Message ID | 20220620131618.952133-1-vdronov@redhat.com (mailing list archive) |
---|---|
State | Superseded |
Delegated to: | Herbert Xu |
Headers | show |
Series | crypto: fips - make proc files report fips module name and version | expand |
Hi-- On 6/20/22 06:16, Vladis Dronov wrote: > diff --git a/crypto/Kconfig b/crypto/Kconfig > index 1d44893a997b..082ff03d9f6c 100644 > --- a/crypto/Kconfig > +++ b/crypto/Kconfig > @@ -33,6 +33,27 @@ config CRYPTO_FIPS > certification. You should say no unless you know what > this is. > > +config CRYPTO_FIPS_NAME > + string "FIPS Module Name" > + default "Linux Kernel Cryptographic API" > + depends on (CRYPTO_FIPS) No parentheses. > + help > + This option sets the FIPS Module name reported by the Crypto API via > + the /proc/sys/crypto/fips_name file. > + > +config CRYPTO_FIPS_CUSTOM_VERSION > + bool "Use Custom FIPS Module Version" > + depends on (CRYPTO_FIPS) Ditto. > + default n > + > +config CRYPTO_FIPS_VERSION > + string "FIPS Module Version" > + default "(none)" > + depends on (CRYPTO_FIPS_CUSTOM_VERSION) Ditto. > + help > + This option provides the ability to override the FIPS Module Version. > + By default the KERNELRELEASE value is used.
Hi, On Mon, Jun 20, 2022 at 11:40 PM Randy Dunlap <rdunlap@infradead.org> wrote: > > Hi-- > > On 6/20/22 06:16, Vladis Dronov wrote: > > diff --git a/crypto/Kconfig b/crypto/Kconfig > > index 1d44893a997b..082ff03d9f6c 100644 > > --- a/crypto/Kconfig > > +++ b/crypto/Kconfig > > @@ -33,6 +33,27 @@ config CRYPTO_FIPS > > certification. You should say no unless you know what > > this is. > > > > +config CRYPTO_FIPS_NAME > > + string "FIPS Module Name" > > + default "Linux Kernel Cryptographic API" > > + depends on (CRYPTO_FIPS) > > No parentheses. > > > + help > > + This option sets the FIPS Module name reported by the Crypto API via > > + the /proc/sys/crypto/fips_name file. > > + > > +config CRYPTO_FIPS_CUSTOM_VERSION > > + bool "Use Custom FIPS Module Version" > > + depends on (CRYPTO_FIPS) > > Ditto. > > > + default n > > + > > +config CRYPTO_FIPS_VERSION > > + string "FIPS Module Version" > > + default "(none)" > > + depends on (CRYPTO_FIPS_CUSTOM_VERSION) > > Ditto. > > > + help > > + This option provides the ability to override the FIPS Module Version. > > + By default the KERNELRELEASE value is used. > > -- > ~Randy Oh dang, indeed. Thanks, Randy. Let me post v2 to this same thread to reduce separate threads. Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer
diff --git a/crypto/Kconfig b/crypto/Kconfig index 1d44893a997b..082ff03d9f6c 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -33,6 +33,27 @@ config CRYPTO_FIPS certification. You should say no unless you know what this is. +config CRYPTO_FIPS_NAME + string "FIPS Module Name" + default "Linux Kernel Cryptographic API" + depends on (CRYPTO_FIPS) + help + This option sets the FIPS Module name reported by the Crypto API via + the /proc/sys/crypto/fips_name file. + +config CRYPTO_FIPS_CUSTOM_VERSION + bool "Use Custom FIPS Module Version" + depends on (CRYPTO_FIPS) + default n + +config CRYPTO_FIPS_VERSION + string "FIPS Module Version" + default "(none)" + depends on (CRYPTO_FIPS_CUSTOM_VERSION) + help + This option provides the ability to override the FIPS Module Version. + By default the KERNELRELEASE value is used. + config CRYPTO_ALGAPI tristate select CRYPTO_ALGAPI2 diff --git a/crypto/fips.c b/crypto/fips.c index 7b1d8caee669..644895d23c9b 100644 --- a/crypto/fips.c +++ b/crypto/fips.c @@ -30,13 +30,30 @@ static int fips_enable(char *str) __setup("fips=", fips_enable); +static char fips_name[] = FIPS_MODULE_NAME; +static char fips_version[] = FIPS_MODULE_VERSION; + static struct ctl_table crypto_sysctl_table[] = { { - .procname = "fips_enabled", - .data = &fips_enabled, - .maxlen = sizeof(int), - .mode = 0444, - .proc_handler = proc_dointvec + .procname = "fips_enabled", + .data = &fips_enabled, + .maxlen = sizeof(int), + .mode = 0444, + .proc_handler = proc_dointvec + }, + { + .procname = "fips_name", + .data = &fips_name, + .maxlen = 64, + .mode = 0444, + .proc_handler = proc_dostring + }, + { + .procname = "fips_version", + .data = &fips_version, + .maxlen = 64, + .mode = 0444, + .proc_handler = proc_dostring }, {} }; diff --git a/include/linux/fips.h b/include/linux/fips.h index c6961e932fef..72d2e0e1d3ac 100644 --- a/include/linux/fips.h +++ b/include/linux/fips.h @@ -2,10 +2,19 @@ #ifndef _FIPS_H #define _FIPS_H +#include <generated/utsrelease.h> + #ifdef CONFIG_CRYPTO_FIPS extern int fips_enabled; extern struct atomic_notifier_head fips_fail_notif_chain; +#define FIPS_MODULE_NAME CONFIG_CRYPTO_FIPS_NAME +#ifdef CONFIG_CRYPTO_FIPS_CUSTOM_VERSION +#define FIPS_MODULE_VERSION CONFIG_CRYPTO_FIPS_VERSION +#else +#define FIPS_MODULE_VERSION UTS_RELEASE +#endif + void fips_fail_notify(void); #else