diff options
author | Neil Horman <nhorman@tuxdriver.com> | 2008-08-05 14:13:08 +0800 |
---|---|---|
committer | Herbert Xu <herbert@gondor.apana.org.au> | 2008-08-13 22:04:07 +1000 |
commit | 227d7bf9e557c9b3d86670643a8530afca4b21b1 (patch) | |
tree | b78932ce4c12f40ecfd92573c28f3e62346de85e /crypto | |
parent | 4a2aa98438bf4aea8ef19c56f256d6eef86de13f (diff) |
crypto: api - Add fips_enable flag
Add the ability to turn FIPS-compliant mode on or off at boot
In order to be FIPS compliant, several check may need to be preformed that may
be construed as unusefull in a non-compliant mode. This patch allows us to set
a kernel flag incating that we are running in a fips-compliant mode from boot
up. It also exports that mode information to user space via a sysctl
(/proc/sys/crypto/fips_enabled).
Tested successfully by me.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
-rw-r--r-- | crypto/api.c | 14 | ||||
-rw-r--r-- | crypto/internal.h | 2 | ||||
-rw-r--r-- | crypto/proc.c | 32 |
3 files changed, 48 insertions, 0 deletions
diff --git a/crypto/api.c b/crypto/api.c index 0444d242e985..cd232d4dfc41 100644 --- a/crypto/api.c +++ b/crypto/api.c @@ -493,5 +493,19 @@ int crypto_has_alg(const char *name, u32 type, u32 mask) } EXPORT_SYMBOL_GPL(crypto_has_alg); +int fips_enabled; +EXPORT_SYMBOL_GPL(fips_enabled); + +/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */ +static int fips_enable(char *str) +{ + fips_enabled = !!simple_strtol(str, NULL, 0); + printk(KERN_INFO "fips mode: %s\n", + fips_enabled ? "enabled" : "disabled"); + return 1; +} + +__setup("fips=", fips_enable); + MODULE_DESCRIPTION("Cryptographic core API"); MODULE_LICENSE("GPL"); diff --git a/crypto/internal.h b/crypto/internal.h index fc93743c5d3e..b7fcd3024875 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -26,6 +26,8 @@ #include <linux/rwsem.h> #include <linux/slab.h> +extern int fips_enabled; + /* Crypto notification events. */ enum { CRYPTO_MSG_ALG_REQUEST, diff --git a/crypto/proc.c b/crypto/proc.c index 1d616adead0d..29601dcfd0d3 100644 --- a/crypto/proc.c +++ b/crypto/proc.c @@ -19,8 +19,37 @@ #include <linux/rwsem.h> #include <linux/proc_fs.h> #include <linux/seq_file.h> +#include <linux/sysctl.h> #include "internal.h" +static struct ctl_table crypto_sysctl_table[] = { + { + .ctl_name = CTL_UNNUMBERED, + .procname = "fips_enabled", + .data = &fips_enabled, + .maxlen = sizeof(int), + .mode = 0444, + .proc_handler = &proc_dointvec + }, + { + .ctl_name = 0, + }, +}; + +static struct ctl_table crypto_dir_table[] = { + { + .ctl_name = CTL_UNNUMBERED, + .procname = "crypto", + .mode = 0555, + .child = crypto_sysctl_table + }, + { + .ctl_name = 0, + }, +}; + +static struct ctl_table_header *crypto_sysctls; + static void *c_start(struct seq_file *m, loff_t *pos) { down_read(&crypto_alg_sem); @@ -106,9 +135,12 @@ static const struct file_operations proc_crypto_ops = { void __init crypto_init_proc(void) { proc_create("crypto", 0, NULL, &proc_crypto_ops); + crypto_sysctls = register_sysctl_table(crypto_dir_table); } void __exit crypto_exit_proc(void) { remove_proc_entry("crypto", NULL); + if (crypto_sysctls) + unregister_sysctl_table(crypto_sysctls); } |