5bcc82
diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
5bcc82
--- libgcrypt-1.8.3/src/global.c.fips-ctor	2017-11-23 19:25:58.000000000 +0100
5bcc82
+++ libgcrypt-1.8.3/src/global.c	2020-04-17 16:29:59.258218015 +0200
5bcc82
@@ -141,6 +141,34 @@ global_init (void)
5bcc82
 }
5bcc82
 
5bcc82
 
5bcc82
+#ifndef FIPS_MODULE_PATH
5bcc82
+#define FIPS_MODULE_PATH "/etc/system-fips"
5bcc82
+#endif
5bcc82
+
5bcc82
+void __attribute__ ((constructor)) _gcry_global_constructor (void)
5bcc82
+{
5bcc82
+  int rv;
5bcc82
+
5bcc82
+  rv = access (FIPS_MODULE_PATH, F_OK);
5bcc82
+  if (rv < 0 && errno != ENOENT)
5bcc82
+    rv = 0;
5bcc82
+
5bcc82
+  if (!rv)
5bcc82
+    {
5bcc82
+      int no_secmem_save;
5bcc82
+
5bcc82
+      /* it should be always 0 at this point but let's keep on the safe side */
5bcc82
+      no_secmem_save = no_secure_memory;
5bcc82
+      no_secure_memory = 1;
5bcc82
+      /* force selftests */
5bcc82
+      global_init();
5bcc82
+      _gcry_fips_run_selftests (0);
5bcc82
+      if (!fips_mode())
5bcc82
+         _gcry_random_close_fds ();
5bcc82
+      no_secure_memory = no_secmem_save;
5bcc82
+    }
5bcc82
+}
5bcc82
+
5bcc82
 /* This function is called by the macro fips_is_operational and makes
5bcc82
    sure that the minimal initialization has been done.  This is far
5bcc82
    from a perfect solution and hides problems with an improper
5bcc82
@@ -671,8 +699,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
5bcc82
 
5bcc82
     case GCRYCTL_FIPS_MODE_P:
5bcc82
       if (fips_mode ()
5bcc82
-          && !_gcry_is_fips_mode_inactive ()
5bcc82
-          && !no_secure_memory)
5bcc82
+          && !_gcry_is_fips_mode_inactive ())
5bcc82
 	rc = GPG_ERR_GENERAL; /* Used as TRUE value */
5bcc82
       break;
5bcc82
 
5bcc82
@@ -749,9 +776,9 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
5bcc82
       break;
5bcc82
 
5bcc82
     case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
5bcc82
-      if (!any_init_done)
5bcc82
+      if (fips_mode ())
5bcc82
         {
5bcc82
-          /* Not yet initialized at all.  Set the enforced fips mode flag */
5bcc82
+          /* We are in FIPS mode, we can set the enforced fips mode flag. */
5bcc82
           _gcry_set_preferred_rng_type (0);
5bcc82
           _gcry_set_enforced_fips_mode ();
5bcc82
         }