1 /* 2 * Copyright (C) 2009-2010 IBM Corporation 3 * 4 * Authors: 5 * Mimi Zohar <zohar@us.ibm.com> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License as 9 * published by the Free Software Foundation, version 2 of the 10 * License. 11 * 12 */ 13 14 #include <linux/types.h> 15 #include <linux/integrity.h> 16 #include <crypto/sha.h> 17 18 /* iint cache flags */ 19 #define IMA_MEASURE 0x01 20 #define IMA_MEASURED 0x02 21 #define IMA_APPRAISE 0x04 22 #define IMA_APPRAISED 0x08 23 #define IMA_COLLECTED 0x10 24 25 enum evm_ima_xattr_type { 26 IMA_XATTR_DIGEST = 0x01, 27 EVM_XATTR_HMAC, 28 EVM_IMA_XATTR_DIGSIG, 29 }; 30 31 struct evm_ima_xattr_data { 32 u8 type; 33 u8 digest[SHA1_DIGEST_SIZE]; 34 } __attribute__((packed)); 35 36 /* integrity data associated with an inode */ 37 struct integrity_iint_cache { 38 struct rb_node rb_node; /* rooted in integrity_iint_tree */ 39 struct inode *inode; /* back pointer to inode in question */ 40 u64 version; /* track inode changes */ 41 unsigned char flags; 42 u8 digest[SHA1_DIGEST_SIZE]; 43 enum integrity_status ima_status; 44 enum integrity_status evm_status; 45 }; 46 47 /* rbtree tree calls to lookup, insert, delete 48 * integrity data associated with an inode. 49 */ 50 struct integrity_iint_cache *integrity_iint_insert(struct inode *inode); 51 struct integrity_iint_cache *integrity_iint_find(struct inode *inode); 52 53 #define INTEGRITY_KEYRING_EVM 0 54 #define INTEGRITY_KEYRING_MODULE 1 55 #define INTEGRITY_KEYRING_IMA 2 56 #define INTEGRITY_KEYRING_MAX 3 57 58 #ifdef CONFIG_INTEGRITY_SIGNATURE 59 60 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, 61 const char *digest, int digestlen); 62 63 #else 64 65 static inline int integrity_digsig_verify(const unsigned int id, 66 const char *sig, int siglen, 67 const char *digest, int digestlen) 68 { 69 return -EOPNOTSUPP; 70 } 71 72 #endif /* CONFIG_INTEGRITY_SIGNATURE */ 73 74 /* set during initialization */ 75 extern int iint_initialized; 76