mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-22 12:14:01 +08:00
6be5cc5246
EVM protects a file's security extended attributes(xattrs) against integrity attacks. The current patchset maintains an HMAC-sha1 value across the security xattrs, storing the value as the extended attribute 'security.evm'. We anticipate other methods for protecting the security extended attributes. This patch reserves the first byte of 'security.evm' as a place holder for the type of method. Changelog v6: - move evm_ima_xattr_type definition to security/integrity/integrity.h - defined a structure for the EVM xattr called evm_ima_xattr_data (based on Serge Hallyn's suggestion) - removed unnecessary memset Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@nokia.com> Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
48 lines
1.2 KiB
C
48 lines
1.2 KiB
C
/*
|
|
* Copyright (C) 2009-2010 IBM Corporation
|
|
*
|
|
* Authors:
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation, version 2 of the
|
|
* License.
|
|
*
|
|
*/
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/integrity.h>
|
|
#include <crypto/sha.h>
|
|
|
|
/* iint cache flags */
|
|
#define IMA_MEASURED 0x01
|
|
|
|
enum evm_ima_xattr_type {
|
|
IMA_XATTR_DIGEST = 0x01,
|
|
EVM_XATTR_HMAC,
|
|
EVM_IMA_XATTR_DIGSIG,
|
|
};
|
|
|
|
struct evm_ima_xattr_data {
|
|
u8 type;
|
|
u8 digest[SHA1_DIGEST_SIZE];
|
|
} __attribute__((packed));
|
|
|
|
/* integrity data associated with an inode */
|
|
struct integrity_iint_cache {
|
|
struct rb_node rb_node; /* rooted in integrity_iint_tree */
|
|
struct inode *inode; /* back pointer to inode in question */
|
|
u64 version; /* track inode changes */
|
|
unsigned char flags;
|
|
u8 digest[SHA1_DIGEST_SIZE];
|
|
struct mutex mutex; /* protects: version, flags, digest */
|
|
enum integrity_status hmac_status;
|
|
};
|
|
|
|
/* rbtree tree calls to lookup, insert, delete
|
|
* integrity data associated with an inode.
|
|
*/
|
|
struct integrity_iint_cache *integrity_iint_insert(struct inode *inode);
|
|
struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
|