integrity: EVM as an integrity service provider

Index: linux-2.6.21-rc3-mm2/security/evm/evm_config.c
===================================================================
@@ -0,0 +1,129 @@
+/*
+ * EVM - Extended Verification Module
+ *
+ * Copyright (C) 2005,2006,2007 IBM Corporation
+ * Author: Mimi Zohar <[email protected]>
+ * 	   Kylene Hall <[email protected]>
+ *
+ *      This program is free software; you can redistribute it and/or modify
+ *      it under the terms of the GNU General Public License as published by
+ *      the Free Software Foundation, version 2 of the License.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include "evm.h"
+
+/*
+ * Configuration data
+ */
+struct evm_xattr_config *evm_config_xattrdata;
+int evm_config_xattrnum = 0;	/* number of extended attributes */
+
+/*
+ * inode->i_integrity information
+ */
+void display_config(const char *name)
+{
+	struct evm_xattr_config *config_p;
+
+	for_each_xattr(config_p, evm_config_xattrdata, evm_config_xattrnum)
+	    printk(KERN_INFO "%s: %s\n", name, config_p->xattr_name);
+}
+
+/*
+ * Initialize the Extended Verification module
+ */
+int evm_init_config(struct evm_xattr_config *evm_data, int evm_datasize)
+{
+	ssize_t error = 0;
+
+	if (evm_datasize > 0) {
+		evm_config_xattrdata = evm_data;
+		evm_config_xattrnum = evm_datasize;
+		display_config(__FUNCTION__);
+
+	} else {
+		printk(KERN_INFO "%s: config file definition missing\n",
+		       __FUNCTION__);
+		return -EINVAL;
+	}
+	return error;
+}
+
+static char *get_tag(char *buf_start, char *buf_end, char delimiter,
+		     int *taglen)
+{
+	char *bufp = buf_start;
+	char *tag;
+
+	/* Get start of tag */
+	while (bufp < buf_end) {
+		if (*bufp == ' ')	/* skip blanks */
+			while ((*bufp == ' ') && (bufp++ < buf_end)) ;
+		else if (*bufp == '#') {	/* skip comment */
+			while ((*bufp != '\n') && (bufp++ < buf_end)) ;
+			bufp++;
+		} else if (*bufp == '\n')	/* skip newline */
+			bufp++;
+		else if (*bufp == '\t')	/* skip tabs */
+			bufp++;
+		else
+			break;
+	}
+	if (bufp < buf_end)
+		tag = bufp;
+	else
+		return NULL;
+
+	/* Get tag */
+	*taglen = 0;
+	while ((bufp < buf_end) && (*taglen == 0)) {
+		if ((*bufp == delimiter) || (*bufp == '\n'))
+			*taglen = bufp - tag;
+		bufp++;
+	}
+	if (*taglen == 0)	/* Didn't find end delimiter */
+		*taglen = bufp - tag;
+	return tag;
+}
+
+struct evm_xattr_config *evm_parse_config(char *data, unsigned long datalen,
+					  int *xattrnum)
+{
+	char *datap, *dataend, *tag;
+	int num_xattr = 0;
+	struct evm_xattr_config *config_xattrdata = NULL, *config_p;
+	int taglen;
+
+	/* Get number of extended attribute definitions */
+	datap = data;
+	dataend = data + datalen;
+
+	while ((tag = get_tag(datap, dataend, ' ', &taglen)) != NULL) {
+		datap = tag + taglen;
+		num_xattr++;
+	}
+	*xattrnum = num_xattr;
+
+	datap = data;
+	config_xattrdata =
+	    kmalloc(num_xattr * sizeof(struct evm_xattr_config), GFP_KERNEL);
+	if (!config_xattrdata)
+		return NULL;
+
+	/* Get the list of hmac protected extended attributes */
+	config_p = config_xattrdata;
+	while ((tag = get_tag(datap, dataend, ' ', &taglen)) != NULL) {
+		datap = tag == NULL ? dataend : tag + taglen;
+		memset(config_p->xattr_name, 0, sizeof config_p->xattr_name);
+		memcpy(config_p->xattr_name, tag, taglen);
+		config_p++;
+	}
+	return config_xattrdata;
+}
+
+inline void evm_cleanup_config(void)
+{
+	kfree(evm_config_xattrdata);
+}

350 lines not on this page · raw message

85 lines not on this page · raw message

201 lines not on this page · raw message

926 lines not on this page · raw message

Index: linux-2.6.21-rc3-mm2/fs/namei.c
===================================================================
@@ -2616,6 +2616,27 @@ int generic_readlink(struct dentry *dent
 	return PTR_ERR(cookie);
 }
 
+int kernel_readlink(struct dentry *dentry, char **buffer, int *buflen)
+{
+	struct nameidata nd;
+	void *cookie;
+
+	nd.depth = 0;
+	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
+	if (!IS_ERR(cookie)) {
+		char *link;
+
+		link = nd_get_link(&nd);
+		if (IS_ERR(link))
+			return PTR_ERR(link);
+		*buffer = kstrdup(link, GFP_KERNEL);
+		*buflen = (*buffer == NULL) ? 0 : strlen(*buffer);
+		if (dentry->d_inode->i_op->put_link)
+			dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+	}
+	return PTR_ERR(cookie);
+}
+
 int vfs_follow_link(struct nameidata *nd, const char *link)
 {
 	return __vfs_follow_link(nd, link);

@@ -2758,6 +2779,7 @@ EXPORT_SYMBOL(vfs_mkdir);
 EXPORT_SYMBOL(vfs_mknod);
 EXPORT_SYMBOL(generic_permission);
 EXPORT_SYMBOL(vfs_readlink);
+EXPORT_SYMBOL(kernel_readlink);
 EXPORT_SYMBOL(vfs_rename);
 EXPORT_SYMBOL(vfs_rmdir);
 EXPORT_SYMBOL(vfs_symlink);