diff options
| author | Dmitry Kasatkin <dmitry.kasatkin@intel.com> | 2011-09-01 13:41:40 +0200 |
|---|---|---|
| committer | Dmitry Kasatkin <dmitry.kasatkin@intel.com> | 2011-11-09 15:51:14 +0100 |
| commit | 15647eb3985ef30dfd657038924dc85c03026733 (patch) | |
| tree | 5d4629ef3b687ff56a446f42a8ee5aa35ec9322b /security/integrity/evm/evm.h | |
| parent | integrity: digital signature verification using multiple keyrings (diff) | |
| download | linux-15647eb3985ef30dfd657038924dc85c03026733.tar.xz linux-15647eb3985ef30dfd657038924dc85c03026733.zip | |
evm: digital signature verification support
This patch adds support for digital signature verification to EVM.
With this feature file metadata can be protected using digital
signature instead of an HMAC. When building an image,
which has to be flashed to different devices, an HMAC cannot
be used to sign file metadata, because the HMAC key should be
different on every device.
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Acked-by: Mimi Zohar <zohar@us.ibm.com>
Diffstat (limited to 'security/integrity/evm/evm.h')
| -rw-r--r-- | security/integrity/evm/evm.h | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h index d320f5197437..c885247ebcf7 100644 --- a/security/integrity/evm/evm.h +++ b/security/integrity/evm/evm.h @@ -12,14 +12,21 @@ * File: evm.h * */ + +#ifndef __INTEGRITY_EVM_H +#define __INTEGRITY_EVM_H + #include <linux/xattr.h> #include <linux/security.h> + #include "../integrity.h" extern int evm_initialized; extern char *evm_hmac; +extern char *evm_hash; extern struct crypto_shash *hmac_tfm; +extern struct crypto_shash *hash_tfm; /* List of EVM protected security xattrs */ extern char *evm_config_xattrnames[]; @@ -32,7 +39,12 @@ extern int evm_update_evmxattr(struct dentry *dentry, extern int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, const char *req_xattr_value, size_t req_xattr_value_len, char *digest); +extern int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, + const char *req_xattr_value, + size_t req_xattr_value_len, char *digest); extern int evm_init_hmac(struct inode *inode, const struct xattr *xattr, char *hmac_val); extern int evm_init_secfs(void); extern void evm_cleanup_secfs(void); + +#endif |