2 * Copyright (C) 2005-2010 IBM Corporation
5 * Mimi Zohar <zohar@us.ibm.com>
6 * Kylene Hall <kjhall@us.ibm.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation, version 2 of the License.
13 * Using root's kernel master key (kmk), calculate the HMAC
16 #include <linux/module.h>
17 #include <linux/crypto.h>
18 #include <linux/xattr.h>
19 #include <linux/scatterlist.h>
20 #include <keys/encrypted-type.h>
23 #define EVMKEY "evm-key"
24 #define MAX_KEY_SIZE 128
25 static unsigned char evmkey
[MAX_KEY_SIZE
];
26 static int evmkey_len
= MAX_KEY_SIZE
;
28 static int init_desc(struct hash_desc
*desc
)
32 desc
->tfm
= crypto_alloc_hash(evm_hmac
, 0, CRYPTO_ALG_ASYNC
);
33 if (IS_ERR(desc
->tfm
)) {
34 pr_info("Can not allocate %s (reason: %ld)\n",
35 evm_hmac
, PTR_ERR(desc
->tfm
));
36 rc
= PTR_ERR(desc
->tfm
);
40 rc
= crypto_hash_setkey(desc
->tfm
, evmkey
, evmkey_len
);
43 rc
= crypto_hash_init(desc
);
46 crypto_free_hash(desc
->tfm
);
50 /* Protect against 'cutting & pasting' security.evm xattr, include inode
53 * (Additional directory/file metadata needs to be added for more complete
56 static void hmac_add_misc(struct hash_desc
*desc
, struct inode
*inode
,
66 struct scatterlist sg
[1];
68 memset(&hmac_misc
, 0, sizeof hmac_misc
);
69 hmac_misc
.ino
= inode
->i_ino
;
70 hmac_misc
.generation
= inode
->i_generation
;
71 hmac_misc
.uid
= inode
->i_uid
;
72 hmac_misc
.gid
= inode
->i_gid
;
73 hmac_misc
.mode
= inode
->i_mode
;
74 sg_init_one(sg
, &hmac_misc
, sizeof hmac_misc
);
75 crypto_hash_update(desc
, sg
, sizeof hmac_misc
);
76 crypto_hash_final(desc
, digest
);
80 * Calculate the HMAC value across the set of protected security xattrs.
82 * Instead of retrieving the requested xattr, for performance, calculate
83 * the hmac using the requested xattr value. Don't alloc/free memory for
84 * each xattr, but attempt to re-use the previously allocated memory.
86 int evm_calc_hmac(struct dentry
*dentry
, const char *req_xattr_name
,
87 const char *req_xattr_value
, size_t req_xattr_value_len
,
90 struct inode
*inode
= dentry
->d_inode
;
91 struct hash_desc desc
;
92 struct scatterlist sg
[1];
94 size_t xattr_size
= 0;
95 char *xattr_value
= NULL
;
99 if (!inode
->i_op
|| !inode
->i_op
->getxattr
)
101 error
= init_desc(&desc
);
106 for (xattrname
= evm_config_xattrnames
; *xattrname
!= NULL
; xattrname
++) {
107 if ((req_xattr_name
&& req_xattr_value
)
108 && !strcmp(*xattrname
, req_xattr_name
)) {
110 sg_init_one(sg
, req_xattr_value
, req_xattr_value_len
);
111 crypto_hash_update(&desc
, sg
, req_xattr_value_len
);
114 size
= vfs_getxattr_alloc(dentry
, *xattrname
,
115 &xattr_value
, xattr_size
, GFP_NOFS
);
116 if (size
== -ENOMEM
) {
125 sg_init_one(sg
, xattr_value
, xattr_size
);
126 crypto_hash_update(&desc
, sg
, xattr_size
);
128 hmac_add_misc(&desc
, inode
, digest
);
131 crypto_free_hash(desc
.tfm
);
136 * Calculate the hmac and update security.evm xattr
138 * Expects to be called with i_mutex locked.
140 int evm_update_evmxattr(struct dentry
*dentry
, const char *xattr_name
,
141 const char *xattr_value
, size_t xattr_value_len
)
143 struct inode
*inode
= dentry
->d_inode
;
144 struct evm_ima_xattr_data xattr_data
;
147 rc
= evm_calc_hmac(dentry
, xattr_name
, xattr_value
,
148 xattr_value_len
, xattr_data
.digest
);
150 xattr_data
.type
= EVM_XATTR_HMAC
;
151 rc
= __vfs_setxattr_noperm(dentry
, XATTR_NAME_EVM
,
153 sizeof(xattr_data
), 0);
155 else if (rc
== -ENODATA
)
156 rc
= inode
->i_op
->removexattr(dentry
, XATTR_NAME_EVM
);
160 int evm_init_hmac(struct inode
*inode
, const struct xattr
*lsm_xattr
,
163 struct hash_desc desc
;
164 struct scatterlist sg
[1];
167 error
= init_desc(&desc
);
169 printk(KERN_INFO
"init_desc failed\n");
173 sg_init_one(sg
, lsm_xattr
->value
, lsm_xattr
->value_len
);
174 crypto_hash_update(&desc
, sg
, lsm_xattr
->value_len
);
175 hmac_add_misc(&desc
, inode
, hmac_val
);
176 crypto_free_hash(desc
.tfm
);
181 * Get the key from the TPM for the SHA1-HMAC
183 int evm_init_key(void)
186 struct encrypted_key_payload
*ekp
;
189 evm_key
= request_key(&key_type_encrypted
, EVMKEY
, NULL
);
193 down_read(&evm_key
->sem
);
194 ekp
= evm_key
->payload
.data
;
195 if (ekp
->decrypted_datalen
> MAX_KEY_SIZE
) {
199 memcpy(evmkey
, ekp
->decrypted_data
, ekp
->decrypted_datalen
);
201 /* burn the original key contents */
202 memset(ekp
->decrypted_data
, 0, ekp
->decrypted_datalen
);
203 up_read(&evm_key
->sem
);