f268f1
diff -up libgcrypt-1.5.3/cipher/md.c.fips-ctor libgcrypt-1.5.3/cipher/md.c
f268f1
--- libgcrypt-1.5.3/cipher/md.c.fips-ctor	2013-07-25 11:10:03.000000000 +0200
f268f1
+++ libgcrypt-1.5.3/cipher/md.c	2014-12-12 15:32:35.464515238 +0100
f268f1
@@ -570,11 +570,8 @@ md_enable (gcry_md_hd_t hd, int algorith
f268f1
 
f268f1
   if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
f268f1
     {
f268f1
-      _gcry_inactivate_fips_mode ("MD5 used");
f268f1
       if (_gcry_enforced_fips_mode () )
f268f1
         {
f268f1
-          /* We should never get to here because we do not register
f268f1
-             MD5 in enforced fips mode. But better throw an error.  */
f268f1
           err = GPG_ERR_DIGEST_ALGO;
f268f1
         }
f268f1
     }
f268f1
diff -up libgcrypt-1.5.3/src/global.c.fips-ctor libgcrypt-1.5.3/src/global.c
f268f1
--- libgcrypt-1.5.3/src/global.c.fips-ctor	2014-12-12 15:32:35.463515215 +0100
f268f1
+++ libgcrypt-1.5.3/src/global.c	2014-12-12 16:46:33.424883301 +0100
f268f1
@@ -140,6 +140,34 @@ global_init (void)
f268f1
 }
f268f1
 
f268f1
 
f268f1
+#ifndef FIPS_MODULE_PATH
f268f1
+#define FIPS_MODULE_PATH "/etc/system-fips"
f268f1
+#endif
f268f1
+
f268f1
+void __attribute__ ((constructor)) _gcry_global_constructor (void)
f268f1
+{
f268f1
+  int rv;
f268f1
+
f268f1
+  rv = access (FIPS_MODULE_PATH, F_OK);
f268f1
+  if (rv < 0 && errno != ENOENT)
f268f1
+    rv = 0;
f268f1
+
f268f1
+  if (!rv)
f268f1
+    {
f268f1
+      int no_secmem_save;
f268f1
+
f268f1
+      /* it should be always 0 at this point but let's keep on the safe side */
f268f1
+      no_secmem_save = no_secure_memory;
f268f1
+      no_secure_memory = 1;
f268f1
+      /* force selftests */
f268f1
+      global_init ();
f268f1
+      if (fips_mode ())
f268f1
+         _gcry_random_initialize (1);
f268f1
+      _gcry_fips_run_selftests (0);
f268f1
+      no_secure_memory = no_secmem_save;
f268f1
+    }
f268f1
+}
f268f1
+
f268f1
 /* This function is called by the macro fips_is_operational and makes
f268f1
    sure that the minimal initialization has been done.  This is far
f268f1
    from a perfect solution and hides problems with an improper
f268f1
@@ -500,8 +528,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
f268f1
 
f268f1
     case GCRYCTL_FIPS_MODE_P:
f268f1
       if (fips_mode ()
f268f1
-          && !_gcry_is_fips_mode_inactive ()
f268f1
-          && !no_secure_memory)
f268f1
+          && !_gcry_is_fips_mode_inactive ())
f268f1
 	err = GPG_ERR_GENERAL; /* Used as TRUE value */
f268f1
       break;
f268f1
 
f268f1
@@ -600,7 +627,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
f268f1
       break;
f268f1
 
f268f1
     case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
f268f1
-      if (!any_init_done)
f268f1
+      if (fips_mode ())
f268f1
         {
f268f1
           /* Not yet intialized at all.  Set the enforced fips mode flag */
f268f1
           _gcry_set_enforced_fips_mode ();