security/integrity/integrity.h

   1 /*
   2  * Copyright (C) 2009-2010 IBM Corporation
   3  *
   4  * Authors:
   5  * Mimi Zohar <zohar@us.ibm.com>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation, version 2 of the
  10  * License.
  11  *
  12  */
  13
  14 #include <linux/types.h>
  15 #include <linux/integrity.h>
  16 #include <crypto/sha.h>
  17
  18 /* iint cache flags */
  19 #define IMA_MEASURE             0x01
  20 #define IMA_MEASURED            0x02
  21 #define IMA_APPRAISE            0x04
  22 #define IMA_APPRAISED           0x08
  23 #define IMA_COLLECTED           0x10
  24
  25 enum evm_ima_xattr_type {
  26         IMA_XATTR_DIGEST = 0x01,
  27         EVM_XATTR_HMAC,
  28         EVM_IMA_XATTR_DIGSIG,
  29 };
  30
  31 struct evm_ima_xattr_data {
  32         u8 type;
  33         u8 digest[SHA1_DIGEST_SIZE];
  34 }  __attribute__((packed));
  35
  36 /* integrity data associated with an inode */
  37 struct integrity_iint_cache {
  38         struct rb_node rb_node; /* rooted in integrity_iint_tree */
  39         struct inode *inode;    /* back pointer to inode in question */
  40         u64 version;            /* track inode changes */
  41         unsigned char flags;
  42         struct evm_ima_xattr_data ima_xattr;
  43         enum integrity_status ima_status;
  44         enum integrity_status evm_status;
  45 };
  46
  47 /* rbtree tree calls to lookup, insert, delete
  48  * integrity data associated with an inode.
  49  */
  50 struct integrity_iint_cache *integrity_iint_insert(struct inode *inode);
  51 struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
  52
  53 #define INTEGRITY_KEYRING_EVM           0
  54 #define INTEGRITY_KEYRING_MODULE        1
  55 #define INTEGRITY_KEYRING_IMA           2
  56 #define INTEGRITY_KEYRING_MAX           3
  57
  58 #ifdef CONFIG_INTEGRITY_SIGNATURE
  59
  60 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
  61                                         const char *digest, int digestlen);
  62
  63 #else
  64
  65 static inline int integrity_digsig_verify(const unsigned int id,
  66                                           const char *sig, int siglen,
  67                                           const char *digest, int digestlen)
  68 {
  69         return -EOPNOTSUPP;
  70 }
  71
  72 #endif /* CONFIG_INTEGRITY_SIGNATURE */
  73
  74 /* set during initialization */
  75 extern int iint_initialized;