Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76266763 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar
Browse files

evm: provide a function to set the EVM key from the kernel 



A crypto HW kernel module can possibly initialize the EVM key from the
kernel __init code to enable EVM before calling the 'init' process.
This patch provides a function evm_set_key() to set the EVM key
directly without using the KEY subsystem.

Changes in v4:
* kernel-doc style for evm_set_key

Changes in v3:
* error reporting moved to evm_set_key
* EVM_INIT_HMAC moved to evm_set_key
* added bitop to prevent key setting race

Changes in v2:
* use size_t for key size instead of signed int
* provide EVM_MAX_KEY_SIZE macro in <linux/evm.h>
* provide EVM_MIN_KEY_SIZE macro in <linux/evm.h>

Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent 26ddabfe

include/linux/evm.h

+7 −0
Original line number Original line Diff line number Diff line
@@ -14,6 +14,7 @@ 
struct integrity_iint_cache;

struct integrity_iint_cache;





#ifdef CONFIG_EVM

#ifdef CONFIG_EVM

extern int evm_set_key(void *key, size_t keylen);

extern enum integrity_status evm_verifyxattr(struct dentry *dentry,

extern enum integrity_status evm_verifyxattr(struct dentry *dentry,

					     const char *xattr_name,

					     const char *xattr_name,

					     void *xattr_value,

					     void *xattr_value,
@@ -42,6 +43,12 @@ static inline int posix_xattr_acl(const char *xattrname) 
}

}

#endif

#endif

#else

#else



static inline int evm_set_key(void *key, size_t keylen)

{

	return -EOPNOTSUPP;

}



#ifdef CONFIG_INTEGRITY

#ifdef CONFIG_INTEGRITY

static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,

static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,

						    const char *xattr_name,

						    const char *xattr_name,

security/integrity/evm/evm_crypto.c

+43 −7
Original line number Original line Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <linux/module.h>

#include <linux/module.h>

#include <linux/crypto.h>

#include <linux/crypto.h>

#include <linux/xattr.h>

#include <linux/xattr.h>

#include <linux/evm.h>

#include <keys/encrypted-type.h>

#include <keys/encrypted-type.h>

#include <crypto/hash.h>

#include <crypto/hash.h>

#include "evm.h"

#include "evm.h"
@@ -32,6 +33,44 @@ struct crypto_shash *hash_tfm; 




static DEFINE_MUTEX(mutex);

static DEFINE_MUTEX(mutex);





#define EVM_SET_KEY_BUSY 0



static unsigned long evm_set_key_flags;



/**

 * evm_set_key() - set EVM HMAC key from the kernel

 * @key: pointer to a buffer with the key data

 * @size: length of the key data

 *

 * This function allows setting the EVM HMAC key from the kernel

 * without using the "encrypted" key subsystem keys. It can be used

 * by the crypto HW kernel module which has its own way of managing

 * keys.

 *

 * key length should be between 32 and 128 bytes long

 */

int evm_set_key(void *key, size_t keylen)

{

	int rc;



	rc = -EBUSY;

	if (test_and_set_bit(EVM_SET_KEY_BUSY, &evm_set_key_flags))

		goto busy;

	rc = -EINVAL;

	if (keylen > MAX_KEY_SIZE)

		goto inval;

	memcpy(evmkey, key, keylen);

	evm_initialized |= EVM_INIT_HMAC;

	pr_info("key initialized\n");

	return 0;

inval:

	clear_bit(EVM_SET_KEY_BUSY, &evm_set_key_flags);

busy:

	pr_err("key initialization failed\n");

	return rc;

}

EXPORT_SYMBOL_GPL(evm_set_key);



static struct shash_desc *init_desc(char type)

static struct shash_desc *init_desc(char type)

{

{

	long rc;

	long rc;
@@ -244,7 +283,7 @@ int evm_init_key(void) 
{

{

	struct key *evm_key;

	struct key *evm_key;

	struct encrypted_key_payload *ekp;

	struct encrypted_key_payload *ekp;

	int rc = 0;

	int rc;





	evm_key = request_key(&key_type_encrypted, EVMKEY, NULL);

	evm_key = request_key(&key_type_encrypted, EVMKEY, NULL);

	if (IS_ERR(evm_key))

	if (IS_ERR(evm_key))
@@ -252,12 +291,9 @@ int evm_init_key(void) 




	down_read(&evm_key->sem);

	down_read(&evm_key->sem);

	ekp = evm_key->payload.data[0];

	ekp = evm_key->payload.data[0];

	if (ekp->decrypted_datalen > MAX_KEY_SIZE) {



		rc = -EINVAL;

	rc = evm_set_key(ekp->decrypted_data, ekp->decrypted_datalen);

		goto out;



	}

	memcpy(evmkey, ekp->decrypted_data, ekp->decrypted_datalen);

out:

	/* burn the original key contents */

	/* burn the original key contents */

	memset(ekp->decrypted_data, 0, ekp->decrypted_datalen);

	memset(ekp->decrypted_data, 0, ekp->decrypted_datalen);

	up_read(&evm_key->sem);

	up_read(&evm_key->sem);

security/integrity/evm/evm_secfs.c

+3 −7
Original line number Original line Diff line number Diff line
@@ -62,7 +62,7 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, 
			     size_t count, loff_t *ppos)

			     size_t count, loff_t *ppos)

{

{

	char temp[80];

	char temp[80];

	int i, error;

	int i;





	if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_INIT_HMAC))

	if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_INIT_HMAC))

		return -EPERM;

		return -EPERM;
@@ -78,12 +78,8 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, 
	if ((sscanf(temp, "%d", &i) != 1) || (i != 1))

	if ((sscanf(temp, "%d", &i) != 1) || (i != 1))

		return -EINVAL;

		return -EINVAL;





	error = evm_init_key();

	evm_init_key();

	if (!error) {



		evm_initialized |= EVM_INIT_HMAC;

		pr_info("initialized\n");

	} else

		pr_err("initialization failed\n");

	return count;

	return count;

}

}