diff --git a/lib/pk11wrap/pk11pars.c b/lib/pk11wrap/pk11pars.c

--- a/lib/pk11wrap/pk11pars.c

+++ b/lib/pk11wrap/pk11pars.c

@@ -159,16 +159,20 @@ SECMOD_CreateModuleEx(const char *librar

     if (parameters) {

 	mod->libraryParams = PORT_ArenaStrdup(mod->arena,parameters);

     }

     if (config) {

 	/* XXX: Apply configuration */

     }

     mod->internal   = NSSUTIL_ArgHasFlag("flags","internal",nssc);

     mod->isFIPS     = NSSUTIL_ArgHasFlag("flags","FIPS",nssc);

+    /* if the system FIPS mode is enabled, force FIPS to be on */

+    if (SECMOD_GetSystemFIPSEnabled()) {

+	mod->isFIPS = PR_TRUE;

+    }

     mod->isCritical = NSSUTIL_ArgHasFlag("flags","critical",nssc);

     slotParams      = NSSUTIL_ArgGetParamValue("slotParams",nssc);

     mod->slotInfo   = NSSUTIL_ArgParseSlotInfo(mod->arena,slotParams,

 							&mod->slotInfoCount);

     if (slotParams) PORT_Free(slotParams);

     /* new field */

     mod->trustOrder  = NSSUTIL_ArgReadLong("trustOrder",nssc,

 					NSSUTIL_DEFAULT_TRUST_ORDER,NULL);

diff --git a/lib/pk11wrap/pk11util.c b/lib/pk11wrap/pk11util.c

--- a/lib/pk11wrap/pk11util.c

+++ b/lib/pk11wrap/pk11util.c

@@ -90,16 +90,35 @@ SECMOD_Shutdown()

 #endif

     if (secmod_PrivateModuleCount) {

     	PORT_SetError(SEC_ERROR_BUSY);

 	return SECFailure;

     }

     return SECSuccess;

 }

+int SECMOD_GetSystemFIPSEnabled(void) {

+#ifdef LINUX

+    FILE *f;

+    char d;

+    size_t size;

+

+    f = fopen("/proc/sys/crypto/fips_enabled", "r");

+    if (!f)

+        return 0;

+

+    size = fread(&d, 1, 1, f);

+    fclose(f);

+    if (size != 1)

+        return 0;

+    if (d == '1')

+        return 1;

+#endif

+    return 0;

+}

 /*

  * retrieve the internal module

  */

 SECMODModule *

 SECMOD_GetInternalModule(void)

 {

    return internalModule;

@@ -412,17 +431,17 @@ SECMOD_DeleteModule(const char *name, in

  */

 SECStatus

 SECMOD_DeleteInternalModule(const char *name) 

 {

     SECMODModuleList *mlp;

     SECMODModuleList **mlpp;

     SECStatus rv = SECFailure;

-    if (pendingModule) {

+    if (SECMOD_GetSystemFIPSEnabled() || pendingModule) {

 	PORT_SetError(SEC_ERROR_MODULE_STUCK);

 	return rv;

     }

     if (!moduleLock) {

     	PORT_SetError(SEC_ERROR_NOT_INITIALIZED);

 	return rv;

     }

@@ -883,17 +902,17 @@ SECMOD_DestroyModuleList(SECMODModuleLis

     SECMODModuleList *lp;

     for ( lp = list; lp != NULL; lp = SECMOD_DestroyModuleListElement(lp)) ;

 }

 PRBool

 SECMOD_CanDeleteInternalModule(void)

 {

-    return (PRBool) (pendingModule == NULL);

+    return (PRBool) ((pendingModule == NULL) && !SECMOD_GetSystemFIPSEnabled());

 }

 /*

  * check to see if the module has added new slots. PKCS 11 v2.20 allows for

  * modules to add new slots, but never remove them. Slots cannot be added 

  * between a call to C_GetSlotLlist(Flag, NULL, &count) and the subsequent

  * C_GetSlotList(flag, &data, &count) so that the array doesn't accidently

  * grow on the caller. It is permissible for the slots to increase between

diff --git a/lib/pk11wrap/secmodi.h b/lib/pk11wrap/secmodi.h

--- a/lib/pk11wrap/secmodi.h

+++ b/lib/pk11wrap/secmodi.h

@@ -108,17 +108,22 @@ SECStatus PBE_PK11ParamToAlgid(SECOidTag

 PK11SymKey *pk11_TokenKeyGenWithFlagsAndKeyType(PK11SlotInfo *slot,

 	CK_MECHANISM_TYPE type, SECItem *param, CK_KEY_TYPE keyType, 

 	int keySize, SECItem *keyId, CK_FLAGS opFlags, 

 	PK11AttrFlags attrFlags, void *wincx);

 CK_MECHANISM_TYPE pk11_GetPBECryptoMechanism(SECAlgorithmID *algid,

                    SECItem **param, SECItem *pwd, PRBool faulty3DES);

-

+/* Get the state of the system FIPS mode */

+/* NSS uses this to force FIPS mode if the system bit is on. Applications which

+ * use the SECMOD_CanDeleteInteral() to check to see if they can switch to or

+ * from FIPS mode will automatically be told that they can't swith out of FIPS

+ * mode */

+int SECMOD_GetSystemFIPSEnabled();

 extern void pk11sdr_Init(void);

 extern void pk11sdr_Shutdown(void);

 /*

  * Private to pk11wrap.

  */