2 * Copyright (C) 2005-2010 IBM Corporation
5 * Mimi Zohar <zohar@us.ibm.com>
6 * Kylene Hall <kjhall@us.ibm.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation, version 2 of the License.
13 * Using root's kernel master key (kmk), calculate the HMAC
16 #include <linux/module.h>
17 #include <linux/crypto.h>
18 #include <linux/xattr.h>
19 #include <keys/encrypted-type.h>
20 #include <crypto/hash.h>
23 #define EVMKEY "evm-key"
24 #define MAX_KEY_SIZE 128
25 static unsigned char evmkey
[MAX_KEY_SIZE
];
26 static int evmkey_len
= MAX_KEY_SIZE
;
28 struct crypto_shash
*hmac_tfm
;
29 struct crypto_shash
*hash_tfm
;
31 static struct shash_desc
*init_desc(const char type
)
35 struct crypto_shash
**tfm
;
36 struct shash_desc
*desc
;
38 if (type
== EVM_XATTR_HMAC
) {
47 *tfm
= crypto_alloc_shash(algo
, 0, CRYPTO_ALG_ASYNC
);
49 pr_err("Can not allocate %s (reason: %ld)\n",
55 if (type
== EVM_XATTR_HMAC
) {
56 rc
= crypto_shash_setkey(*tfm
, evmkey
, evmkey_len
);
58 crypto_free_shash(*tfm
);
65 desc
= kmalloc(sizeof(*desc
) + crypto_shash_descsize(*tfm
),
68 return ERR_PTR(-ENOMEM
);
71 desc
->flags
= CRYPTO_TFM_REQ_MAY_SLEEP
;
73 rc
= crypto_shash_init(desc
);
81 /* Protect against 'cutting & pasting' security.evm xattr, include inode
84 * (Additional directory/file metadata needs to be added for more complete
87 static void hmac_add_misc(struct shash_desc
*desc
, struct inode
*inode
,
98 memset(&hmac_misc
, 0, sizeof hmac_misc
);
99 hmac_misc
.ino
= inode
->i_ino
;
100 hmac_misc
.generation
= inode
->i_generation
;
101 hmac_misc
.uid
= inode
->i_uid
;
102 hmac_misc
.gid
= inode
->i_gid
;
103 hmac_misc
.mode
= inode
->i_mode
;
104 crypto_shash_update(desc
, (const u8
*)&hmac_misc
, sizeof hmac_misc
);
105 crypto_shash_final(desc
, digest
);
109 * Calculate the HMAC value across the set of protected security xattrs.
111 * Instead of retrieving the requested xattr, for performance, calculate
112 * the hmac using the requested xattr value. Don't alloc/free memory for
113 * each xattr, but attempt to re-use the previously allocated memory.
115 static int evm_calc_hmac_or_hash(struct dentry
*dentry
,
116 const char *req_xattr_name
,
117 const char *req_xattr_value
,
118 size_t req_xattr_value_len
,
119 char type
, char *digest
)
121 struct inode
*inode
= dentry
->d_inode
;
122 struct shash_desc
*desc
;
124 size_t xattr_size
= 0;
125 char *xattr_value
= NULL
;
129 if (!inode
->i_op
|| !inode
->i_op
->getxattr
)
131 desc
= init_desc(type
);
133 return PTR_ERR(desc
);
136 for (xattrname
= evm_config_xattrnames
; *xattrname
!= NULL
; xattrname
++) {
137 if ((req_xattr_name
&& req_xattr_value
)
138 && !strcmp(*xattrname
, req_xattr_name
)) {
140 crypto_shash_update(desc
, (const u8
*)req_xattr_value
,
141 req_xattr_value_len
);
144 size
= vfs_getxattr_alloc(dentry
, *xattrname
,
145 &xattr_value
, xattr_size
, GFP_NOFS
);
146 if (size
== -ENOMEM
) {
155 crypto_shash_update(desc
, (const u8
*)xattr_value
, xattr_size
);
157 hmac_add_misc(desc
, inode
, digest
);
165 int evm_calc_hmac(struct dentry
*dentry
, const char *req_xattr_name
,
166 const char *req_xattr_value
, size_t req_xattr_value_len
,
169 return evm_calc_hmac_or_hash(dentry
, req_xattr_name
, req_xattr_value
,
170 req_xattr_value_len
, EVM_XATTR_HMAC
, digest
);
173 int evm_calc_hash(struct dentry
*dentry
, const char *req_xattr_name
,
174 const char *req_xattr_value
, size_t req_xattr_value_len
,
177 return evm_calc_hmac_or_hash(dentry
, req_xattr_name
, req_xattr_value
,
178 req_xattr_value_len
, IMA_XATTR_DIGEST
, digest
);
182 * Calculate the hmac and update security.evm xattr
184 * Expects to be called with i_mutex locked.
186 int evm_update_evmxattr(struct dentry
*dentry
, const char *xattr_name
,
187 const char *xattr_value
, size_t xattr_value_len
)
189 struct inode
*inode
= dentry
->d_inode
;
190 struct evm_ima_xattr_data xattr_data
;
193 rc
= evm_calc_hmac(dentry
, xattr_name
, xattr_value
,
194 xattr_value_len
, xattr_data
.digest
);
196 xattr_data
.type
= EVM_XATTR_HMAC
;
197 rc
= __vfs_setxattr_noperm(dentry
, XATTR_NAME_EVM
,
199 sizeof(xattr_data
), 0);
201 else if (rc
== -ENODATA
)
202 rc
= inode
->i_op
->removexattr(dentry
, XATTR_NAME_EVM
);
206 int evm_init_hmac(struct inode
*inode
, const struct xattr
*lsm_xattr
,
209 struct shash_desc
*desc
;
211 desc
= init_desc(EVM_XATTR_HMAC
);
213 printk(KERN_INFO
"init_desc failed\n");
214 return PTR_ERR(desc
);
217 crypto_shash_update(desc
, lsm_xattr
->value
, lsm_xattr
->value_len
);
218 hmac_add_misc(desc
, inode
, hmac_val
);
224 * Get the key from the TPM for the SHA1-HMAC
226 int evm_init_key(void)
229 struct encrypted_key_payload
*ekp
;
232 evm_key
= request_key(&key_type_encrypted
, EVMKEY
, NULL
);
236 down_read(&evm_key
->sem
);
237 ekp
= evm_key
->payload
.data
;
238 if (ekp
->decrypted_datalen
> MAX_KEY_SIZE
) {
242 memcpy(evmkey
, ekp
->decrypted_data
, ekp
->decrypted_datalen
);
244 /* burn the original key contents */
245 memset(ekp
->decrypted_data
, 0, ekp
->decrypted_datalen
);
246 up_read(&evm_key
->sem
);