rpms/kernel/devel linux-2.6-crypto-fips_enable.patch, NONE, 1.1 config-generic, 1.178, 1.179 kernel.spec, 1.1003, 1.1004
Dave Jones
davej at fedoraproject.org
Thu Oct 2 20:35:21 UTC 2008
Author: davej
Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24271
Modified Files:
config-generic kernel.spec
Added Files:
linux-2.6-crypto-fips_enable.patch
Log Message:
Add the ability to turn FIPS-compliant mode on or off at boot.
linux-2.6-crypto-fips_enable.patch:
--- NEW FILE linux-2.6-crypto-fips_enable.patch ---
From: Neil Horman <nhorman at tuxdriver.com>
Date: Tue, 5 Aug 2008 06:13:08 +0000 (+0800)
Subject: crypto: api - Add fips_enable flag
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fherbert%2Fcryptodev-2.6.git;a=commitdiff_plain;h=ccb778e1841ce04b4c10b39f0dd2558ab2c6dcd4
crypto: api - Add fips_enable flag
Add the ability to turn FIPS-compliant mode on or off at boot
In order to be FIPS compliant, several check may need to be preformed that may
be construed as unusefull in a non-compliant mode. This patch allows us to set
a kernel flag incating that we are running in a fips-compliant mode from boot
up. It also exports that mode information to user space via a sysctl
(/proc/sys/crypto/fips_enabled).
Tested successfully by me.
Signed-off-by: Neil Horman <nhorman at tuxdriver.com>
Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
---
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 776f90d..a784c2d 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -21,6 +21,14 @@ if CRYPTO
comment "Crypto core or helper"
+config CRYPTO_FIPS
+ bool "FIPS 200 compliance"
+ help
+ This options enables the fips boot option which is
+ required if you want to system to operate in a FIPS 200
+ certification. You should say no unless you know what
+ this is.
+
config CRYPTO_ALGAPI
tristate
help
diff --git a/crypto/Makefile b/crypto/Makefile
index 256e33e..8a27b83 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -5,6 +5,8 @@
obj-$(CONFIG_CRYPTO) += crypto.o
crypto-objs := api.o cipher.o digest.o compress.o
+obj-$(CONFIG_CRYPTO_FIPS) += fips.o
+
crypto_algapi-$(CONFIG_PROC_FS) += proc.o
crypto_algapi-objs := algapi.o scatterwalk.o $(crypto_algapi-y)
obj-$(CONFIG_CRYPTO_ALGAPI) += crypto_algapi.o
diff --git a/crypto/fips.c b/crypto/fips.c
new file mode 100644
index 0000000..5539700
--- /dev/null
+++ b/crypto/fips.c
@@ -0,0 +1,27 @@
+/*
+ * FIPS 200 support.
+ *
+ * Copyright (c) 2008 Neil Horman <nhorman at tuxdriver.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include "internal.h"
+
+int fips_enabled;
+EXPORT_SYMBOL_GPL(fips_enabled);
+
+/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */
+static int fips_enable(char *str)
+{
+ fips_enabled = !!simple_strtol(str, NULL, 0);
+ printk(KERN_INFO "fips mode: %s\n",
+ fips_enabled ? "enabled" : "disabled");
+ return 1;
+}
+
+__setup("fips=", fips_enable);
diff --git a/crypto/internal.h b/crypto/internal.h
index fc93743..8ef72d7 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -26,6 +26,12 @@
#include <linux/rwsem.h>
#include <linux/slab.h>
+#ifdef CONFIG_CRYPTO_FIPS
+extern int fips_enabled;
+#else
+#define fips_enabled 0
+#endif
+
/* Crypto notification events. */
enum {
CRYPTO_MSG_ALG_REQUEST,
diff --git a/crypto/proc.c b/crypto/proc.c
index 1d616ad..37a13d0 100644
--- a/crypto/proc.c
+++ b/crypto/proc.c
@@ -19,8 +19,53 @@
#include <linux/rwsem.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
+#include <linux/sysctl.h>
#include "internal.h"
+#ifdef CONFIG_CRYPTO_FIPS
+static struct ctl_table crypto_sysctl_table[] = {
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "fips_enabled",
+ .data = &fips_enabled,
+ .maxlen = sizeof(int),
+ .mode = 0444,
+ .proc_handler = &proc_dointvec
+ },
+ {
+ .ctl_name = 0,
+ },
+};
+
+static struct ctl_table crypto_dir_table[] = {
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "crypto",
+ .mode = 0555,
+ .child = crypto_sysctl_table
+ },
+ {
+ .ctl_name = 0,
+ },
+};
+
+static struct ctl_table_header *crypto_sysctls;
+
+static void crypto_proc_fips_init(void)
+{
+ crypto_sysctls = register_sysctl_table(crypto_dir_table);
+}
+
+static void crypto_proc_fips_exit(void)
+{
+ if (crypto_sysctls)
+ unregister_sysctl_table(crypto_sysctls);
+}
+#else
+#define crypto_proc_fips_init()
+#define crypto_proc_fips_exit()
+#endif
+
static void *c_start(struct seq_file *m, loff_t *pos)
{
down_read(&crypto_alg_sem);
@@ -106,9 +151,11 @@ static const struct file_operations proc_crypto_ops = {
void __init crypto_init_proc(void)
{
proc_create("crypto", 0, NULL, &proc_crypto_ops);
+ crypto_proc_fips_init();
}
void __exit crypto_exit_proc(void)
{
+ crypto_proc_fips_exit();
remove_proc_entry("crypto", NULL);
}
Index: config-generic
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/config-generic,v
retrieving revision 1.178
retrieving revision 1.179
diff -u -r1.178 -r1.179
--- config-generic 2 Oct 2008 12:22:49 -0000 1.178
+++ config-generic 2 Oct 2008 20:34:51 -0000 1.179
@@ -3205,6 +3205,7 @@
# Cryptographic options
#
CONFIG_CRYPTO=y
+CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_BLKCIPHER=y
CONFIG_CRYPTO_MANAGER=m
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.1003
retrieving revision 1.1004
diff -u -r1.1003 -r1.1004
--- kernel.spec 2 Oct 2008 12:22:49 -0000 1.1003
+++ kernel.spec 2 Oct 2008 20:34:51 -0000 1.1004
@@ -627,6 +627,9 @@
# make USB EHCI driver respect "nousb" parameter
Patch2300: linux-2.6-usb-ehci-hcd-respect-nousb.patch
+# Add fips_enable flag
+Patch2400: linux-2.6-crypto-fips_enable.patch
+
# get rid of imacfb and make efifb work everywhere it was used
Patch2600: linux-2.6-merge-efifb-imacfb.patch
@@ -1045,6 +1048,9 @@
# USB
ApplyPatch linux-2.6-usb-ehci-hcd-respect-nousb.patch
+# Add the ability to turn FIPS-compliant mode on or off at boot
+ApplyPatch linux-2.6-crypto-fips_enable.patch
+
# ACPI
ApplyPatch linux-2.6-defaults-acpi-video.patch
@@ -1741,6 +1747,9 @@
%kernel_variant_files -k vmlinux %{with_kdump} kdump
%changelog
+* Thu Oct 02 2008 Dave Jones <davej at redhat.com>
+- Add the ability to turn FIPS-compliant mode on or off at boot.
+
* Thu Oct 02 2008 Kyle McMartin <kyle at redhat.com>
- Linux 2.6.27-rc8-git3
- Re-enable e1000e driver, corruption prevention fix is upstream
More information about the fedora-extras-commits
mailing list