crypto: api - Add fips_enable flag

Add the ability to turn FIPS-compliant mode on or off at boot

In order to be FIPS compliant, several check may need to be preformed that may
be construed as unusefull in a non-compliant mode.  This patch allows us to set
a kernel flag incating that we are running in a fips-compliant mode from boot
up.  It also exports that mode information to user space via a sysctl
(/proc/sys/crypto/fips_enabled).

Tested successfully by me.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

1 files changed, 47 insertions, 0 deletions

diff --git a/crypto/proc.c b/crypto/proc.c
index 1d616adead0d..37a13d05636d 100644
--- a/crypto/proc.c
+++ b/crypto/proc.c
@@ -19,8 +19,53 @@
 #include <linux/rwsem.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/sysctl.h>
 #include "internal.h"
 
+#ifdef CONFIG_CRYPTO_FIPS
+static struct ctl_table crypto_sysctl_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "fips_enabled",
+                .data           = &fips_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = 0444,
+                .proc_handler   = &proc_dointvec
+        },
+        {
+                .ctl_name = 0,
+        },
+};
+
+static struct ctl_table crypto_dir_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "crypto",
+                .mode           = 0555,
+                .child          = crypto_sysctl_table
+        },
+        {
+                .ctl_name = 0,
+        },
+};
+
+static struct ctl_table_header *crypto_sysctls;
+
+static void crypto_proc_fips_init(void)
+{
+        crypto_sysctls = register_sysctl_table(crypto_dir_table);
+}
+
+static void crypto_proc_fips_exit(void)
+{
+        if (crypto_sysctls)
+                unregister_sysctl_table(crypto_sysctls);
+}
+#else
+#define crypto_proc_fips_init()
+#define crypto_proc_fips_exit()
+#endif
+
 static void *c_start(struct seq_file *m, loff_t *pos)
 {
         down_read(&crypto_alg_sem);
@@ -106,9 +151,11 @@ static const struct file_operations proc_crypto_ops = {
 void __init crypto_init_proc(void)
 {
         proc_create("crypto", 0, NULL, &proc_crypto_ops);
+        crypto_proc_fips_init();
 }
 
 void __exit crypto_exit_proc(void)
 {
+        crypto_proc_fips_exit();
         remove_proc_entry("crypto", NULL);
 }