diff options
| author | Matthew Garrett | 2018-06-08 23:57:43 +0200 |
|---|---|---|
| committer | Mimi Zohar | 2018-07-18 13:27:22 +0200 |
| commit | 5feeb61183dde9d4f4026fd0d5801388c21d61a2 (patch) | |
| tree | 6998490db3d17d7dffbfcc4d69d521c44f0fe8ac /security/integrity/evm/evm.h | |
| parent | evm: Don't deadlock if a crypto algorithm is unavailable (diff) | |
| download | kernel-qcow2-linux-5feeb61183dde9d4f4026fd0d5801388c21d61a2.tar.gz kernel-qcow2-linux-5feeb61183dde9d4f4026fd0d5801388c21d61a2.tar.xz kernel-qcow2-linux-5feeb61183dde9d4f4026fd0d5801388c21d61a2.zip | |
evm: Allow non-SHA1 digital signatures
SHA1 is reasonable in HMAC constructs, but it's desirable to be able to
use stronger hashes in digital signatures. Modify the EVM crypto code so
the hash type is imported from the digital signature and passed down to
the hash calculation code, and return the digest size to higher layers
for validation.
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'security/integrity/evm/evm.h')
| -rw-r--r-- | security/integrity/evm/evm.h | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h index 1257c3c24723..c3f437f5db10 100644 --- a/security/integrity/evm/evm.h +++ b/security/integrity/evm/evm.h @@ -47,6 +47,11 @@ extern struct crypto_shash *hash_tfm; /* List of EVM protected security xattrs */ extern struct list_head evm_config_xattrnames; +struct evm_digest { + struct ima_digest_data hdr; + char digest[IMA_MAX_DIGEST_SIZE]; +} __packed; + int evm_init_key(void); int evm_update_evmxattr(struct dentry *dentry, const char *req_xattr_name, @@ -54,10 +59,11 @@ int evm_update_evmxattr(struct dentry *dentry, size_t req_xattr_value_len); int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, const char *req_xattr_value, - size_t req_xattr_value_len, char *digest); + size_t req_xattr_value_len, struct evm_digest *data); int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, const char *req_xattr_value, - size_t req_xattr_value_len, char type, char *digest); + size_t req_xattr_value_len, char type, + struct evm_digest *data); int evm_init_hmac(struct inode *inode, const struct xattr *xattr, char *hmac_val); int evm_init_secfs(void); |