sysdeps/unix/sysv/linux/fips-private.h

   1 /* FIPS compliance status test for GNU/Linux systems.
   2    Copyright (C) 2012-2017 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 #ifndef _FIPS_PRIVATE_H
  20 #define _FIPS_PRIVATE_H
  21
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <stdlib.h>
  25 #include <unistd.h>
  26 #include <not-cancel.h>
  27 #include <stdbool.h>
  28
  29 /* Return true if FIPS mode is enabled.  See
  30    sysdeps/generic/fips-private.h for more information.  */
  31
  32 static bool
  33 fips_enabled_p (void)
  34 {
  35   static enum
  36   {
  37     FIPS_UNTESTED = 0,
  38     FIPS_ENABLED = 1,
  39     FIPS_DISABLED = -1,
  40     FIPS_TEST_FAILED = -2
  41   } checked;
  42
  43   if (checked == FIPS_UNTESTED)
  44     {
  45       int fd = open_not_cancel_2 ("/proc/sys/crypto/fips_enabled", O_RDONLY);
  46
  47       if (fd != -1)
  48         {
  49           /* This is more than enough, the file contains a single integer.  */
  50           char buf[32];
  51           ssize_t n;
  52           n = TEMP_FAILURE_RETRY (read_not_cancel (fd, buf, sizeof (buf) - 1));
  53           close_not_cancel_no_status (fd);
  54
  55           if (n > 0)
  56             {
  57               /* Terminate the string.  */
  58               buf[n] = '\0';
  59
  60               char *endp;
  61               long int res = strtol (buf, &endp, 10);
  62               if (endp != buf && (*endp == '\0' || *endp == '\n'))
  63                 checked = (res > 0) ? FIPS_ENABLED : FIPS_DISABLED;
  64             }
  65         }
  66
  67       if (checked == FIPS_UNTESTED)
  68         checked = FIPS_TEST_FAILED;
  69     }
  70
  71   return checked == FIPS_ENABLED;
  72 }
  73
  74 #endif /* _FIPS_PRIVATE_H */