Commit 76266763 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar

evm: provide a function to set the EVM key from the kernel

A crypto HW kernel module can possibly initialize the EVM key from the
kernel __init code to enable EVM before calling the 'init' process.
This patch provides a function evm_set_key() to set the EVM key
directly without using the KEY subsystem.

Changes in v4:
* kernel-doc style for evm_set_key

Changes in v3:
* error reporting moved to evm_set_key
* EVM_INIT_HMAC moved to evm_set_key
* added bitop to prevent key setting race

Changes in v2:
* use size_t for key size instead of signed int
* provide EVM_MAX_KEY_SIZE macro in <linux/evm.h>
* provide EVM_MIN_KEY_SIZE macro in <linux/evm.h>
Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent 26ddabfe
...@@ -14,6 +14,7 @@ ...@@ -14,6 +14,7 @@
struct integrity_iint_cache; struct integrity_iint_cache;
#ifdef CONFIG_EVM #ifdef CONFIG_EVM
extern int evm_set_key(void *key, size_t keylen);
extern enum integrity_status evm_verifyxattr(struct dentry *dentry, extern enum integrity_status evm_verifyxattr(struct dentry *dentry,
const char *xattr_name, const char *xattr_name,
void *xattr_value, void *xattr_value,
...@@ -42,6 +43,12 @@ static inline int posix_xattr_acl(const char *xattrname) ...@@ -42,6 +43,12 @@ static inline int posix_xattr_acl(const char *xattrname)
} }
#endif #endif
#else #else
static inline int evm_set_key(void *key, size_t keylen)
{
return -EOPNOTSUPP;
}
#ifdef CONFIG_INTEGRITY #ifdef CONFIG_INTEGRITY
static inline enum integrity_status evm_verifyxattr(struct dentry *dentry, static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
const char *xattr_name, const char *xattr_name,
......
...@@ -18,6 +18,7 @@ ...@@ -18,6 +18,7 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/crypto.h> #include <linux/crypto.h>
#include <linux/xattr.h> #include <linux/xattr.h>
#include <linux/evm.h>
#include <keys/encrypted-type.h> #include <keys/encrypted-type.h>
#include <crypto/hash.h> #include <crypto/hash.h>
#include "evm.h" #include "evm.h"
...@@ -32,6 +33,44 @@ struct crypto_shash *hash_tfm; ...@@ -32,6 +33,44 @@ struct crypto_shash *hash_tfm;
static DEFINE_MUTEX(mutex); static DEFINE_MUTEX(mutex);
#define EVM_SET_KEY_BUSY 0
static unsigned long evm_set_key_flags;
/**
* evm_set_key() - set EVM HMAC key from the kernel
* @key: pointer to a buffer with the key data
* @size: length of the key data
*
* This function allows setting the EVM HMAC key from the kernel
* without using the "encrypted" key subsystem keys. It can be used
* by the crypto HW kernel module which has its own way of managing
* keys.
*
* key length should be between 32 and 128 bytes long
*/
int evm_set_key(void *key, size_t keylen)
{
int rc;
rc = -EBUSY;
if (test_and_set_bit(EVM_SET_KEY_BUSY, &evm_set_key_flags))
goto busy;
rc = -EINVAL;
if (keylen > MAX_KEY_SIZE)
goto inval;
memcpy(evmkey, key, keylen);
evm_initialized |= EVM_INIT_HMAC;
pr_info("key initialized\n");
return 0;
inval:
clear_bit(EVM_SET_KEY_BUSY, &evm_set_key_flags);
busy:
pr_err("key initialization failed\n");
return rc;
}
EXPORT_SYMBOL_GPL(evm_set_key);
static struct shash_desc *init_desc(char type) static struct shash_desc *init_desc(char type)
{ {
long rc; long rc;
...@@ -244,7 +283,7 @@ int evm_init_key(void) ...@@ -244,7 +283,7 @@ int evm_init_key(void)
{ {
struct key *evm_key; struct key *evm_key;
struct encrypted_key_payload *ekp; struct encrypted_key_payload *ekp;
int rc = 0; int rc;
evm_key = request_key(&key_type_encrypted, EVMKEY, NULL); evm_key = request_key(&key_type_encrypted, EVMKEY, NULL);
if (IS_ERR(evm_key)) if (IS_ERR(evm_key))
...@@ -252,12 +291,9 @@ int evm_init_key(void) ...@@ -252,12 +291,9 @@ int evm_init_key(void)
down_read(&evm_key->sem); down_read(&evm_key->sem);
ekp = evm_key->payload.data[0]; ekp = evm_key->payload.data[0];
if (ekp->decrypted_datalen > MAX_KEY_SIZE) {
rc = -EINVAL; rc = evm_set_key(ekp->decrypted_data, ekp->decrypted_datalen);
goto out;
}
memcpy(evmkey, ekp->decrypted_data, ekp->decrypted_datalen);
out:
/* burn the original key contents */ /* burn the original key contents */
memset(ekp->decrypted_data, 0, ekp->decrypted_datalen); memset(ekp->decrypted_data, 0, ekp->decrypted_datalen);
up_read(&evm_key->sem); up_read(&evm_key->sem);
......
...@@ -62,7 +62,7 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, ...@@ -62,7 +62,7 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
char temp[80]; char temp[80];
int i, error; int i;
if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_INIT_HMAC)) if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_INIT_HMAC))
return -EPERM; return -EPERM;
...@@ -78,12 +78,8 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, ...@@ -78,12 +78,8 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf,
if ((sscanf(temp, "%d", &i) != 1) || (i != 1)) if ((sscanf(temp, "%d", &i) != 1) || (i != 1))
return -EINVAL; return -EINVAL;
error = evm_init_key(); evm_init_key();
if (!error) {
evm_initialized |= EVM_INIT_HMAC;
pr_info("initialized\n");
} else
pr_err("initialization failed\n");
return count; return count;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment