1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
2 | /* |
3 | * Copyright (C) 2005-2010 IBM Corporation |
4 | * |
5 | * Authors: |
6 | * Mimi Zohar <zohar@us.ibm.com> |
7 | * Kylene Hall <kjhall@us.ibm.com> |
8 | * |
9 | * File: evm.h |
10 | */ |
11 | |
12 | #ifndef __INTEGRITY_EVM_H |
13 | #define __INTEGRITY_EVM_H |
14 | |
15 | #include <linux/xattr.h> |
16 | #include <linux/security.h> |
17 | |
18 | #include "../integrity.h" |
19 | |
20 | #define EVM_INIT_HMAC 0x0001 |
21 | #define EVM_INIT_X509 0x0002 |
22 | #define EVM_ALLOW_METADATA_WRITES 0x0004 |
23 | #define EVM_SETUP_COMPLETE 0x80000000 /* userland has signaled key load */ |
24 | |
25 | #define EVM_KEY_MASK (EVM_INIT_HMAC | EVM_INIT_X509) |
26 | #define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP_COMPLETE | \ |
27 | EVM_ALLOW_METADATA_WRITES) |
28 | |
29 | struct xattr_list { |
30 | struct list_head list; |
31 | char *name; |
32 | bool enabled; |
33 | }; |
34 | |
35 | #define EVM_NEW_FILE 0x00000001 |
36 | #define EVM_IMMUTABLE_DIGSIG 0x00000002 |
37 | |
38 | /* EVM integrity metadata associated with an inode */ |
39 | struct evm_iint_cache { |
40 | unsigned long flags; |
41 | enum integrity_status evm_status:4; |
42 | }; |
43 | |
44 | extern struct lsm_blob_sizes evm_blob_sizes; |
45 | |
46 | static inline struct evm_iint_cache *evm_iint_inode(const struct inode *inode) |
47 | { |
48 | if (unlikely(!inode->i_security)) |
49 | return NULL; |
50 | |
51 | return inode->i_security + evm_blob_sizes.lbs_inode; |
52 | } |
53 | |
54 | extern int evm_initialized; |
55 | |
56 | #define EVM_ATTR_FSUUID 0x0001 |
57 | |
58 | extern int evm_hmac_attrs; |
59 | |
60 | /* List of EVM protected security xattrs */ |
61 | extern struct list_head evm_config_xattrnames; |
62 | |
63 | struct evm_digest { |
64 | struct ima_digest_data hdr; |
65 | char digest[IMA_MAX_DIGEST_SIZE]; |
66 | } __packed; |
67 | |
68 | int evm_protected_xattr(const char *req_xattr_name); |
69 | |
70 | int evm_init_key(void); |
71 | int evm_update_evmxattr(struct dentry *dentry, |
72 | const char *req_xattr_name, |
73 | const char *req_xattr_value, |
74 | size_t req_xattr_value_len); |
75 | int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, |
76 | const char *req_xattr_value, |
77 | size_t req_xattr_value_len, struct evm_digest *data); |
78 | int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, |
79 | const char *req_xattr_value, |
80 | size_t req_xattr_value_len, char type, |
81 | struct evm_digest *data); |
82 | int evm_init_hmac(struct inode *inode, const struct xattr *xattrs, |
83 | char *hmac_val); |
84 | int evm_init_secfs(void); |
85 | |
86 | #endif |
87 | |