security/integrity/integrity.h

   1 /*
   2  * Copyright (C) 2009-2010 IBM Corporation
   3  *
   4  * Authors:
   5  * Mimi Zohar <zohar@us.ibm.com>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation, version 2 of the
  10  * License.
  11  *
  12  */
  13
  14 #include <linux/types.h>
  15 #include <linux/integrity.h>
  16 #include <crypto/sha.h>
  17
  18 /* iint action cache flags */
  19 #define IMA_MEASURE             0x0001
  20 #define IMA_MEASURED            0x0002
  21 #define IMA_APPRAISE            0x0004
  22 #define IMA_APPRAISED           0x0008
  23 /*#define IMA_COLLECT           0x0010  do not use this flag */
  24 #define IMA_COLLECTED           0x0020
  25 #define IMA_AUDIT               0x0040
  26 #define IMA_AUDITED             0x0080
  27
  28 /* iint cache flags */
  29 #define IMA_ACTION_FLAGS        0xff00
  30 #define IMA_DIGSIG              0x0100
  31 #define IMA_DIGSIG_REQUIRED     0x0200
  32
  33 #define IMA_DO_MASK             (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT)
  34 #define IMA_DONE_MASK           (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED \
  35                                  | IMA_COLLECTED)
  36
  37 enum evm_ima_xattr_type {
  38         IMA_XATTR_DIGEST = 0x01,
  39         EVM_XATTR_HMAC,
  40         EVM_IMA_XATTR_DIGSIG,
  41 };
  42
  43 struct evm_ima_xattr_data {
  44         u8 type;
  45         u8 digest[SHA1_DIGEST_SIZE];
  46 }  __attribute__((packed));
  47
  48 /* integrity data associated with an inode */
  49 struct integrity_iint_cache {
  50         struct rb_node rb_node; /* rooted in integrity_iint_tree */
  51         struct inode *inode;    /* back pointer to inode in question */
  52         u64 version;            /* track inode changes */
  53         unsigned short flags;
  54         struct evm_ima_xattr_data ima_xattr;
  55         enum integrity_status ima_status:4;
  56         enum integrity_status evm_status:4;
  57 };
  58
  59 /* rbtree tree calls to lookup, insert, delete
  60  * integrity data associated with an inode.
  61  */
  62 struct integrity_iint_cache *integrity_iint_insert(struct inode *inode);
  63 struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
  64
  65 #define INTEGRITY_KEYRING_EVM           0
  66 #define INTEGRITY_KEYRING_MODULE        1
  67 #define INTEGRITY_KEYRING_IMA           2
  68 #define INTEGRITY_KEYRING_MAX           3
  69
  70 #ifdef CONFIG_INTEGRITY_SIGNATURE
  71
  72 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
  73                                         const char *digest, int digestlen);
  74
  75 #else
  76
  77 static inline int integrity_digsig_verify(const unsigned int id,
  78                                           const char *sig, int siglen,
  79                                           const char *digest, int digestlen)
  80 {
  81         return -EOPNOTSUPP;
  82 }
  83
  84 #endif /* CONFIG_INTEGRITY_SIGNATURE */
  85
  86 /* set during initialization */
  87 extern int iint_initialized;