summaryrefslogtreecommitdiffstats
path: root/crypto/proc.c
diff options
context:
space:
mode:
authorNeil Horman <nhorman@tuxdriver.com>2008-08-05 14:13:08 +0800
committerHerbert Xu <herbert@gondor.apana.org.au>2008-08-29 15:50:02 +1000
commitccb778e1841ce04b4c10b39f0dd2558ab2c6dcd4 (patch)
treed15c704e38e731391fdb8bf8db1922aff893acd7 /crypto/proc.c
parent5be5e667a9a5d8d5553e009e67bc692d95e5916a (diff)
downloadlinux-ccb778e1841ce04b4c10b39f0dd2558ab2c6dcd4.tar.bz2
crypto: api - Add fips_enable flag
Add the ability to turn FIPS-compliant mode on or off at boot In order to be FIPS compliant, several check may need to be preformed that may be construed as unusefull in a non-compliant mode. This patch allows us to set a kernel flag incating that we are running in a fips-compliant mode from boot up. It also exports that mode information to user space via a sysctl (/proc/sys/crypto/fips_enabled). Tested successfully by me. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/proc.c')
-rw-r--r--crypto/proc.c47
1 files changed, 47 insertions, 0 deletions
diff --git a/crypto/proc.c b/crypto/proc.c
index 1d616adead0d..37a13d05636d 100644
--- a/crypto/proc.c
+++ b/crypto/proc.c
@@ -19,8 +19,53 @@
#include <linux/rwsem.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
+#include <linux/sysctl.h>
#include "internal.h"
+#ifdef CONFIG_CRYPTO_FIPS
+static struct ctl_table crypto_sysctl_table[] = {
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "fips_enabled",
+ .data = &fips_enabled,
+ .maxlen = sizeof(int),
+ .mode = 0444,
+ .proc_handler = &proc_dointvec
+ },
+ {
+ .ctl_name = 0,
+ },
+};
+
+static struct ctl_table crypto_dir_table[] = {
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "crypto",
+ .mode = 0555,
+ .child = crypto_sysctl_table
+ },
+ {
+ .ctl_name = 0,
+ },
+};
+
+static struct ctl_table_header *crypto_sysctls;
+
+static void crypto_proc_fips_init(void)
+{
+ crypto_sysctls = register_sysctl_table(crypto_dir_table);
+}
+
+static void crypto_proc_fips_exit(void)
+{
+ if (crypto_sysctls)
+ unregister_sysctl_table(crypto_sysctls);
+}
+#else
+#define crypto_proc_fips_init()
+#define crypto_proc_fips_exit()
+#endif
+
static void *c_start(struct seq_file *m, loff_t *pos)
{
down_read(&crypto_alg_sem);
@@ -106,9 +151,11 @@ static const struct file_operations proc_crypto_ops = {
void __init crypto_init_proc(void)
{
proc_create("crypto", 0, NULL, &proc_crypto_ops);
+ crypto_proc_fips_init();
}
void __exit crypto_exit_proc(void)
{
+ crypto_proc_fips_exit();
remove_proc_entry("crypto", NULL);
}