1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * Copyright (C) 2005-2010 IBM Corporation 4 * 5 * Authors: 6 * Mimi Zohar <zohar@us.ibm.com> 7 * Kylene Hall <kjhall@us.ibm.com> 8 * 9 * File: evm.h 10 */ 11 12#ifndef __INTEGRITY_EVM_H 13#define __INTEGRITY_EVM_H 14 15#include <linux/xattr.h> 16#include <linux/security.h> 17 18#include "../integrity.h" 19 20#define EVM_INIT_HMAC 0x0001 21#define EVM_INIT_X509 0x0002 22#define EVM_ALLOW_METADATA_WRITES 0x0004 23#define EVM_SETUP_COMPLETE 0x80000000 /* userland has signaled key load */ 24 25#define EVM_KEY_MASK (EVM_INIT_HMAC | EVM_INIT_X509) 26#define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP_COMPLETE | \ 27 EVM_ALLOW_METADATA_WRITES) 28 29struct xattr_list { 30 struct list_head list; 31 char *name; 32 bool enabled; 33}; 34 35#define EVM_NEW_FILE 0x00000001 36#define EVM_IMMUTABLE_DIGSIG 0x00000002 37 38/* EVM integrity metadata associated with an inode */ 39struct evm_iint_cache { 40 unsigned long flags; 41 enum integrity_status evm_status:4; 42}; 43 44extern struct lsm_blob_sizes evm_blob_sizes; 45 46static inline struct evm_iint_cache *evm_iint_inode(const struct inode *inode) 47{ 48 if (unlikely(!inode->i_security)) 49 return NULL; 50 51 return inode->i_security + evm_blob_sizes.lbs_inode; 52} 53 54extern int evm_initialized; 55 56#define EVM_ATTR_FSUUID 0x0001 57 58extern int evm_hmac_attrs; 59 60/* List of EVM protected security xattrs */ 61extern struct list_head evm_config_xattrnames; 62 63struct evm_digest { 64 struct ima_digest_data hdr; 65 char digest[IMA_MAX_DIGEST_SIZE]; 66} __packed; 67 68int evm_protected_xattr(const char *req_xattr_name); 69 70int evm_init_key(void); 71int evm_update_evmxattr(struct dentry *dentry, 72 const char *req_xattr_name, 73 const char *req_xattr_value, 74 size_t req_xattr_value_len); 75int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, 76 const char *req_xattr_value, 77 size_t req_xattr_value_len, struct evm_digest *data); 78int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, 79 const char *req_xattr_value, 80 size_t req_xattr_value_len, char type, 81 struct evm_digest *data); 82int evm_init_hmac(struct inode *inode, const struct xattr *xattrs, 83 char *hmac_val); 84int evm_init_secfs(void); 85 86#endif 87