security/apparmor/crypto.c

   1 /*
   2  * AppArmor security module
   3  *
   4  * This file contains AppArmor policy loading interface function definitions.
   5  *
   6  * Copyright 2013 Canonical Ltd.
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License as
  10  * published by the Free Software Foundation, version 2 of the
  11  * License.
  12  *
  13  * Fns to provide a checksum of policy that has been loaded this can be
  14  * compared to userspace policy compiles to check loaded policy is what
  15  * it should be.
  16  */
  17
  18 #include <crypto/hash.h>
  19
  20 #include "include/apparmor.h"
  21 #include "include/crypto.h"
  22
  23 static unsigned int apparmor_hash_size;
  24
  25 static struct crypto_shash *apparmor_tfm;
  26
  27 unsigned int aa_hash_size(void)
  28 {
  29         return apparmor_hash_size;
  30 }
  31
  32 void aa_snprint_hashstr(char *out, unsigned char *hash, unsigned int hsize)
  33 {
  34        unsigned int i;
  35
  36        for (i = 0; i < hsize; i++)
  37                sprintf(out + i*2, "%.2x", hash[i]);
  38        out[hsize*2] = 0;
  39 }
  40
  41 char *aa_asprint_hashstr(unsigned char *hash, unsigned int hsize, gfp_t gfp)
  42 {
  43         char *buffer = kmalloc(hsize*2 + 1, gfp);
  44         if (!buffer)
  45                 return NULL;
  46         aa_snprint_hashstr(buffer, hash, hsize);
  47
  48         return buffer;
  49 }
  50
  51 char *aa_calc_hash(void *data, size_t len)
  52 {
  53         SHASH_DESC_ON_STACK(desc, apparmor_tfm);
  54         char *hash = NULL;
  55         int error = -ENOMEM;
  56
  57         if (!apparmor_tfm)
  58                 return NULL;
  59
  60         hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
  61         if (!hash)
  62                 goto fail;
  63
  64         desc->tfm = apparmor_tfm;
  65         desc->flags = 0;
  66
  67         error = crypto_shash_init(desc);
  68         if (error)
  69                 goto fail;
  70         error = crypto_shash_update(desc, (u8 *) data, len);
  71         if (error)
  72                 goto fail;
  73         error = crypto_shash_final(desc, hash);
  74         if (error)
  75                 goto fail;
  76
  77         return hash;
  78
  79 fail:
  80         kfree(hash);
  81
  82         return ERR_PTR(error);
  83 }
  84
  85 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
  86                          size_t len)
  87 {
  88         SHASH_DESC_ON_STACK(desc, apparmor_tfm);
  89         int error = -ENOMEM;
  90         __le32 le32_version = cpu_to_le32(version);
  91
  92         if (!aa_g_hash_policy)
  93                 return 0;
  94
  95         if (!apparmor_tfm)
  96                 return 0;
  97
  98         profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
  99         if (!profile->hash)
 100                 goto fail;
 101
 102         desc->tfm = apparmor_tfm;
 103         desc->flags = 0;
 104
 105         error = crypto_shash_init(desc);
 106         if (error)
 107                 goto fail;
 108         error = crypto_shash_update(desc, (u8 *) &le32_version, 4);
 109         if (error)
 110                 goto fail;
 111         error = crypto_shash_update(desc, (u8 *) start, len);
 112         if (error)
 113                 goto fail;
 114         error = crypto_shash_final(desc, profile->hash);
 115         if (error)
 116                 goto fail;
 117
 118         return 0;
 119
 120 fail:
 121         kfree(profile->hash);
 122         profile->hash = NULL;
 123
 124         return error;
 125 }
 126
 127 static int __init init_profile_hash(void)
 128 {
 129         struct crypto_shash *tfm;
 130
 131         if (!apparmor_initialized)
 132                 return 0;
 133
 134         tfm = crypto_alloc_shash("sha1", 0, CRYPTO_ALG_ASYNC);
 135         if (IS_ERR(tfm)) {
 136                 int error = PTR_ERR(tfm);
 137                 AA_ERROR("failed to setup profile sha1 hashing: %d\n", error);
 138                 return error;
 139         }
 140         apparmor_tfm = tfm;
 141         apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);
 142
 143         aa_info_message("AppArmor sha1 policy hashing enabled");
 144
 145         return 0;
 146 }
 147
 148 late_initcall(init_profile_hash);