Handle PermissionError when importing crypt when FIPS is enabled.

[takeda]

What does this PR do?

When salt runs on a machine where FIPS is enabled, it produces:

PermissionError: [Errno 1] Operation not permitted

on import.

This error shows up in certain circumstances, for example when trying to get documentation from a module.

salt-call saltutil

What issues does this PR fix or reference?

Fixes: not created

Merge requirements satisfied?

[NOTICE] Bug fixes or features added to Salt require tests.

• Docs
• Changelog - https://docs.saltproject.io/en/master/topics/development/changelog.html
• Tests written/updated

Commits signed with GPG?

Yes/No

Please review Salt's Contributing Guide for best practices.

See GitHub's page on GPG signing for more information about signing commits with GPG.

[welcome]

Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here’s some information that may help as you continue your Salt journey.
Please be sure to review our Code of Conduct. Also, check out some of our community resources including:

• Community Wiki
• Salt’s Contributor Guide
• Join our Community Slack
• IRC on LiberaChat
• Salt Project YouTube channel
• Salt Project Twitch channel

There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar.
If you have additional questions, email us at [email protected]. We’re glad you’ve joined our community and look forward to doing awesome things with you!

[whytewolf]

Thank you for the PR. Is there anyway we can get some tests to make sure the functionality doesn't break in the future. as well as a changelog file.

[whytewolf]

@takeda can we get a test case please? I know the fix seems simple but it dos still need a test case just to make sure this doesn't break again in the future.

[takeda]

@whytewolf I'm not sure how this could be tested. To enable FIPS you switch a sysctl in the kernel crypto.fips_enabled = 1. I don't see how this could be incorporated in an unit test.

[whytewolf]

@takeda sorry. I missed this was only catching on import. in theory you could mock the __import__ function but that is tricky business that can cause all sorts of nightmares. I"ll go ahead and see if we can bypass the test requirement.

[whytewolf]

it does still need a changelog though

[Ch3LL]

Merging as tests passed previously before the changelog was added.

[welcome]

Congratulations on your first PR being merged! 🎉