LXR linux/security/apparmor/crypto.c

   1/*
   2 * AppArmor security module
   3 *
   4 * This file contains AppArmor policy loading interface function definitions.
   5 *
   6 * Copyright 2013 Canonical Ltd.
   7 *
   8 * This program is free software; you can redistribute it and/or
   9 * modify it under the terms of the GNU General Public License as
  10 * published by the Free Software Foundation, version 2 of the
  11 * License.
  12 *
  13 * Fns to provide a checksum of policy that has been loaded this can be
  14 * compared to userspace policy compiles to check loaded policy is what
  15 * it should be.
  16 */
  17
  18#include <crypto/hash.h>
  19
  20#include "include/apparmor.h"
  21#include "include/crypto.h"
  22
  23static unsigned int apparmor_hash_size;
  24
  25static struct crypto_shash *apparmor_tfm;
  26
  27unsigned int aa_hash_size(void)
  28{
  29        return apparmor_hash_size;
  30}
  31
  32char *aa_calc_hash(void *data, size_t len)
  33{
  34        SHASH_DESC_ON_STACK(desc, apparmor_tfm);
  35        char *hash = NULL;
  36        int error = -ENOMEM;
  37
  38        if (!apparmor_tfm)
  39                return NULL;
  40
  41        hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
  42        if (!hash)
  43                goto fail;
  44
  45        desc->tfm = apparmor_tfm;
  46        desc->flags = 0;
  47
  48        error = crypto_shash_init(desc);
  49        if (error)
  50                goto fail;
  51        error = crypto_shash_update(desc, (u8 *) data, len);
  52        if (error)
  53                goto fail;
  54        error = crypto_shash_final(desc, hash);
  55        if (error)
  56                goto fail;
  57
  58        return hash;
  59
  60fail:
  61        kfree(hash);
  62
  63        return ERR_PTR(error);
  64}
  65
  66int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
  67                         size_t len)
  68{
  69        SHASH_DESC_ON_STACK(desc, apparmor_tfm);
  70        int error = -ENOMEM;
  71        __le32 le32_version = cpu_to_le32(version);
  72
  73        if (!aa_g_hash_policy)
  74                return 0;
  75
  76        if (!apparmor_tfm)
  77                return 0;
  78
  79        profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
  80        if (!profile->hash)
  81                goto fail;
  82
  83        desc->tfm = apparmor_tfm;
  84        desc->flags = 0;
  85
  86        error = crypto_shash_init(desc);
  87        if (error)
  88                goto fail;
  89        error = crypto_shash_update(desc, (u8 *) &le32_version, 4);
  90        if (error)
  91                goto fail;
  92        error = crypto_shash_update(desc, (u8 *) start, len);
  93        if (error)
  94                goto fail;
  95        error = crypto_shash_final(desc, profile->hash);
  96        if (error)
  97                goto fail;
  98
  99        return 0;
 100
 101fail:
 102        kfree(profile->hash);
 103        profile->hash = NULL;
 104
 105        return error;
 106}
 107
 108static int __init init_profile_hash(void)
 109{
 110        struct crypto_shash *tfm;
 111
 112        if (!apparmor_initialized)
 113                return 0;
 114
 115        tfm = crypto_alloc_shash("sha1", 0, CRYPTO_ALG_ASYNC);
 116        if (IS_ERR(tfm)) {
 117                int error = PTR_ERR(tfm);
 118                AA_ERROR("failed to setup profile sha1 hashing: %d\n", error);
 119                return error;
 120        }
 121        apparmor_tfm = tfm;
 122        apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);
 123
 124        aa_info_message("AppArmor sha1 policy hashing enabled");
 125
 126        return 0;
 127}
 128
 129late_initcall(init_profile_hash);
 130