security/apparmor/crypto.c

   1 /*
   2  * AppArmor security module
   3  *
   4  * This file contains AppArmor policy loading interface function definitions.
   5  *
   6  * Copyright 2013 Canonical Ltd.
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License as
  10  * published by the Free Software Foundation, version 2 of the
  11  * License.
  12  *
  13  * Fns to provide a checksum of policy that has been loaded this can be
  14  * compared to userspace policy compiles to check loaded policy is what
  15  * it should be.
  16  */
  17
  18 #include <crypto/hash.h>
  19
  20 #include "include/apparmor.h"
  21 #include "include/crypto.h"
  22
  23 static unsigned int apparmor_hash_size;
  24
  25 static struct crypto_shash *apparmor_tfm;
  26
  27 unsigned int aa_hash_size(void)
  28 {
  29         return apparmor_hash_size;
  30 }
  31
  32 char *aa_calc_hash(void *data, size_t len)
  33 {
  34         SHASH_DESC_ON_STACK(desc, apparmor_tfm);
  35         char *hash = NULL;
  36         int error = -ENOMEM;
  37
  38         if (!apparmor_tfm)
  39                 return NULL;
  40
  41         hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
  42         if (!hash)
  43                 goto fail;
  44
  45         desc->tfm = apparmor_tfm;
  46
  47         error = crypto_shash_init(desc);
  48         if (error)
  49                 goto fail;
  50         error = crypto_shash_update(desc, (u8 *) data, len);
  51         if (error)
  52                 goto fail;
  53         error = crypto_shash_final(desc, hash);
  54         if (error)
  55                 goto fail;
  56
  57         return hash;
  58
  59 fail:
  60         kfree(hash);
  61
  62         return ERR_PTR(error);
  63 }
  64
  65 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
  66                          size_t len)
  67 {
  68         SHASH_DESC_ON_STACK(desc, apparmor_tfm);
  69         int error = -ENOMEM;
  70         __le32 le32_version = cpu_to_le32(version);
  71
  72         if (!aa_g_hash_policy)
  73                 return 0;
  74
  75         if (!apparmor_tfm)
  76                 return 0;
  77
  78         profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
  79         if (!profile->hash)
  80                 goto fail;
  81
  82         desc->tfm = apparmor_tfm;
  83
  84         error = crypto_shash_init(desc);
  85         if (error)
  86                 goto fail;
  87         error = crypto_shash_update(desc, (u8 *) &le32_version, 4);
  88         if (error)
  89                 goto fail;
  90         error = crypto_shash_update(desc, (u8 *) start, len);
  91         if (error)
  92                 goto fail;
  93         error = crypto_shash_final(desc, profile->hash);
  94         if (error)
  95                 goto fail;
  96
  97         return 0;
  98
  99 fail:
 100         kfree(profile->hash);
 101         profile->hash = NULL;
 102
 103         return error;
 104 }
 105
 106 static int __init init_profile_hash(void)
 107 {
 108         struct crypto_shash *tfm;
 109
 110         if (!apparmor_initialized)
 111                 return 0;
 112
 113         tfm = crypto_alloc_shash("sha1", 0, 0);
 114         if (IS_ERR(tfm)) {
 115                 int error = PTR_ERR(tfm);
 116                 AA_ERROR("failed to setup profile sha1 hashing: %d\n", error);
 117                 return error;
 118         }
 119         apparmor_tfm = tfm;
 120         apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);
 121
 122         aa_info_message("AppArmor sha1 policy hashing enabled");
 123
 124         return 0;
 125 }
 126
 127 late_initcall(init_profile_hash);