Ard Biesheuvel 2db9143a1b ANDROID: fips140: add kernel crypto module ...

To meet FIPS 140 requirements, add support for building a kernel module
"fips140.ko" that contains various cryptographic algorithms built from
existing kernel source files.  At load time, the module checks its own
integrity and self-tests its algorithms, then registers the algorithms
with the crypto API to supersede the original algorithms provided by the
kernel itself.

[ebiggers: this commit originated from "ANDROID: crypto: fips140 -
 perform load time integrity check", but I've folded many later commits
 into it to make forward porting easier.  See below]

Original commits from android12-5.10:
  * 6be141eb36 ("ANDROID: crypto: fips140 - perform load time integrity check")
  * 868be244bb ("ANDROID: inject correct HMAC digest into fips140.ko at build time")
  * 091338cb39 ("ANDROID: fips140: add missing static keyword to fips140_init()")
  * c799c6644b ("ANDROID: fips140: adjust some log messages")
  * 92de53472e ("ANDROID: fips140: log already-live algorithms")
  * 0af06624ea ("ANDROID: fips140: check for errors from initcalls")
  * 634445a640 ("ANDROID: fips140: fix deadlock in unregister_existing_fips140_algos()")
  * e886dd4c33 ("ANDROID: fips140: unregister existing DRBG algorithms")
  * b7397e89db ("ANDROID: fips140: add power-up cryptographic self-tests")
  * 50661975be ("ANDROID: fips140: add/update module help text")
  * b397a0387c ("ANDROID: fips140: test all implementations")
  * 17ccefe140 ("ANDROID: fips140: use full 16-byte IV")
  * 1be58af077 ("ANDROID: fips140: remove non-prediction-resistant DRBG test")
  * 2b5843ae2d ("ANDROID: fips140: add AES-CBC-CTS")
  * 2ee56aad31 ("ANDROID: fips140: add AES-CMAC")
  * 960ebb2b56 ("ANDROID: fips140: add jitterentropy to fips140 module")
  * e5b14396f9 ("ANDROID: fips140: take into account AES-GCM not being approvable")
  * 52b70d491b ("ANDROID: fips140: use FIPS140_CFLAGS when compiling fips140-selftests.c")
  * 6b995f5a54 ("ANDROID: fips140: preserve RELA sections without relying on the module loader")
  * e45108ecff ("ANDROID: fips140: block crypto operations until tests complete")
  * ecf9341134 ("ANDROID: fips140: remove in-place updating of live algorithms")
  * 482b0323cf ("ANDROID: fips140: zeroize temporary values from integrity check")
  * 64d769e53f ("ANDROID: fips140: add service indicators")
  * 8d7f609cda ("ANDROID: fips140: add name and version, and a function to retrieve them")
  * 6b7c37f6c4 ("ANDROID: fips140: use UTS_RELEASE as FIPS version")
  * 903e97a0ca ("ANDROID: fips140: refactor evaluation testing support")
  * 97fb2104fe ("ANDROID: fips140: add support for injecting integrity error")
  * 109f31ac23 ("ANDROID: fips140: add userspace interface for evaluation testing")

Bug: 153614920
Bug: 188620248
Test: tested that the module builds and can be loaded on raven.
Change-Id: I3fde49dbc3d16b149b072a27ba5b4c6219015c94
Signed-off-by: Ard Biesheuvel <ardb@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>

2022-03-15 21:24:22 +00:00

1.3 KiB

Raw Permalink Blame History

View Raw