74de668424
EVM uses the same key for all file systems to calculate the HMAC, making it possible to paste inodes from one file system on to another one, without EVM being able to detect it. To prevent such an attack, it is necessary to make the EVM HMAC file system specific. This patch uses the file system UUID, a file system unique identifier, to bind the EVM HMAC to the file system. The value inode->i_sb->s_uuid is used for the HMAC hash calculation, instead of using it for deriving the file system specific key. Initializing the key for every inode HMAC calculation is a bit more expensive operation than adding the uuid to the HMAC hash. Changing the HMAC calculation method or adding additional info to the calculation, requires existing EVM labeled file systems to be relabeled. This patch adds a Kconfig HMAC version option for backwards compatability. Changelog v1: - squash "hmac version setting" Changelog v0: - add missing Kconfig depends (Mimi) Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
51 lines
1.4 KiB
C
51 lines
1.4 KiB
C
/*
|
|
* Copyright (C) 2005-2010 IBM Corporation
|
|
*
|
|
* Authors:
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
* Kylene Hall <kjhall@us.ibm.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, version 2 of the License.
|
|
*
|
|
* File: evm.h
|
|
*
|
|
*/
|
|
|
|
#ifndef __INTEGRITY_EVM_H
|
|
#define __INTEGRITY_EVM_H
|
|
|
|
#include <linux/xattr.h>
|
|
#include <linux/security.h>
|
|
|
|
#include "../integrity.h"
|
|
|
|
extern int evm_initialized;
|
|
extern char *evm_hmac;
|
|
extern char *evm_hash;
|
|
extern int evm_hmac_version;
|
|
|
|
extern struct crypto_shash *hmac_tfm;
|
|
extern struct crypto_shash *hash_tfm;
|
|
|
|
/* List of EVM protected security xattrs */
|
|
extern char *evm_config_xattrnames[];
|
|
|
|
extern int evm_init_key(void);
|
|
extern int evm_update_evmxattr(struct dentry *dentry,
|
|
const char *req_xattr_name,
|
|
const char *req_xattr_value,
|
|
size_t req_xattr_value_len);
|
|
extern int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name,
|
|
const char *req_xattr_value,
|
|
size_t req_xattr_value_len, char *digest);
|
|
extern int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name,
|
|
const char *req_xattr_value,
|
|
size_t req_xattr_value_len, char *digest);
|
|
extern int evm_init_hmac(struct inode *inode, const struct xattr *xattr,
|
|
char *hmac_val);
|
|
extern int evm_init_secfs(void);
|
|
|
|
#endif
|