1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (C) 2005-2010 IBM Corporation 4 * 5 * Authors: 6 * Mimi Zohar <zohar@us.ibm.com> 7 * Kylene Hall <kjhall@us.ibm.com> 8 * 9 * File: evm.h 10 */ 11 12 #ifndef __INTEGRITY_EVM_H 13 #define __INTEGRITY_EVM_H 14 15 #include <linux/xattr.h> 16 #include <linux/security.h> 17 18 #include "../integrity.h" 19 20 #define EVM_INIT_HMAC 0x0001 21 #define EVM_INIT_X509 0x0002 22 #define EVM_ALLOW_METADATA_WRITES 0x0004 23 #define EVM_SIGV3_REQUIRED 0x0008 24 #define EVM_SETUP_COMPLETE 0x80000000 /* userland has signaled key load */ 25 26 #define EVM_KEY_MASK (EVM_INIT_HMAC | EVM_INIT_X509) 27 #define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP_COMPLETE | \ 28 EVM_ALLOW_METADATA_WRITES | EVM_SIGV3_REQUIRED) 29 30 struct xattr_list { 31 struct list_head list; 32 char *name; 33 bool enabled; 34 }; 35 36 #define EVM_NEW_FILE 0x00000001 37 #define EVM_IMMUTABLE_DIGSIG 0x00000002 38 39 /* EVM integrity metadata associated with an inode */ 40 struct evm_iint_cache { 41 unsigned long flags; 42 enum integrity_status evm_status:4; 43 struct integrity_inode_attributes metadata_inode; 44 }; 45 46 extern struct lsm_blob_sizes evm_blob_sizes; 47 48 static inline struct evm_iint_cache *evm_iint_inode(const struct inode *inode) 49 { 50 if (unlikely(!inode->i_security)) 51 return NULL; 52 53 return inode->i_security + evm_blob_sizes.lbs_inode; 54 } 55 56 extern int evm_initialized; 57 58 #define EVM_ATTR_FSUUID 0x0001 59 60 extern int evm_hmac_attrs; 61 62 /* List of EVM protected security xattrs */ 63 extern struct list_head evm_config_xattrnames; 64 65 struct evm_digest { 66 struct ima_digest_data_hdr hdr; 67 char digest[IMA_MAX_DIGEST_SIZE]; 68 } __packed; 69 70 int evm_protected_xattr(const char *req_xattr_name); 71 72 int evm_init_key(void); 73 int evm_update_evmxattr(struct dentry *dentry, 74 const char *req_xattr_name, 75 const char *req_xattr_value, 76 size_t req_xattr_value_len); 77 int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, 78 const char *req_xattr_value, 79 size_t req_xattr_value_len, struct evm_digest *data, 80 struct evm_iint_cache *iint); 81 int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, 82 const char *req_xattr_value, 83 size_t req_xattr_value_len, char type, 84 struct evm_digest *data, struct evm_iint_cache *iint); 85 int evm_init_hmac(struct inode *inode, const struct xattr *xattrs, 86 char *hmac_val); 87 int evm_init_secfs(void); 88 89 #endif 90