Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1254103

[PATCHv3 5/6] evm: define EVM key max and min sizes

Show all headers | View raw

This patch imposes minimum key size limit.
It declares EVM_MIN_KEY_SIZE and EVM_MAX_KEY_SIZE in public header file.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
---
 include/linux/evm.h                 | 3 +++
 security/integrity/evm/evm_crypto.c | 7 +++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/linux/evm.h b/include/linux/evm.h
index 35ed9a8..0aeedec 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -11,6 +11,9 @@
 #include <linux/integrity.h>
 #include <linux/xattr.h>
 
+#define EVM_MAX_KEY_SIZE	128
+#define EVM_MIN_KEY_SIZE	64
+
 struct integrity_iint_cache;
 
 #ifdef CONFIG_EVM
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 7aec93e..cfb788c 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -24,9 +24,8 @@
 #include "evm.h"
 
 #define EVMKEY "evm-key"
-#define MAX_KEY_SIZE 128
-static unsigned char evmkey[MAX_KEY_SIZE];
-static int evmkey_len = MAX_KEY_SIZE;
+static unsigned char evmkey[EVM_MAX_KEY_SIZE];
+static int evmkey_len = EVM_MAX_KEY_SIZE;
 
 struct crypto_shash *hmac_tfm;
 struct crypto_shash *hash_tfm;
@@ -54,7 +53,7 @@ int evm_set_key(void *key, size_t keylen)
 	if (test_and_set_bit(EVM_SET_KEY_BUSY, &evm_set_key_flags))
 		goto busy;
 	rc = -EINVAL;
-	if (keylen > MAX_KEY_SIZE)
+	if (keylen < EVM_MIN_KEY_SIZE || keylen > EVM_MAX_KEY_SIZE)
 		goto inval;
 	memcpy(evmkey, key, keylen);
 	evm_initialized |= EVM_INIT_HMAC;
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCHv3 0/6] integrity: few EVM patches Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 20:50 +0200
  [PATCHv3 2/6] evm: load x509 certificate from the kernel Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
  [PATCHv3 6/6] evm: reset EVM status when file attributes changes Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
  [PATCHv3 4/6] evm: provide a function to set EVM key from the kernel Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
    Re: [PATCHv3 4/6] evm: provide a function to set EVM key from the  kernel Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-10-23 20:40 +0200
      Re: [PATCHv3 4/6] evm: provide a function to set EVM key from the kernel Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-26 20:20 +0100
  [PATCHv3 5/6] evm: define EVM key max and min sizes Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
  [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted' keyring Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
    Re: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Petko Manolov <petkan@mip-labs.com> - 2015-10-23 15:10 +0200
      RE: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Dmitry Kasatkin <dmitry.kasatkin@huawei.com> - 2015-10-23 15:50 +0200
      Re: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-10-23 21:20 +0200
        Re: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Petko Manolov <petkan@mip-labs.com> - 2015-10-24 11:40 +0200
  [PATCHv3 3/6] evm: enable EVM when X509 certificate is loaded Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
    Re: [PATCHv3 3/6] evm: enable EVM when X509 certificate is loaded Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-10-23 20:40 +0200
      Re: [PATCHv3 3/6] evm: enable EVM when X509 certificate is loaded Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-26 20:20 +0100

csiph-web