linux

iv/linux

History

Antony Antony c7a5899eb2 xfrm: redact SA secret with lockdown confidentiality

redact XFRM SA secret in the netlink response to xfrm_get_sa()
or dumpall sa.
Enable lockdown, confidentiality mode, at boot or at run time.

e.g. when enabled:
cat /sys/kernel/security/lockdown
none integrity [confidentiality]

ip xfrm state
src 172.16.1.200 dst 172.16.1.100
	proto esp spi 0x00000002 reqid 2 mode tunnel
	replay-window 0
	aead rfc4106(gcm(aes)) 0x0000000000000000000000000000000000000000 96

note: the aead secret is redacted.
Redacting secret is also a FIPS 140-2 requirement.

v1->v2
 - add size checks before memset calls
v2->v3
 - replace spaces with tabs for consistency
v3->v4
 - use kernel lockdown instead of a /proc setting
v4->v5
 - remove kconfig option

Reviewed-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

2020-11-27 11:03:06 +01:00

apparmor

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

bpf

bpf: Implement bpf_local_storage for inodes

2020-08-25 15:00:04 -07:00

integrity

ima: Replace zero-length array with flexible-array member

2020-10-29 17:22:59 -05:00

keys

task_work: cleanup notification modes