diff options
| author | Dmitry Kasatkin <dmitry.kasatkin@nokia.com> | 2011-03-09 22:28:20 +0300 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2011-07-18 20:29:41 +0400 |
| commit | 6be5cc5246f807fd8ede9f5f1bb2826f2c598658 (patch) | |
| tree | 00fc342eb91fb50df4e8eddfe2a7294b27df8117 /include | |
| parent | 66dbc325afcef909043c30e90930a36823fc734c (diff) | |
| download | linux-6be5cc5246f807fd8ede9f5f1bb2826f2c598658.tar.xz | |
evm: add support for different security.evm data types
EVM protects a file's security extended attributes(xattrs) against integrity
attacks. The current patchset maintains an HMAC-sha1 value across the security
xattrs, storing the value as the extended attribute 'security.evm'. We
anticipate other methods for protecting the security extended attributes.
This patch reserves the first byte of 'security.evm' as a place holder for
the type of method.
Changelog v6:
- move evm_ima_xattr_type definition to security/integrity/integrity.h
- defined a structure for the EVM xattr called evm_ima_xattr_data
(based on Serge Hallyn's suggestion)
- removed unnecessary memset
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@nokia.com>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/integrity.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/integrity.h b/include/linux/integrity.h index e715a2abcea2..968443385678 100644 --- a/include/linux/integrity.h +++ b/include/linux/integrity.h @@ -19,6 +19,7 @@ enum integrity_status { INTEGRITY_UNKNOWN, }; +/* List of EVM protected security xattrs */ #ifdef CONFIG_INTEGRITY extern int integrity_inode_alloc(struct inode *inode); extern void integrity_inode_free(struct inode *inode); |