1*4882a593Smuzhiyun /* SPDX-License-Identifier: GPL-2.0-only */ 2*4882a593Smuzhiyun /* 3*4882a593Smuzhiyun * Copyright (C) 2005-2010 IBM Corporation 4*4882a593Smuzhiyun * 5*4882a593Smuzhiyun * Authors: 6*4882a593Smuzhiyun * Mimi Zohar <zohar@us.ibm.com> 7*4882a593Smuzhiyun * Kylene Hall <kjhall@us.ibm.com> 8*4882a593Smuzhiyun * 9*4882a593Smuzhiyun * File: evm.h 10*4882a593Smuzhiyun */ 11*4882a593Smuzhiyun 12*4882a593Smuzhiyun #ifndef __INTEGRITY_EVM_H 13*4882a593Smuzhiyun #define __INTEGRITY_EVM_H 14*4882a593Smuzhiyun 15*4882a593Smuzhiyun #include <linux/xattr.h> 16*4882a593Smuzhiyun #include <linux/security.h> 17*4882a593Smuzhiyun 18*4882a593Smuzhiyun #include "../integrity.h" 19*4882a593Smuzhiyun 20*4882a593Smuzhiyun #define EVM_INIT_HMAC 0x0001 21*4882a593Smuzhiyun #define EVM_INIT_X509 0x0002 22*4882a593Smuzhiyun #define EVM_ALLOW_METADATA_WRITES 0x0004 23*4882a593Smuzhiyun #define EVM_SETUP_COMPLETE 0x80000000 /* userland has signaled key load */ 24*4882a593Smuzhiyun 25*4882a593Smuzhiyun #define EVM_KEY_MASK (EVM_INIT_HMAC | EVM_INIT_X509) 26*4882a593Smuzhiyun #define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP_COMPLETE | \ 27*4882a593Smuzhiyun EVM_ALLOW_METADATA_WRITES) 28*4882a593Smuzhiyun 29*4882a593Smuzhiyun struct xattr_list { 30*4882a593Smuzhiyun struct list_head list; 31*4882a593Smuzhiyun char *name; 32*4882a593Smuzhiyun }; 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun extern int evm_initialized; 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun #define EVM_ATTR_FSUUID 0x0001 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun extern int evm_hmac_attrs; 39*4882a593Smuzhiyun 40*4882a593Smuzhiyun extern struct crypto_shash *hmac_tfm; 41*4882a593Smuzhiyun extern struct crypto_shash *hash_tfm; 42*4882a593Smuzhiyun 43*4882a593Smuzhiyun /* List of EVM protected security xattrs */ 44*4882a593Smuzhiyun extern struct list_head evm_config_xattrnames; 45*4882a593Smuzhiyun 46*4882a593Smuzhiyun struct evm_digest { 47*4882a593Smuzhiyun struct ima_digest_data hdr; 48*4882a593Smuzhiyun char digest[IMA_MAX_DIGEST_SIZE]; 49*4882a593Smuzhiyun } __packed; 50*4882a593Smuzhiyun 51*4882a593Smuzhiyun int evm_init_key(void); 52*4882a593Smuzhiyun int evm_update_evmxattr(struct dentry *dentry, 53*4882a593Smuzhiyun const char *req_xattr_name, 54*4882a593Smuzhiyun const char *req_xattr_value, 55*4882a593Smuzhiyun size_t req_xattr_value_len); 56*4882a593Smuzhiyun int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, 57*4882a593Smuzhiyun const char *req_xattr_value, 58*4882a593Smuzhiyun size_t req_xattr_value_len, struct evm_digest *data); 59*4882a593Smuzhiyun int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, 60*4882a593Smuzhiyun const char *req_xattr_value, 61*4882a593Smuzhiyun size_t req_xattr_value_len, char type, 62*4882a593Smuzhiyun struct evm_digest *data); 63*4882a593Smuzhiyun int evm_init_hmac(struct inode *inode, const struct xattr *xattr, 64*4882a593Smuzhiyun char *hmac_val); 65*4882a593Smuzhiyun int evm_init_secfs(void); 66*4882a593Smuzhiyun 67*4882a593Smuzhiyun #endif 68