1================= 2/proc/sys/crypto/ 3================= 4 5These files show up in ``/proc/sys/crypto/``, depending on the 6kernel configuration: 7 8.. contents:: :local: 9 10.. _af_alg_restrict: 11 12af_alg_restrict 13=============== 14 15Controls the level of restriction of AF_ALG. 16 17AF_ALG is a deprecated and rarely-used userspace interface that is a 18frequent source of vulnerabilities. It also unnecessarily exposes a 19large number of kernel implementation details. For more information 20about AF_ALG, see :ref:`Documentation/crypto/userspace-if.rst 21<crypto_userspace_interface>`. 22 23Starting in Linux v7.3, AF_ALG supports only a limited set of 24algorithms by default. This sysctl allows the system administrator to 25remove this restriction when needed for compatibility reasons, or to 26go further and disable AF_ALG entirely. The default value is 1. 27 28=== ================================================================== 290 AF_ALG is unrestricted. 30 311 AF_ALG is supported with a limited list of algorithms. The list 32 is designed for compatibility with known users such as iwd and 33 bluez that haven't yet been fixed to use userspace crypto code. 34 35 Specifically, there is an allowlist for unprivileged processes 36 and a somewhat longer allowlist for processes that hold 37 CAP_SYS_ADMIN or CAP_NET_ADMIN in the initial user namespace. 38 39 Attempts to bind() an AF_ALG socket with a disallowed algorithm 40 fail with ENOENT. 41 422 AF_ALG is completely disabled. Attempts to create an AF_ALG 43 socket fail with EAFNOSUPPORT. 44=== ================================================================== 45 46fips_enabled 47============ 48 49Read-only flag that indicates whether FIPS mode is enabled. 50 51- ``0``: FIPS mode is disabled (default). 52- ``1``: FIPS mode is enabled. 53 54This value is set at boot time via the ``fips=1`` kernel command line 55parameter. When enabled, the cryptographic API will restrict the use 56of certain algorithms and perform self-tests to ensure compliance with 57FIPS (Federal Information Processing Standards) requirements, such as 58FIPS 140-2 and the newer FIPS 140-3, depending on the kernel 59configuration and the module in use. 60 61fips_name 62========= 63 64Read-only file that contains the name of the FIPS module currently in use. 65The value is typically configured via the ``CONFIG_CRYPTO_FIPS_NAME`` 66kernel configuration option. 67 68fips_version 69============ 70 71Read-only file that contains the version string of the FIPS module. 72If ``CONFIG_CRYPTO_FIPS_CUSTOM_VERSION`` is set, it uses the value from 73``CONFIG_CRYPTO_FIPS_VERSION``. Otherwise, it defaults to the kernel 74release version (``UTS_RELEASE``). 75 76Copyright (c) 2026, Shubham Chakraborty <chakrabortyshubham66@gmail.com> 77 78For general info and legal blurb, please look in 79Documentation/admin-guide/sysctl/index.rst. 80 81.. See scripts/check-sysctl-docs to keep this up to date: 82.. scripts/check-sysctl-docs -vtable="crypto" \ 83.. $(git grep -l register_sysctl_) 84