linux/fs/verity/measure.c

// SPDX-License-Identifier: GPL-2.0
/*
 * Ioctl to get a verity file's digest
 *
 * Copyright 2019 Google LLC
 */

#include "fsverity_private.h"

#include <linux/bpf.h>
#include <linux/btf.h>
#include <linux/uaccess.h>

/**
 * fsverity_ioctl_measure() - get a verity file's digest
 * @filp: file to get digest of
 * @_uarg: user pointer to fsverity_digest
 *
 * Retrieve the file digest that the kernel is enforcing for reads from a verity
 * file.  See the "FS_IOC_MEASURE_VERITY" section of
 * Documentation/filesystems/fsverity.rst for the documentation.
 *
 * Return: 0 on success, -errno on failure
 */
int fsverity_ioctl_measure(struct file *filp, void __user *_uarg)
{ … }
EXPORT_SYMBOL_GPL(…);

/**
 * fsverity_get_digest() - get a verity file's digest
 * @inode: inode to get digest of
 * @raw_digest: (out) the raw file digest
 * @alg: (out) the digest's algorithm, as a FS_VERITY_HASH_ALG_* value
 * @halg: (out) the digest's algorithm, as a HASH_ALGO_* value
 *
 * Retrieves the fsverity digest of the given file.  The file must have been
 * opened at least once since the inode was last loaded into the inode cache;
 * otherwise this function will not recognize when fsverity is enabled.
 *
 * The file's fsverity digest consists of @raw_digest in combination with either
 * @alg or @halg.  (The caller can choose which one of @alg or @halg to use.)
 *
 * IMPORTANT: Callers *must* make use of one of the two algorithm IDs, since
 * @raw_digest is meaningless without knowing which algorithm it uses!  fsverity
 * provides no security guarantee for users who ignore the algorithm ID, even if
 * they use the digest size (since algorithms can share the same digest size).
 *
 * Return: The size of the raw digest in bytes, or 0 if the file doesn't have
 *	   fsverity enabled.
 */
int fsverity_get_digest(struct inode *inode,
			u8 raw_digest[FS_VERITY_MAX_DIGEST_SIZE],
			u8 *alg, enum hash_algo *halg)
{ … }
EXPORT_SYMBOL_GPL(…);

#ifdef CONFIG_BPF_SYSCALL

/* bpf kfuncs */
__bpf_kfunc_start_defs();

/**
 * bpf_get_fsverity_digest: read fsverity digest of file
 * @file: file to get digest from
 * @digest_p: (out) dynptr for struct fsverity_digest
 *
 * Read fsverity_digest of *file* into *digest_ptr*.
 *
 * Return: 0 on success, a negative value on error.
 */
__bpf_kfunc int bpf_get_fsverity_digest(struct file *file, struct bpf_dynptr *digest_p)
{ … }

__bpf_kfunc_end_defs();

BTF_KFUNCS_START(fsverity_set_ids)
BTF_ID_FLAGS(…)
BTF_KFUNCS_END(…)

static int bpf_get_fsverity_digest_filter(const struct bpf_prog *prog, u32 kfunc_id)
{ … }

static const struct btf_kfunc_id_set bpf_fsverity_set = …;

void __init fsverity_init_bpf(void)
{ … }

#endif /* CONFIG_BPF_SYSCALL */