evm: add support for different security.evm data types
authorDmitry Kasatkin <dmitry.kasatkin@nokia.com>
Wed, 9 Mar 2011 19:28:20 +0000 (14:28 -0500)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Mon, 18 Jul 2011 16:29:41 +0000 (12:29 -0400)
commit6be5cc5246f807fd8ede9f5f1bb2826f2c598658
tree00fc342eb91fb50df4e8eddfe2a7294b27df8117
parent66dbc325afcef909043c30e90930a36823fc734c
evm: add support for different security.evm data types

EVM protects a file's security extended attributes(xattrs) against integrity
attacks. The current patchset maintains an HMAC-sha1 value across the security
xattrs, storing the value as the extended attribute 'security.evm'. We
anticipate other methods for protecting the security extended attributes.
This patch reserves the first byte of 'security.evm' as a place holder for
the type of method.

Changelog v6:
- move evm_ima_xattr_type definition to security/integrity/integrity.h
- defined a structure for the EVM xattr called evm_ima_xattr_data
  (based on Serge Hallyn's suggestion)
- removed unnecessary memset

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@nokia.com>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
include/linux/integrity.h
security/integrity/evm/evm_crypto.c
security/integrity/evm/evm_main.c
security/integrity/integrity.h