[PATCH] crypto: add fips_enable flag
From: Neil Horman <nhorman@tuxdriver.com>
Date: 2008-08-05 06:16:24
Subsystem:
crypto api, the rest · Maintainers:
Herbert Xu, "David S. Miller", Linus Torvalds
Add the ability to turn FIPS-compliant mode on or off at boot In order to be FIPS compliant, several check may need to be preformed that may be construed as unusefull in a non-compliant mode. This patch allows us to set a kernel flag incating that we are running in a fips-compliant mode from boot up. It also exports that mode information to user space via a sysctl (/proc/sys/crypto/fips_enabled). Tested successfully by me. Neil Signed-off-by: Neil Horman <nhorman@tuxdriver.com> api.c | 14 ++++++++++++++ internal.h | 2 ++ proc.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+)
diff --git a/crypto/api.c b/crypto/api.c
index d06e332..897070c 100644
--- a/crypto/api.c
+++ b/crypto/api.c@@ -450,5 +450,19 @@ int crypto_has_alg(const char *name, u32 type, u32 mask) } EXPORT_SYMBOL_GPL(crypto_has_alg); + +int fips_enabled; + +/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */ +static int fips_enable(char *str) +{ + fips_enabled = !!simple_strtol(str, NULL, 0); + printk(KERN_INFO "fips mode: %s\n", + fips_enabled ? "enabled" : "disabled"); + return 1; +} + +__setup("fips=", fips_enable); + MODULE_DESCRIPTION("Cryptographic core API"); MODULE_LICENSE("GPL");
diff --git a/crypto/internal.h b/crypto/internal.h
index 683fcb2..ec44f47 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h@@ -26,6 +26,8 @@ #include <linux/rwsem.h> #include <linux/slab.h> +extern int fips_enabled; + /* Crypto notification events. */ enum { CRYPTO_MSG_ALG_REQUEST,
diff --git a/crypto/proc.c b/crypto/proc.c
index 02ff567..07864ec 100644
--- a/crypto/proc.c
+++ b/crypto/proc.c@@ -19,8 +19,37 @@ #include <linux/rwsem.h> #include <linux/proc_fs.h> #include <linux/seq_file.h> +#include <linux/sysctl.h> #include "internal.h" +static struct ctl_table crypto_sysctl_table[] = { + { + .ctl_name = CTL_UNNUMBERED, + .procname = "fips_enabled", + .data = &fips_enabled, + .maxlen = sizeof(int), + .mode = 0444, + .proc_handler = &proc_dointvec + }, + { + .ctl_name = 0, + }, +}; + +static struct ctl_table crypto_dir_table[] = { + { + .ctl_name = CTL_UNNUMBERED, + .procname = "crypto", + .mode = 0555, + .child = crypto_sysctl_table + }, + { + .ctl_name = 0, + }, +}; + +static struct ctl_table_header *crypto_sysctls; + static void *c_start(struct seq_file *m, loff_t *pos) { down_read(&crypto_alg_sem);
@@ -100,9 +129,12 @@ static const struct file_operations proc_crypto_ops = { void __init crypto_init_proc(void) { proc_create("crypto", 0, NULL, &proc_crypto_ops); + crypto_sysctls = register_sysctl_table(crypto_dir_table); } void __exit crypto_exit_proc(void) { remove_proc_entry("crypto", NULL); + if (crypto_sysctls) + unregister_sysctl_table(crypto_sysctls); }
--
/****************************************************
* Neil Horman <nhorman@tuxdriver.com>
* Software Engineer, Red Hat
****************************************************/