Merge ~ahasenack/ubuntu/+source/ubuntu-advantage-tools:v17-fips-updates into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Andreas Hasenack]

ubuntu-advantage-tools FIPS updates. These are not used in bionic, because fips is not supported in bionic yet, but are needed for an upcoming xenial SRU.

The bug this is fixing is a Feature Freeze Exception request, which was granted provided there are no new package relations introduced, which is correct.

PPA with bionic test packages: https://launchpad.net/~ahasenack/+archive/ubuntu/ua-tools-fips-updates-1759280

sudo add-apt-repository ppa:ahasenack/ua-tools-fips-updates-1759280

[Andreas Hasenack (ahasenack)]

I'll create matching commits for the entries in d/changelog, but there will be remaining commits that won't be mentioned there. d/changelog is not a git log after alll, and this LP branch is not a mirror of the upstream git repo.

[Andreas Hasenack (ahasenack)]

That is boiling down to a manual mirroring from github from the landed pull requests. The commits and individual pull requests can be seen in https://github.com/CanonicalLtd/ubuntu-advantage-script/commits/master and https://github.com/CanonicalLtd/ubuntu-advantage-script/pulls?q=is%3Apr+is%3Aclosed respectively. Please let me know if you need any other information or have other questions.

[Steve Langasek (vorlon)]

Reviewing with respect to archive and feature freeze only. Comments inline.

review: Approve

[Christian Ehrhardt  (paelzer)]

Some potential improvements inline, but could as well be on the next version being uploaded.
I'll set need info and leave it to you if you want to address now or later.

review: Needs Information

[Andreas Hasenack (ahasenack)]

Replied to commends from Steve and Christian inline. Thanks guys!

[Andreas Hasenack (ahasenack)]

Upstream issues opened.

[Christian Ehrhardt  (paelzer)]

All that was asked was explained and I agree to those you opened new bugs for.
As I said none of these has to be in this upload.

Approve +1

review: Approve

[Joy Latten (j-latten)]

We were not able to anticipate which fips modules a customer wants, so the enable-fips installs all the certified fips modules. Thus naturally assumed the update-fips should update all of them. Manual install instructions are published and provided for customers that prefer to "customize" their fips installations. See, https://assets.ubuntu.com/v1/f35fe02e-Canonical+FIPS+Installation+Instructions.pdf?utm_source=ubunteu&utm_medium=url_shortner&utm_term=fips-install&utm_campaign=shortner

Given that after initial installation, whether done manually or via enable-fips, a customer may have removed fips modules not desired or only installed those desired, the update-fips perhaps should loop thru and see which fips modules are installed, and only update those. In the special case of an update-fips being called where no fips modules have been installed, the script can just install all the updated fips modules similar to the enable-fips.

If that sounds good, then I can open an issue in github to do that.

In regards to fips updates, both potential and existing customers have indicated they would like "updated" fips modules, that is, they want fips modules with bugfixes and CVEs applied and is ok if these "updated" fips modules are not re-certified. They want the fips code paths and fips approved algorithms. For example, not all the fips approved algorithms are in the corresponding, regular version of ssl. We also found this is what several other major Linux distros do as well. So we are giving customers choice of strict fips compliance with fips certified modules from fips ppa and|or the ability to run in "fips mode" with CVEs+bugfixes on top of the fips-certified modules from fips-update ppa. We decided to include that warning or info message in update-fips to do just that, provide info and warn, just in case. Thus absolving us of any potential liability or misunderstanding. Hopefully, that all seems ok. We are learning as we go.

[Andreas Hasenack (ahasenack)]

Thanks Christian.

I need sponsoring for this package, if you could please push the upload tag and dput the package, thanks.

[Christian Ehrhardt  (paelzer)]

Tag push and sponsoring done as requested

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..34972a2
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+__pycache__
+.tox
diff --git a/debian/changelog b/debian/changelog
index bb95c3d..39ea084 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+ubuntu-advantage-tools (17) bionic; urgency=medium
+
+  * New upstream release (LP: #1759280):
+    - Added enable-fips-updates command. This command enables the fips-updates
+      repository to install updates to FIPS modules. The updated modules from
+      fips-updates repository are non-certified.
+    - Add repository pinning for FIPS packages
+    - Check that all prerequisite packages are installed when enabling FIPS
+    - Support returning the status for a single service
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 21 Mar 2018 14:20:04 -0300
+
 ubuntu-advantage-tools (16) bionic; urgency=medium
 
   * d/t/update-motd-run: fix path to the esm motd (LP: #1757490)
diff --git a/keyrings/ubuntu-fips-updates-keyring.gpg b/keyrings/ubuntu-fips-updates-keyring.gpg
new file mode 100644
index 0000000..d00f63f
Binary files /dev/null and b/keyrings/ubuntu-fips-updates-keyring.gpg differ
diff --git a/modules/apt.sh b/modules/apt.sh
index 8a9a2ab..3d73d12 100644
--- a/modules/apt.sh
+++ b/modules/apt.sh
@@ -35,19 +35,31 @@ apt_remove_repo() {
     _apt_remove_auth "$repo_url"
 }
 
+apt_add_repo_pinning() {
+    local repo_file="$1"
+    local origin="$2"
+    local priority="$3"
+
+    cat <<EOF >"$repo_file"
+Package: *
+Pin: release o=${origin}, n=${SERIES}
+Pin-Priority: ${priority}
+EOF
+}
+
 apt_get() {
     DEBIAN_FRONTEND=noninteractive \
                    apt-get -y -o Dpkg::Options::='--force-confold' "$@"
 }
 
-is_package_installed() {
+apt_is_package_installed() {
     local package="$1"
 
     dpkg-query -s "$package" >/dev/null 2>&1
 }
 
 # Install a package if the specified file doesn't exist
-install_package_if_missing_file() {
+apt_install_package_if_missing_file() {
     local file="$1"
     local package="$2"
 
diff --git a/modules/service-esm.sh b/modules/service-esm.sh
index 0bbfaa2..de281f8 100644
--- a/modules/service-esm.sh
+++ b/modules/service-esm.sh
@@ -14,8 +14,8 @@ esm_enable() {
     check_token "$ESM_REPO_URL" "$token"
     apt_add_repo "$ESM_REPO_LIST" "$ESM_REPO_URL" "$token" \
                  "${KEYRINGS_DIR}/${ESM_REPO_KEY_FILE}"
-    install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
-    install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
+    apt_install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
+    apt_install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
     echo -n 'Running apt-get update... '
     check_result apt_get update
     echo 'Ubuntu ESM repository enabled.'
diff --git a/modules/service-fips.sh b/modules/service-fips.sh
index 38c2c6d..4df3872 100644
--- a/modules/service-fips.sh
+++ b/modules/service-fips.sh
@@ -7,6 +7,11 @@ FIPS_SUPPORTED_ARCHS="x86_64 ppc64le s390x"
 FIPS_REPO_URL="https://private-ppa.launchpad.net/ubuntu-advantage/fips"
 FIPS_REPO_KEY_FILE="ubuntu-fips-keyring.gpg"
 FIPS_REPO_LIST=${FIPS_REPO_LIST:-"/etc/apt/sources.list.d/ubuntu-fips-${SERIES}.list"}
+FIPS_REPO_PREFERENCES=${FIPS_REPO_PREFERENCES:-"/etc/apt/preferences.d/ubuntu-fips-${SERIES}"}
+FIPS_UPDATES_REPO_URL="https://private-ppa.launchpad.net/ubuntu-advantage/fips-updates"
+FIPS_UPDATES_REPO_KEY_FILE="ubuntu-fips-updates-keyring.gpg"
+FIPS_UPDATES_REPO_LIST=${FIPS_UPDATES_REPO_LIST:-"/etc/apt/sources.list.d/ubuntu-fips-updates-${SERIES}.list"}
+FIPS_UPDATES_REPO_PREFERENCES=${FIPS_UPDATES_REPO_PREFERENCES:-"/etc/apt/preferences.d/ubuntu-fips-updates-${SERIES}"}
 FIPS_ENABLED_FILE=${FIPS_ENABLED_FILE:-"/proc/sys/crypto/fips_enabled"}
 if [ "$ARCH" = "s390x" ]; then
     FIPS_BOOT_CFG=${FIPS_BOOT_CFG:-"/etc/zipl.conf"}
@@ -15,28 +20,30 @@ else
     FIPS_BOOT_CFG=${FIPS_BOOT_CFG:-"${FIPS_BOOT_CFG_DIR}/99-fips.cfg"}
 fi
 FIPS_HMAC_PACKAGES="openssh-client-hmac openssh-server-hmac libssl1.0.0-hmac \
-        linux-fips strongswan-hmac"
+    linux-fips strongswan-hmac"
+FIPS_OTHER_PACKAGES="openssh-client openssh-server openssl libssl1.0.0 \
+    fips-initramfs strongswan"
 
 fips_enable() {
     local token="$1"
 
-    _fips_check_packages_installed || error_exit service_already_enabled
+    _fips_check_installed || error_exit service_already_enabled
 
     check_token "$FIPS_REPO_URL" "$token"
     apt_add_repo "$FIPS_REPO_LIST" "$FIPS_REPO_URL" "$token" \
                  "${KEYRINGS_DIR}/${FIPS_REPO_KEY_FILE}"
-    install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
-    install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
+    apt_add_repo_pinning "$FIPS_REPO_PREFERENCES" \
+                         LP-PPA-ubuntu-advantage-fips 1001
+    apt_install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
+    apt_install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
     echo -n 'Running apt-get update... '
     check_result apt_get update
     echo 'Ubuntu FIPS PPA repository enabled.'
 
     # install all the fips packages
     echo -n 'Installing FIPS packages (this may take a while)... '
-    check_result apt_get install openssh-client openssh-client-hmac \
-                 openssh-server openssh-server-hmac openssl libssl1.0.0 \
-                 libssl1.0.0-hmac fips-initramfs linux-fips \
-                 strongswan strongswan-hmac
+    # shellcheck disable=SC2086
+    check_result apt_get install $FIPS_HMAC_PACKAGES $FIPS_OTHER_PACKAGES
 
     echo "Configuring FIPS... "
     _fips_configure
@@ -47,8 +54,73 @@ fips_disable() {
     not_supported 'Disabling FIPS'
 }
 
+fips_updates_enable() {
+    local token="$1"
+    local bypass_prompt="$2"
+
+    local fips_configured=0
+    local fips_kernel_version=0
+    local result=0
+
+    _fips_updates_is_enabled || result=$?
+    if [ $result -eq 0 ]; then
+        error_msg "FIPS-UPDATES repository is already enabled."
+        error_exit service_already_enabled
+    fi
+
+    check_token "$FIPS_UPDATES_REPO_URL" "$token"
+
+    echo "Installing updates from FIPS-UPDATES repository will take the system out of FIPS compliance."
+    if [ "$bypass_prompt" -ne 1 ]; then
+        if ! prompt_user 'Do you want to proceed?'; then
+            error_msg "Aborting updating FIPS packages..."
+            return
+        fi
+    fi
+
+    # add the fips-updates repo if the system is undergoing updates the first time
+    if [ ! -f "$FIPS_UPDATES_REPO_LIST" ]; then
+        apt_add_repo "$FIPS_UPDATES_REPO_LIST" "$FIPS_UPDATES_REPO_URL" "$token" \
+                 "${KEYRINGS_DIR}/${FIPS_UPDATES_REPO_KEY_FILE}"
+        apt_add_repo_pinning "$FIPS_UPDATES_REPO_PREFERENCES" \
+                         LP-PPA-ubuntu-advantage-fips-updates 1001
+        apt_install_package_if_missing_file "$APT_METHOD_HTTPS" apt-transport-https
+        apt_install_package_if_missing_file "$CA_CERTIFICATES" ca-certificates
+        echo -n 'Running apt-get update... '
+        check_result apt_get update
+        echo 'Ubuntu FIPS-UPDATES PPA repository enabled.'
+    fi
+
+    # if a fips package is found on the system, assume fips was configured before
+    # users could be running with fips=0 or fips=1, so just checking package here
+    if apt_is_package_installed fips-initramfs; then
+       fips_configured=1
+       # get the fips kernel version installed here
+       fips_kernel_version=$(package_version linux-fips)
+    fi
+
+    # update all the fips packages
+    echo -n 'Updating FIPS packages (this may take a while)... '
+    # shellcheck disable=SC2086
+    check_result apt_get install $FIPS_HMAC_PACKAGES $FIPS_OTHER_PACKAGES
+
+    # if fips was never configured before and is enabled for the
+    # first time, configure fips
+    if [ "$fips_configured" -eq 0 ]; then
+        echo "Configuring FIPS... "
+        _fips_configure
+    fi
+    echo "Successfully updated FIPS packages."
+
+    # show the message to reboot only if fips kernel has undergone an upgrade or fips is
+    # being configured the first time
+    if [ "$fips_kernel_version" != "$(package_version linux-fips)" ] || [ "$fips_configured" -eq 0 ]; then
+        echo "Please reboot into the new FIPS kernel."
+    fi
+}
+
 fips_is_enabled() {
-    is_package_installed fips-initramfs && [ "$(_fips_enabled_check)" -eq 1 ]
+    apt_is_package_installed fips-initramfs && [ "$(_fips_enabled_check)" -eq 1 ]
 }
 
 fips_validate_token() {
@@ -80,6 +152,21 @@ fips_check_support() {
     esac
 }
 
+fips_print_status() {
+    local result=0
+
+    _fips_updates_is_enabled || result=$?
+    if [ $result -eq 0 ]; then
+        echo "fips-updates (uncertified): enabled"
+    else
+        echo "fips-updates (uncertified): disabled"
+    fi
+}
+
+_fips_updates_is_enabled() {
+    apt-cache policy | grep -Fq "$FIPS_UPDATES_REPO_URL"
+}
+
 _fips_configure() {
     local bootdev fips_params result
 
@@ -118,16 +205,22 @@ _fips_enabled_check() {
     echo 0
 }
 
+_fips_check_installed() {
+    if ! _fips_check_packages_installed; then
+        return
+    fi
+
+    if fips_is_enabled; then
+        error_msg "FIPS is already enabled."
+    else
+        error_msg "FIPS is already installed. Please reboot into the FIPS kernel to enable it."
+    fi
+    return 1
+}
+
 _fips_check_packages_installed() {
     local pkg
     for pkg in $FIPS_HMAC_PACKAGES; do
-        if is_package_installed "$pkg"; then
-            if fips_is_enabled; then
-                error_msg "FIPS is already enabled."
-            else
-                error_msg "FIPS is already installed. Please reboot into the FIPS kernel to enable it."
-            fi
-            return 1
-        fi
+        apt_is_package_installed "$pkg" || return 1
     done
 }
diff --git a/modules/service-livepatch.sh b/modules/service-livepatch.sh
index 7b3a5ad..0e35020 100644
--- a/modules/service-livepatch.sh
+++ b/modules/service-livepatch.sh
@@ -81,7 +81,7 @@ _livepatch_validate_token() {
 }
 
 _livepatch_install_prereqs() {
-    install_package_if_missing_file "$SNAPD" snapd
+    apt_install_package_if_missing_file "$SNAPD" snapd
     if ! snap list canonical-livepatch >/dev/null 2>&1; then
         echo 'Installing the canonical-livepatch snap.'
         echo 'This may take a few minutes depending on your bandwidth.'
diff --git a/modules/service.sh b/modules/service.sh
index 1ac3243..26dc63e 100644
--- a/modules/service.sh
+++ b/modules/service.sh
@@ -12,8 +12,8 @@ service_enable() {
     local service="$1"
     local token="$2"
 
-    _service_check_user
-    _service_check_support "$service"
+    service_check_user
+    service_check_support "$service"
     _service_check_enabled "$service" || error_exit service_already_enabled
     "${service}_validate_token" "$token" || error_exit invalid_token
     "${service}_enable" "$token"
@@ -22,8 +22,8 @@ service_enable() {
 service_disable() {
     local service="$1"
 
-    _service_check_user
-    _service_check_support "$service"
+    service_check_user
+    service_check_support "$service"
     _service_check_disabled "$service" || error_exit service_already_disabled
     shift 1
    "${service}_disable" "$@"
@@ -58,14 +58,14 @@ service_print_status() {
     fi
 }
 
-_service_check_user() {
+service_check_user() {
     if [ "$(id -u)" -ne 0 ]; then
         error_msg "This command must be run as root (try using sudo)"
         error_exit not_root
     fi
 }
 
-_service_check_support() {
+service_check_support() {
     local service="$1"
 
     check_series_arch_supported "$service"
diff --git a/modules/utils.sh b/modules/utils.sh
index 1862fb4..5d13057 100644
--- a/modules/utils.sh
+++ b/modules/utils.sh
@@ -20,6 +20,26 @@ error_exit() {
     exit "${codes[$code]}"
 }
 
+# prompt the user to confirm
+#
+prompt_user() {
+    local answer
+
+    while true; do
+        read -r -p "$* [N/y] " answer 2>&1
+        case "$answer" in
+        y|Y)
+            return 0
+            ;;
+        ''|n|N)
+            return 1
+            ;;
+        *) echo "Please answer y or n."
+            ;;
+        esac
+    done
+}
+
 check_result() {
     local result output
     result=0
diff --git a/tests/test_esm.py b/tests/test_esm.py
index 04f73e9..acd0707 100644
--- a/tests/test_esm.py
+++ b/tests/test_esm.py
@@ -20,7 +20,7 @@ class ESMTest(UbuntuAdvantageTest):
         expected = (
             'deb https://esm.ubuntu.com/ubuntu precise main\n'
             '# deb-src https://esm.ubuntu.com/ubuntu precise main\n')
-        self.assertEqual(expected, self.repo_list.read_text())
+        self.assertEqual(expected, self.esm_repo_list.read_text())
         self.assertEqual(
             self.apt_auth_file.read_text(),
             'machine esm.ubuntu.com/ubuntu/ login user password pass\n')
@@ -198,7 +198,7 @@ class ESMTest(UbuntuAdvantageTest):
         process = self.script('disable-esm')
         self.assertEqual(0, process.returncode)
         self.assertIn('Ubuntu ESM repository disabled', process.stdout)
-        self.assertFalse(self.repo_list.exists())
+        self.assertFalse(self.esm_repo_list.exists())
         # the keyring file is removed
         keyring_file = self.trusted_gpg_dir / 'ubuntu-esm-keyring.gpg'
         self.assertFalse(keyring_file.exists())
diff --git a/tests/test_fips.py b/tests/test_fips.py
index 5efe325..433c0bf 100644
--- a/tests/test_fips.py
+++ b/tests/test_fips.py
@@ -23,7 +23,12 @@ class FIPSTest(UbuntuAdvantageTest):
             'fips/ubuntu xenial main\n'
             '# deb-src https://private-ppa.launchpad.net/'
             'ubuntu-advantage/fips/ubuntu xenial main\n')
-        self.assertEqual(expected, self.repo_list.read_text())
+        self.assertEqual(expected, self.fips_repo_list.read_text())
+        expected = (
+            'Package: *\n'
+            'Pin: release o=LP-PPA-ubuntu-advantage-fips, n=xenial\n'
+            'Pin-Priority: 1001\n')
+        self.assertEqual(self.fips_repo_preferences.read_text(), expected)
         self.assertEqual(
             self.apt_auth_file.read_text(),
             'machine private-ppa.launchpad.net/ubuntu-advantage/fips/ubuntu/'
@@ -67,6 +72,15 @@ class FIPSTest(UbuntuAdvantageTest):
             'Please reboot into the FIPS kernel to enable it.',
             process.stderr.strip())
 
+    def test_enable_fips_not_all_packages_installed(self):
+        # one of the packages is not installed
+        self.make_fake_binary(
+            'dpkg-query', command='[ $2 != openssh-client-hmac ]')
+        process = self.script('enable-fips', 'user:pass')
+        self.assertEqual(process.returncode, 0)
+        self.assertIn('Installing FIPS packages', process.stdout)
+        self.assertIn('Successfully configured FIPS', process.stdout)
+
     def test_enable_fips_writes_config(self):
         """The enable-fips option writes fips configuration."""
         self.script('enable-fips', 'user:pass')
@@ -249,3 +263,160 @@ class FIPSTest(UbuntuAdvantageTest):
         self.assertIn(
             'Canonical FIPS 140-2 Modules is not enabled',
             process.stderr)
+
+    def test_update_fips(self):
+        """The enable-fips-updates option enables FIPS-UPDATES repository."""
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(0, process.returncode)
+        self.assertIn('Ubuntu FIPS-UPDATES PPA repository enabled.',
+                      process.stdout)
+        expected = (
+            'deb https://private-ppa.launchpad.net/ubuntu-advantage/'
+            'fips-updates/ubuntu xenial main\n'
+            '# deb-src https://private-ppa.launchpad.net/'
+            'ubuntu-advantage/fips-updates/ubuntu xenial main\n')
+        self.assertEqual(expected, self.fips_updates_repo_list.read_text())
+        expected = (
+            'Package: *\n'
+            'Pin: release o=LP-PPA-ubuntu-advantage-fips-updates, n=xenial\n'
+            'Pin-Priority: 1001\n')
+        self.assertEqual(self.fips_updates_repo_preferences.read_text(),
+                         expected)
+        self.assertEqual(
+            self.apt_auth_file.read_text(),
+            'machine private-ppa.launchpad.net/ubuntu-advantage/'
+            'fips-updates/ubuntu/'
+            ' login user password pass\n')
+        self.assertEqual(self.apt_auth_file.stat().st_mode, 0o100600)
+        keyring_file = self.trusted_gpg_dir / 'ubuntu-fips-updates-keyring.gpg'
+        self.assertEqual('GPG key', keyring_file.read_text())
+        self.assertIn(
+            'Configuring FIPS...',
+            process.stdout)
+        self.assertIn(
+            'Successfully updated FIPS packages.\n'
+            'Please reboot into the new FIPS kernel',
+            process.stdout)
+
+    def test_update_fips_auth_if_other_entries(self):
+        """Existing auth.conf entries are preserved."""
+        auth = 'machine example.com login user password pass\n'
+        self.apt_auth_file.write_text(auth)
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(0, process.returncode)
+        self.assertIn(auth, self.apt_auth_file.read_text())
+
+    def test_update_fips_writes_config(self):
+        """The enable-fips-updates option writes fips configuration."""
+        self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(
+            'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT fips=1"',
+            self.boot_cfg.read_text().strip())
+
+    def test_update_fips_writes_config_with_boot_partition(self):
+        """The fips configuration includes the /boot partition."""
+        self.fstab.write_text('/dev/sda1 /boot ext2 defaults 0 1\n')
+        self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertIn('bootdev=/dev/sda1', self.boot_cfg.read_text())
+
+    def test_update_fips_writes_config_s390x_parameters(self):
+        """On S390x, FIPS parameters are appended to the config file."""
+        self.ARCH = 's390x'
+        self.boot_cfg.write_text('parameters=foo\n')
+        self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual('parameters=foo fips=1\n', self.boot_cfg.read_text())
+
+    def test_update_unsupported_on_i686(self):
+        """FIPS is unsupported on i686 arch."""
+        self.ARCH = 'i686'
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(7, process.returncode)
+        self.assertIn(
+            'Sorry, but Canonical FIPS 140-2 Modules is not supported on i686',
+            process.stderr)
+
+    def test_update_fips_missing_token(self):
+        """The token must be specified when using enable-fips-updates."""
+        process = self.script('enable-fips-updates')
+        self.assertEqual(3, process.returncode)
+        self.assertIn(
+            'Invalid token, it must be in the form "user:password"',
+            process.stderr)
+
+    def test_update_fips_invalid_token_format(self):
+        """The FIPS token must be specified as "user:password"."""
+        process = self.script('enable-fips-updates', 'foo-bar', '-y')
+        self.assertEqual(3, process.returncode)
+        self.assertIn(
+            'Invalid token, it must be in the form "user:password"',
+            process.stderr)
+
+    def test_update_fips_invalid_token(self):
+        """If token is invalid, an error is returned."""
+        message = (
+            'E: Failed to fetch https://esm.ubuntu.com/'
+            '  401  Unauthorized [IP: 1.2.3.4]')
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn('Invalid token', process.stderr)
+
+    def test_update_fips_invalid_token_trusty(self):
+        """Invalid token error is caught with apt-helper in trusty."""
+        message = 'E: Failed to fetch https://esm.ubuntu.com/  HttpError401'
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn('Invalid token', process.stderr)
+
+    def test_update_fips_error_checking_token(self):
+        """If token check fails, an error is returned."""
+        message = (
+            'E: Failed to fetch https://esm.ubuntu.com/'
+            '  404  Not Found [IP: 1.2.3.4]')
+        self.make_fake_binary(
+            'apt-helper', command='echo "{}"; exit 1'.format(message))
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(3, process.returncode)
+        self.assertIn('Checking token... ERROR', process.stdout)
+        self.assertIn(
+            'Failed checking token (404  Not Found [IP: 1.2.3.4])',
+            process.stderr)
+
+    def test_update_fips_only_supported_on_xenial(self):
+        """The enable-fips-updates option fails if not on Xenial."""
+        self.SERIES = 'zesty'
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(4, process.returncode)
+        self.assertIn(
+            'Canonical FIPS 140-2 Modules is not supported on zesty',
+            process.stderr)
+
+    def test_update_fips_x86_64_aes_not_available(self):
+        """The enable-fips-updates command fails if AESNI is not available."""
+        self.cpuinfo.write_text('flags\t\t: fpu tsc')
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(7, process.returncode)
+        self.assertEqual(
+            'FIPS requires AES CPU extensions', process.stderr.strip())
+
+    def test_update_fips_ppc64le_power8(self):
+        """POWER8 processors are supported by FIPS."""
+        self.ARCH = 'ppc64le'
+        self.cpuinfo.write_text('cpu\t\t: POWER8 (raw), altivec supported')
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(0, process.returncode)
+        self.assertIn('Successfully updated FIPS packages', process.stdout)
+
+    def test_update_fips_ppc64le_older_power(self):
+        """processors older than POWER8 are not supported by FIPS."""
+        self.ARCH = 'ppc64le'
+        self.cpuinfo.write_text('cpu\t\t: POWER7')
+        process = self.script('enable-fips-updates', 'user:pass', '-y')
+        self.assertEqual(7, process.returncode)
+        self.assertEqual(
+            'FIPS requires POWER8 or later', process.stderr.strip())
diff --git a/tests/test_script.py b/tests/test_script.py
index 1feb400..4e7da93 100644
--- a/tests/test_script.py
+++ b/tests/test_script.py
@@ -79,6 +79,18 @@ class UbuntuAdvantageScriptTest(UbuntuAdvantageTest):
         process = self.script('status')
         self.assertIn("livepatch: disabled (not available)", process.stdout)
 
+    def test_status_with_one_service(self):
+        """The status for a single service can be returned."""
+        self.SERIES = 'precise'
+        process = self.script('status', 'fips')
+        self.assertEqual(process.returncode, 0)
+        self.assertEqual(process.stdout, 'fips: disabled (not available)\n')
+
+    def test_status_with_one_service_unknown(self):
+        """The script exits with error on unknown service status name."""
+        process = self.script('status', 'unknown')
+        self.assertEqual(process.returncode, 1)
+
     def test_version(self):
         """The version command shows the package version."""
         self.make_fake_binary('dpkg-query', command='echo 123')
diff --git a/tests/testing.py b/tests/testing.py
index a26eb6c..c684f48 100644
--- a/tests/testing.py
+++ b/tests/testing.py
@@ -50,10 +50,17 @@ class UbuntuAdvantageTest(TestWithFixtures):
     def setUp(self):
         super(UbuntuAdvantageTest, self).setUp()
         self.tempdir = self.useFixture(TempDir())
-        self.repo_list = Path(self.tempdir.join('repo.list'))
         self.boot_cfg = Path(self.tempdir.join('boot.cfg'))
         self.fstab = Path(self.tempdir.join('fstab'))
         self.cpuinfo = Path(self.tempdir.join('cpuinfo'))
+        self.esm_repo_list = Path(self.tempdir.join('esm-repo.list'))
+        self.fips_repo_list = Path(self.tempdir.join('fips-repo.list'))
+        self.fips_updates_repo_list = Path(
+            self.tempdir.join('fips-updates-repo.list'))
+        self.fips_repo_preferences = Path(
+            self.tempdir.join('preferences-fips'))
+        self.fips_updates_repo_preferences = Path(
+            self.tempdir.join('preferences-fips-updates'))
         self.fips_enabled_file = Path(self.tempdir.join('fips_enabled_file'))
         self.bin_dir = Path(self.tempdir.join('bin'))
         self.etc_dir = Path(self.tempdir.join('etc'))
@@ -73,6 +80,8 @@ class UbuntuAdvantageTest(TestWithFixtures):
         self.trusted_gpg_dir.mkdir()
         (self.keyrings_dir / 'ubuntu-esm-keyring.gpg').write_text('GPG key')
         (self.keyrings_dir / 'ubuntu-fips-keyring.gpg').write_text('GPG key')
+        (self.keyrings_dir / 'ubuntu-fips-updates-keyring.gpg').write_text(
+            'GPG key')
         self.cpuinfo.write_text('flags\t\t: fpu apic')
         self.make_fake_binary('apt-get')
         self.make_fake_binary('apt-helper')
@@ -105,11 +114,15 @@ class UbuntuAdvantageTest(TestWithFixtures):
             'PATH': path,
             'FSTAB': str(self.fstab),
             'CPUINFO': str(self.cpuinfo),
-            'ESM_REPO_LIST': str(self.repo_list),
-            'FIPS_REPO_LIST': str(self.repo_list),
+            'ESM_REPO_LIST': str(self.esm_repo_list),
+            'FIPS_REPO_LIST': str(self.fips_repo_list),
+            'FIPS_UPDATES_REPO_LIST': str(self.fips_updates_repo_list),
             'FIPS_BOOT_CFG': str(self.boot_cfg),
             'FIPS_BOOT_CFG_DIR': str(self.etc_dir),
             'FIPS_ENABLED_FILE': str(self.fips_enabled_file),
+            'FIPS_REPO_PREFERENCES': str(self.fips_repo_preferences),
+            'FIPS_UPDATES_REPO_PREFERENCES': str(
+                                        self.fips_updates_repo_preferences),
             'KEYRINGS_DIR': str(self.keyrings_dir),
             'APT_HELPER': str(self.apt_helper),
             'APT_AUTH_FILE': str(self.apt_auth_file),
diff --git a/ubuntu-advantage b/ubuntu-advantage
index 451e060..1ad03a5 100755
--- a/ubuntu-advantage
+++ b/ubuntu-advantage
@@ -38,8 +38,15 @@ load_modules() {
 }
 
 print_status() {
-    local service
-    for service in $SERVICES; do
+    local service="$1"
+
+    local services="$SERVICES"
+    if [ "$service" ]; then
+        name_in_list "$service" "$SERVICES" || error_exit invalid_command
+        services="$service"
+    fi
+
+    for service in $services; do
         service_print_status "$service"
     done
 }
@@ -54,20 +61,25 @@ Ubuntu Advantage offerings.
 Currently available are:
 - Ubuntu Extended Security Maintenance archive (https://ubuntu.com/esm)
 - Canonical FIPS 140-2 Certified Modules
+- Canonical FIPS 140-2 Non-Certified Module Updates
 - Canonical Livepatch Service (https://www.ubuntu.com/server/livepatch)
 
 Commands:
- version                   show the tool version
- status                    show current status of Ubuntu Advantage offerings
- enable-esm <token>        enable the ESM repository
- disable-esm               disable the ESM repository
- enable-fips <token>       enable the FIPS PPA repository and install,
-                           configure and enable FIPS certified modules
- disabe-fips               currently not supported
- enable-livepatch <token>  enable the Livepatch service
- disable-livepatch [-r]    disable the Livepatch service. With "-r", the
-                           canonical-livepatch snap will also be removed
-
+ version                           show the tool version
+ status [NAME]                     show current status of Ubuntu Advantage
+                                   offerings (or of a specific one if provided)
+ enable-esm <TOKEN>                enable the ESM repository
+ disable-esm                       disable the ESM repository
+ enable-fips <TOKEN>               enable the FIPS PPA repository and install,
+                                   configure and enable FIPS certified modules
+ disable-fips                      currently not supported
+ enable-fips-updates <TOKEN> [-y]  enable non-certified FIPS-UPDATES PPA
+                                   repository and install updates. With an
+                                   optional "-y" the user prompt will be
+                                   bypassed.
+ enable-livepatch <TOKEN>          enable the Livepatch service
+ disable-livepatch [-r]            disable the Livepatch service. With "-r", the
+                                   canonical-livepatch snap will also be removed
 EOF
     error_exit invalid_command
 }
@@ -79,20 +91,40 @@ main() {
     local service
     service=$(service_from_command "$command")
     # if the command contains a service name, check that it's valid
-    if [ "$service" ] && ! name_in_list "$service" "$SERVICES"; then
+    if [ "$service" ] && ! name_in_list "$service" "$SERVICES" \
+           && [ "$service" != "fips-updates" ]; then
         error_msg "Invalid command: \"$command\""
         usage
     fi
 
     case "$command" in
         status)
-            print_status
+            print_status "$@"
             ;;
 
         version)
             package_version ubuntu-advantage-tools
             ;;
 
+        # special case, adding it above enable-*. There is no separate
+        # fips-update service.
+        enable-fips-updates)
+            local token="$1"
+            local bypass_prompt=0
+            if [ -n "$2" ]; then
+                if [ "$2" = "-y" ]; then
+                    bypass_prompt=1
+                else
+                    error_msg "Unknown option \"$2\""
+                    usage
+                fi
+            fi
+            service_check_user
+            service_check_support "fips"
+            fips_validate_token "$token" || error_exit invalid_token
+            fips_updates_enable "$token" "$bypass_prompt"
+            ;;
+
         enable-*)
             service_enable "$service" "$@"
             ;;
diff --git a/ubuntu-advantage.1 b/ubuntu-advantage.1
index 0fa3290..e86b85d 100644
--- a/ubuntu-advantage.1
+++ b/ubuntu-advantage.1
@@ -55,6 +55,25 @@ cryptoapi.
 disable-fips
 It's currently not possible to disable FIPS after it has been enabled.
 
+.TP
+.B
+enable-fips-updates \fItoken\fR [\fB\-y\fR]
+Updating the FIPS modules will take the system out of FIPS compliance as the
+updated modules are not FIPS certified. The option enables the FIPS-UPDATES
+PPA repository and installs the updated FIPS modules. If the system is
+installing FIPS modules for the first time, it configures FIPS on the
+system. After successfully executing the ubuntu-advantage script to
+update FIPS modules, the system MUST be rebooted if FIPS kernel was
+upgraded in the upgrade process. Failing to reboot will result
+in the system not running the updated FIPS kernel.
+The \fItoken\fR argument must be in the form "user:password".
+The \fB\-y\fR argument is optional to bypass the user prompt while
+installing updates.
+
+The following FIPS modules will be updated and put in FIPS mode -
+openssh-server, openssh-client, strongswan, openssl, and the kernel
+cryptoapi.
+
 .SH Livepatch (Canonical Livepatch Service)
 Managed live kernel patching. For more information, visit
 https://www.ubuntu.com/server/livepatch