ima: Introduce ima_get_current_hash_algo()
authorRoberto Sassu <roberto.sassu@huawei.com>
Fri, 23 Jul 2021 08:53:02 +0000 (10:53 +0200)
committerMimi Zohar <zohar@linux.ibm.com>
Fri, 23 Jul 2021 13:25:28 +0000 (09:25 -0400)
commit5d1ef2ce13a9098b4e0d31c50e4c79763a57b444
tree1415f5cd4b9ff5546c5e6c0c9fdfc897c2bd797e
parenta32ad90426a9c8eb3915eed26e08ce133bd9e0da
ima: Introduce ima_get_current_hash_algo()

Buffer measurements, unlike file measurements, are not accessible after the
measurement is done, as buffers are not suitable for use with the
integrity_iint_cache structure (there is no index, for files it is the
inode number). In the subsequent patches, the measurement (digest) will be
returned directly by the functions that perform the buffer measurement,
ima_measure_critical_data() and process_buffer_measurement().

A caller of those functions also needs to know the algorithm used to
calculate the digest. Instead of adding the algorithm as a new parameter to
the functions, this patch provides it separately with the new function
ima_get_current_hash_algo().

Since the hash algorithm does not change after the IMA setup phase, there
is no risk of races (obtaining a digest calculated with a different
algorithm than the one returned).

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
[zohar@linux.ibm.com: annotate ima_hash_algo as __ro_after_init]
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
include/linux/ima.h
security/integrity/ima/ima_main.c