]>
Commit | Line | Data |
---|---|---|
66dbc325 MZ |
1 | /* |
2 | * Copyright (C) 2005-2010 IBM Corporation | |
3 | * | |
4 | * Author: | |
5 | * Mimi Zohar <zohar@us.ibm.com> | |
6 | * Kylene Hall <kjhall@us.ibm.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation, version 2 of the License. | |
11 | * | |
12 | * File: evm_main.c | |
13 | * implements evm_inode_setxattr, evm_inode_post_setxattr, | |
14 | * evm_inode_removexattr, and evm_verifyxattr | |
15 | */ | |
16 | ||
20ee451f JP |
17 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
18 | ||
66dbc325 MZ |
19 | #include <linux/module.h> |
20 | #include <linux/crypto.h> | |
9b97b6cd | 21 | #include <linux/audit.h> |
66dbc325 MZ |
22 | #include <linux/xattr.h> |
23 | #include <linux/integrity.h> | |
3e1be52d | 24 | #include <linux/evm.h> |
50d34394 IM |
25 | #include <linux/magic.h> |
26 | ||
d46eb369 | 27 | #include <crypto/hash.h> |
613317bd | 28 | #include <crypto/algapi.h> |
66dbc325 MZ |
29 | #include "evm.h" |
30 | ||
31 | int evm_initialized; | |
32 | ||
9b97b6cd MZ |
33 | static char *integrity_status_msg[] = { |
34 | "pass", "fail", "no_label", "no_xattrs", "unknown" | |
35 | }; | |
66dbc325 | 36 | char *evm_hmac = "hmac(sha1)"; |
15647eb3 | 37 | char *evm_hash = "sha1"; |
d3b33679 | 38 | int evm_hmac_attrs; |
66dbc325 MZ |
39 | |
40 | char *evm_config_xattrnames[] = { | |
41 | #ifdef CONFIG_SECURITY_SELINUX | |
42 | XATTR_NAME_SELINUX, | |
43 | #endif | |
44 | #ifdef CONFIG_SECURITY_SMACK | |
45 | XATTR_NAME_SMACK, | |
3e38df56 DK |
46 | #ifdef CONFIG_EVM_EXTRA_SMACK_XATTRS |
47 | XATTR_NAME_SMACKEXEC, | |
48 | XATTR_NAME_SMACKTRANSMUTE, | |
49 | XATTR_NAME_SMACKMMAP, | |
50 | #endif | |
2fe5d6de MZ |
51 | #endif |
52 | #ifdef CONFIG_IMA_APPRAISE | |
53 | XATTR_NAME_IMA, | |
66dbc325 MZ |
54 | #endif |
55 | XATTR_NAME_CAPS, | |
56 | NULL | |
57 | }; | |
58 | ||
7102ebcd MZ |
59 | static int evm_fixmode; |
60 | static int __init evm_set_fixmode(char *str) | |
61 | { | |
62 | if (strncmp(str, "fix", 3) == 0) | |
63 | evm_fixmode = 1; | |
64 | return 0; | |
65 | } | |
66 | __setup("evm=", evm_set_fixmode); | |
67 | ||
d3b33679 DK |
68 | static void __init evm_init_config(void) |
69 | { | |
70 | #ifdef CONFIG_EVM_ATTR_FSUUID | |
71 | evm_hmac_attrs |= EVM_ATTR_FSUUID; | |
72 | #endif | |
73 | pr_info("HMAC attrs: 0x%x\n", evm_hmac_attrs); | |
74 | } | |
75 | ||
15647eb3 DK |
76 | static int evm_find_protected_xattrs(struct dentry *dentry) |
77 | { | |
c6f493d6 | 78 | struct inode *inode = d_backing_inode(dentry); |
15647eb3 DK |
79 | char **xattr; |
80 | int error; | |
81 | int count = 0; | |
82 | ||
5d6c3191 | 83 | if (!(inode->i_opflags & IOP_XATTR)) |
15647eb3 DK |
84 | return -EOPNOTSUPP; |
85 | ||
86 | for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) { | |
5d6c3191 | 87 | error = __vfs_getxattr(dentry, inode, *xattr, NULL, 0); |
15647eb3 DK |
88 | if (error < 0) { |
89 | if (error == -ENODATA) | |
90 | continue; | |
91 | return error; | |
92 | } | |
93 | count++; | |
94 | } | |
95 | ||
96 | return count; | |
97 | } | |
98 | ||
66dbc325 MZ |
99 | /* |
100 | * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr | |
101 | * | |
102 | * Compute the HMAC on the dentry's protected set of extended attributes | |
7102ebcd MZ |
103 | * and compare it against the stored security.evm xattr. |
104 | * | |
105 | * For performance: | |
106 | * - use the previoulsy retrieved xattr value and length to calculate the | |
107 | * HMAC.) | |
108 | * - cache the verification result in the iint, when available. | |
66dbc325 MZ |
109 | * |
110 | * Returns integrity status | |
111 | */ | |
112 | static enum integrity_status evm_verify_hmac(struct dentry *dentry, | |
113 | const char *xattr_name, | |
114 | char *xattr_value, | |
115 | size_t xattr_value_len, | |
116 | struct integrity_iint_cache *iint) | |
117 | { | |
15647eb3 DK |
118 | struct evm_ima_xattr_data *xattr_data = NULL; |
119 | struct evm_ima_xattr_data calc; | |
566be59a | 120 | enum integrity_status evm_status = INTEGRITY_PASS; |
15647eb3 | 121 | int rc, xattr_len; |
66dbc325 | 122 | |
7102ebcd | 123 | if (iint && iint->evm_status == INTEGRITY_PASS) |
24e0198e | 124 | return iint->evm_status; |
66dbc325 | 125 | |
6d38ca01 DK |
126 | /* if status is not PASS, try to check again - against -ENOMEM */ |
127 | ||
15647eb3 DK |
128 | /* first need to know the sig type */ |
129 | rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0, | |
130 | GFP_NOFS); | |
131 | if (rc <= 0) { | |
1f100979 DK |
132 | evm_status = INTEGRITY_FAIL; |
133 | if (rc == -ENODATA) { | |
15647eb3 DK |
134 | rc = evm_find_protected_xattrs(dentry); |
135 | if (rc > 0) | |
136 | evm_status = INTEGRITY_NOLABEL; | |
137 | else if (rc == 0) | |
138 | evm_status = INTEGRITY_NOXATTRS; /* new file */ | |
1f100979 DK |
139 | } else if (rc == -EOPNOTSUPP) { |
140 | evm_status = INTEGRITY_UNKNOWN; | |
15647eb3 | 141 | } |
566be59a MZ |
142 | goto out; |
143 | } | |
66dbc325 | 144 | |
b1aaab22 | 145 | xattr_len = rc; |
15647eb3 DK |
146 | |
147 | /* check value type */ | |
148 | switch (xattr_data->type) { | |
149 | case EVM_XATTR_HMAC: | |
b4bfec7f SF |
150 | if (xattr_len != sizeof(struct evm_ima_xattr_data)) { |
151 | evm_status = INTEGRITY_FAIL; | |
152 | goto out; | |
153 | } | |
15647eb3 DK |
154 | rc = evm_calc_hmac(dentry, xattr_name, xattr_value, |
155 | xattr_value_len, calc.digest); | |
156 | if (rc) | |
157 | break; | |
613317bd | 158 | rc = crypto_memneq(xattr_data->digest, calc.digest, |
15647eb3 DK |
159 | sizeof(calc.digest)); |
160 | if (rc) | |
161 | rc = -EINVAL; | |
162 | break; | |
163 | case EVM_IMA_XATTR_DIGSIG: | |
164 | rc = evm_calc_hash(dentry, xattr_name, xattr_value, | |
165 | xattr_value_len, calc.digest); | |
166 | if (rc) | |
167 | break; | |
168 | rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM, | |
b1aaab22 | 169 | (const char *)xattr_data, xattr_len, |
15647eb3 DK |
170 | calc.digest, sizeof(calc.digest)); |
171 | if (!rc) { | |
c2baec7f DK |
172 | /* Replace RSA with HMAC if not mounted readonly and |
173 | * not immutable | |
174 | */ | |
c6f493d6 DH |
175 | if (!IS_RDONLY(d_backing_inode(dentry)) && |
176 | !IS_IMMUTABLE(d_backing_inode(dentry))) | |
c2baec7f DK |
177 | evm_update_evmxattr(dentry, xattr_name, |
178 | xattr_value, | |
179 | xattr_value_len); | |
15647eb3 DK |
180 | } |
181 | break; | |
182 | default: | |
183 | rc = -EINVAL; | |
184 | break; | |
185 | } | |
186 | ||
187 | if (rc) | |
188 | evm_status = (rc == -ENODATA) ? | |
189 | INTEGRITY_NOXATTRS : INTEGRITY_FAIL; | |
7102ebcd MZ |
190 | out: |
191 | if (iint) | |
192 | iint->evm_status = evm_status; | |
15647eb3 | 193 | kfree(xattr_data); |
7102ebcd | 194 | return evm_status; |
66dbc325 MZ |
195 | } |
196 | ||
197 | static int evm_protected_xattr(const char *req_xattr_name) | |
198 | { | |
199 | char **xattrname; | |
200 | int namelen; | |
201 | int found = 0; | |
202 | ||
203 | namelen = strlen(req_xattr_name); | |
204 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { | |
205 | if ((strlen(*xattrname) == namelen) | |
206 | && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) { | |
207 | found = 1; | |
208 | break; | |
209 | } | |
cb723180 MZ |
210 | if (strncmp(req_xattr_name, |
211 | *xattrname + XATTR_SECURITY_PREFIX_LEN, | |
212 | strlen(req_xattr_name)) == 0) { | |
213 | found = 1; | |
214 | break; | |
215 | } | |
66dbc325 MZ |
216 | } |
217 | return found; | |
218 | } | |
219 | ||
220 | /** | |
221 | * evm_verifyxattr - verify the integrity of the requested xattr | |
222 | * @dentry: object of the verify xattr | |
223 | * @xattr_name: requested xattr | |
224 | * @xattr_value: requested xattr value | |
225 | * @xattr_value_len: requested xattr value length | |
226 | * | |
227 | * Calculate the HMAC for the given dentry and verify it against the stored | |
228 | * security.evm xattr. For performance, use the xattr value and length | |
229 | * previously retrieved to calculate the HMAC. | |
230 | * | |
231 | * Returns the xattr integrity status. | |
232 | * | |
233 | * This function requires the caller to lock the inode's i_mutex before it | |
234 | * is executed. | |
235 | */ | |
236 | enum integrity_status evm_verifyxattr(struct dentry *dentry, | |
237 | const char *xattr_name, | |
2960e6cb DK |
238 | void *xattr_value, size_t xattr_value_len, |
239 | struct integrity_iint_cache *iint) | |
66dbc325 | 240 | { |
66dbc325 MZ |
241 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) |
242 | return INTEGRITY_UNKNOWN; | |
243 | ||
2960e6cb | 244 | if (!iint) { |
c6f493d6 | 245 | iint = integrity_iint_find(d_backing_inode(dentry)); |
2960e6cb DK |
246 | if (!iint) |
247 | return INTEGRITY_UNKNOWN; | |
248 | } | |
249 | return evm_verify_hmac(dentry, xattr_name, xattr_value, | |
66dbc325 | 250 | xattr_value_len, iint); |
66dbc325 MZ |
251 | } |
252 | EXPORT_SYMBOL_GPL(evm_verifyxattr); | |
253 | ||
7102ebcd MZ |
254 | /* |
255 | * evm_verify_current_integrity - verify the dentry's metadata integrity | |
256 | * @dentry: pointer to the affected dentry | |
257 | * | |
258 | * Verify and return the dentry's metadata integrity. The exceptions are | |
259 | * before EVM is initialized or in 'fix' mode. | |
260 | */ | |
261 | static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) | |
262 | { | |
c6f493d6 | 263 | struct inode *inode = d_backing_inode(dentry); |
7102ebcd MZ |
264 | |
265 | if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode) | |
266 | return 0; | |
267 | return evm_verify_hmac(dentry, NULL, NULL, 0, NULL); | |
268 | } | |
269 | ||
a924ce0b MZ |
270 | /* |
271 | * evm_protect_xattr - protect the EVM extended attribute | |
272 | * | |
bf6d0f5d MZ |
273 | * Prevent security.evm from being modified or removed without the |
274 | * necessary permissions or when the existing value is invalid. | |
275 | * | |
276 | * The posix xattr acls are 'system' prefixed, which normally would not | |
277 | * affect security.evm. An interesting side affect of writing posix xattr | |
278 | * acls is their modifying of the i_mode, which is included in security.evm. | |
279 | * For posix xattr acls only, permit security.evm, even if it currently | |
280 | * doesn't exist, to be updated. | |
a924ce0b MZ |
281 | */ |
282 | static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, | |
283 | const void *xattr_value, size_t xattr_value_len) | |
284 | { | |
285 | enum integrity_status evm_status; | |
286 | ||
287 | if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { | |
288 | if (!capable(CAP_SYS_ADMIN)) | |
289 | return -EPERM; | |
bf6d0f5d MZ |
290 | } else if (!evm_protected_xattr(xattr_name)) { |
291 | if (!posix_xattr_acl(xattr_name)) | |
292 | return 0; | |
293 | evm_status = evm_verify_current_integrity(dentry); | |
294 | if ((evm_status == INTEGRITY_PASS) || | |
566be59a | 295 | (evm_status == INTEGRITY_NOXATTRS)) |
bf6d0f5d | 296 | return 0; |
9b97b6cd | 297 | goto out; |
bf6d0f5d | 298 | } |
a924ce0b | 299 | evm_status = evm_verify_current_integrity(dentry); |
3dcbad52 DK |
300 | if (evm_status == INTEGRITY_NOXATTRS) { |
301 | struct integrity_iint_cache *iint; | |
302 | ||
c6f493d6 | 303 | iint = integrity_iint_find(d_backing_inode(dentry)); |
3dcbad52 DK |
304 | if (iint && (iint->flags & IMA_NEW_FILE)) |
305 | return 0; | |
5101a185 MZ |
306 | |
307 | /* exception for pseudo filesystems */ | |
fc64005c AV |
308 | if (dentry->d_sb->s_magic == TMPFS_MAGIC |
309 | || dentry->d_sb->s_magic == SYSFS_MAGIC) | |
5101a185 MZ |
310 | return 0; |
311 | ||
312 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, | |
313 | dentry->d_inode, dentry->d_name.name, | |
314 | "update_metadata", | |
315 | integrity_status_msg[evm_status], | |
316 | -EPERM, 0); | |
3dcbad52 | 317 | } |
9b97b6cd MZ |
318 | out: |
319 | if (evm_status != INTEGRITY_PASS) | |
c6f493d6 | 320 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), |
9b97b6cd MZ |
321 | dentry->d_name.name, "appraise_metadata", |
322 | integrity_status_msg[evm_status], | |
323 | -EPERM, 0); | |
a924ce0b MZ |
324 | return evm_status == INTEGRITY_PASS ? 0 : -EPERM; |
325 | } | |
326 | ||
66dbc325 MZ |
327 | /** |
328 | * evm_inode_setxattr - protect the EVM extended attribute | |
329 | * @dentry: pointer to the affected dentry | |
330 | * @xattr_name: pointer to the affected extended attribute name | |
331 | * @xattr_value: pointer to the new extended attribute value | |
332 | * @xattr_value_len: pointer to the new extended attribute value length | |
333 | * | |
2fb1c9a4 MZ |
334 | * Before allowing the 'security.evm' protected xattr to be updated, |
335 | * verify the existing value is valid. As only the kernel should have | |
336 | * access to the EVM encrypted key needed to calculate the HMAC, prevent | |
337 | * userspace from writing HMAC value. Writing 'security.evm' requires | |
338 | * requires CAP_SYS_ADMIN privileges. | |
66dbc325 MZ |
339 | */ |
340 | int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, | |
341 | const void *xattr_value, size_t xattr_value_len) | |
342 | { | |
2fb1c9a4 MZ |
343 | const struct evm_ima_xattr_data *xattr_data = xattr_value; |
344 | ||
3b1deef6 DK |
345 | if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { |
346 | if (!xattr_value_len) | |
347 | return -EINVAL; | |
348 | if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) | |
349 | return -EPERM; | |
350 | } | |
a924ce0b MZ |
351 | return evm_protect_xattr(dentry, xattr_name, xattr_value, |
352 | xattr_value_len); | |
66dbc325 MZ |
353 | } |
354 | ||
355 | /** | |
356 | * evm_inode_removexattr - protect the EVM extended attribute | |
357 | * @dentry: pointer to the affected dentry | |
358 | * @xattr_name: pointer to the affected extended attribute name | |
359 | * | |
7102ebcd MZ |
360 | * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that |
361 | * the current value is valid. | |
66dbc325 MZ |
362 | */ |
363 | int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) | |
364 | { | |
a924ce0b | 365 | return evm_protect_xattr(dentry, xattr_name, NULL, 0); |
66dbc325 MZ |
366 | } |
367 | ||
523b74b1 DK |
368 | static void evm_reset_status(struct inode *inode) |
369 | { | |
370 | struct integrity_iint_cache *iint; | |
371 | ||
372 | iint = integrity_iint_find(inode); | |
373 | if (iint) | |
374 | iint->evm_status = INTEGRITY_UNKNOWN; | |
375 | } | |
376 | ||
66dbc325 MZ |
377 | /** |
378 | * evm_inode_post_setxattr - update 'security.evm' to reflect the changes | |
379 | * @dentry: pointer to the affected dentry | |
380 | * @xattr_name: pointer to the affected extended attribute name | |
381 | * @xattr_value: pointer to the new extended attribute value | |
382 | * @xattr_value_len: pointer to the new extended attribute value length | |
383 | * | |
384 | * Update the HMAC stored in 'security.evm' to reflect the change. | |
385 | * | |
386 | * No need to take the i_mutex lock here, as this function is called from | |
387 | * __vfs_setxattr_noperm(). The caller of which has taken the inode's | |
388 | * i_mutex lock. | |
389 | */ | |
390 | void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, | |
391 | const void *xattr_value, size_t xattr_value_len) | |
392 | { | |
bf6d0f5d MZ |
393 | if (!evm_initialized || (!evm_protected_xattr(xattr_name) |
394 | && !posix_xattr_acl(xattr_name))) | |
66dbc325 MZ |
395 | return; |
396 | ||
523b74b1 DK |
397 | evm_reset_status(dentry->d_inode); |
398 | ||
66dbc325 | 399 | evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len); |
66dbc325 MZ |
400 | } |
401 | ||
402 | /** | |
403 | * evm_inode_post_removexattr - update 'security.evm' after removing the xattr | |
404 | * @dentry: pointer to the affected dentry | |
405 | * @xattr_name: pointer to the affected extended attribute name | |
406 | * | |
407 | * Update the HMAC stored in 'security.evm' to reflect removal of the xattr. | |
7c51bb00 DK |
408 | * |
409 | * No need to take the i_mutex lock here, as this function is called from | |
410 | * vfs_removexattr() which takes the i_mutex. | |
66dbc325 MZ |
411 | */ |
412 | void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) | |
413 | { | |
66dbc325 MZ |
414 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) |
415 | return; | |
416 | ||
523b74b1 DK |
417 | evm_reset_status(dentry->d_inode); |
418 | ||
66dbc325 | 419 | evm_update_evmxattr(dentry, xattr_name, NULL, 0); |
66dbc325 MZ |
420 | } |
421 | ||
817b54aa MZ |
422 | /** |
423 | * evm_inode_setattr - prevent updating an invalid EVM extended attribute | |
424 | * @dentry: pointer to the affected dentry | |
425 | */ | |
426 | int evm_inode_setattr(struct dentry *dentry, struct iattr *attr) | |
427 | { | |
428 | unsigned int ia_valid = attr->ia_valid; | |
429 | enum integrity_status evm_status; | |
430 | ||
a924ce0b | 431 | if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))) |
817b54aa MZ |
432 | return 0; |
433 | evm_status = evm_verify_current_integrity(dentry); | |
566be59a MZ |
434 | if ((evm_status == INTEGRITY_PASS) || |
435 | (evm_status == INTEGRITY_NOXATTRS)) | |
436 | return 0; | |
c6f493d6 | 437 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), |
9b97b6cd MZ |
438 | dentry->d_name.name, "appraise_metadata", |
439 | integrity_status_msg[evm_status], -EPERM, 0); | |
566be59a | 440 | return -EPERM; |
817b54aa MZ |
441 | } |
442 | ||
66dbc325 MZ |
443 | /** |
444 | * evm_inode_post_setattr - update 'security.evm' after modifying metadata | |
445 | * @dentry: pointer to the affected dentry | |
446 | * @ia_valid: for the UID and GID status | |
447 | * | |
448 | * For now, update the HMAC stored in 'security.evm' to reflect UID/GID | |
449 | * changes. | |
450 | * | |
451 | * This function is called from notify_change(), which expects the caller | |
452 | * to lock the inode's i_mutex. | |
453 | */ | |
454 | void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) | |
455 | { | |
456 | if (!evm_initialized) | |
457 | return; | |
458 | ||
459 | if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) | |
460 | evm_update_evmxattr(dentry, NULL, NULL, 0); | |
66dbc325 MZ |
461 | } |
462 | ||
cb723180 MZ |
463 | /* |
464 | * evm_inode_init_security - initializes security.evm | |
465 | */ | |
466 | int evm_inode_init_security(struct inode *inode, | |
467 | const struct xattr *lsm_xattr, | |
468 | struct xattr *evm_xattr) | |
469 | { | |
470 | struct evm_ima_xattr_data *xattr_data; | |
471 | int rc; | |
472 | ||
473 | if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name)) | |
5a4730ba | 474 | return 0; |
cb723180 MZ |
475 | |
476 | xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS); | |
477 | if (!xattr_data) | |
478 | return -ENOMEM; | |
479 | ||
480 | xattr_data->type = EVM_XATTR_HMAC; | |
481 | rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest); | |
482 | if (rc < 0) | |
483 | goto out; | |
484 | ||
485 | evm_xattr->value = xattr_data; | |
486 | evm_xattr->value_len = sizeof(*xattr_data); | |
9548906b | 487 | evm_xattr->name = XATTR_EVM_SUFFIX; |
cb723180 MZ |
488 | return 0; |
489 | out: | |
490 | kfree(xattr_data); | |
491 | return rc; | |
492 | } | |
493 | EXPORT_SYMBOL_GPL(evm_inode_init_security); | |
494 | ||
2ce523eb DK |
495 | #ifdef CONFIG_EVM_LOAD_X509 |
496 | void __init evm_load_x509(void) | |
497 | { | |
26ddabfe DK |
498 | int rc; |
499 | ||
500 | rc = integrity_load_x509(INTEGRITY_KEYRING_EVM, CONFIG_EVM_X509_PATH); | |
501 | if (!rc) | |
502 | evm_initialized |= EVM_INIT_X509; | |
2ce523eb DK |
503 | } |
504 | #endif | |
505 | ||
66dbc325 MZ |
506 | static int __init init_evm(void) |
507 | { | |
508 | int error; | |
509 | ||
d3b33679 DK |
510 | evm_init_config(); |
511 | ||
f4dc3778 DK |
512 | error = integrity_init_keyring(INTEGRITY_KEYRING_EVM); |
513 | if (error) | |
514 | return error; | |
515 | ||
66dbc325 MZ |
516 | error = evm_init_secfs(); |
517 | if (error < 0) { | |
20ee451f | 518 | pr_info("Error registering secfs\n"); |
f4dc3778 | 519 | return error; |
66dbc325 | 520 | } |
15647eb3 DK |
521 | |
522 | return 0; | |
66dbc325 MZ |
523 | } |
524 | ||
66dbc325 MZ |
525 | /* |
526 | * evm_display_config - list the EVM protected security extended attributes | |
527 | */ | |
528 | static int __init evm_display_config(void) | |
529 | { | |
530 | char **xattrname; | |
531 | ||
532 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) | |
20ee451f | 533 | pr_info("%s\n", *xattrname); |
66dbc325 MZ |
534 | return 0; |
535 | } | |
536 | ||
537 | pure_initcall(evm_display_config); | |
538 | late_initcall(init_evm); | |
539 | ||
540 | MODULE_DESCRIPTION("Extended Verification Module"); | |
541 | MODULE_LICENSE("GPL"); |