFS with sec=krb5{,i,p} to work in FIPS mode. Otherwise, the following panic would result:

[ 8.462065] alg: skcipher: Failed to load transform for cts(cbc(aes)): -2 [ 8.463705] Kernel panic - not syncing: cts(cbc(aes)): cts(cbc(aes)) alg self test failed in fips mode!

Fix this by embedding the CTS code into a kernel, the same way as Fedora already does. This was tested by a reproducer in bz1855161 #c24, #c28.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1855161 Signed-off-by: Vladis Dronov vdronov@redhat.com

Merge request reports