mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-27 14:04:47 -04:00
Code Issues Packages Projects Releases Wiki Activity

crypto: af_alg - Replace 'bool privileged' with flags

Browse Source 
It isn't obvious what false/true mean at the definition sites, so let's
replace it with flags instead.  Also flip the polarity to make the
default zero-initialized value be the secure (privileged-only) value.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Eric Biggers
2026-08-02 16:00:54 -07:00
committed by Herbert Xu
parent d9506e82ce
commit 185c67edbb
5 changed files with 36 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
crypto/af_alg.c
View File

@@ -146,7 +146,8 @@ int af_alg_check_restriction(const char *name,
for (const struct af_alg_allowlist_entry *ent = allowlist;
ent->name; ent++) {
if (strcmp(name, ent->name) == 0 &&
(!ent->privileged || af_alg_capable()))
((ent->flags & AF_ALG_UNPRIVILEGED) ||
af_alg_capable()))
return 0;
}
}

2
crypto/algif_aead.c
View File

@@ -35,7 +35,7 @@
#include <net/sock.h>
static const struct af_alg_allowlist_entry aead_allowlist[] = {
{ "ccm(aes)", true }, /* bluez */
{ "ccm(aes)" }, /* bluez */
{},
};

28
crypto/algif_hash.c
View File

@@ -17,20 +17,20 @@
#include <net/sock.h>
static const struct af_alg_allowlist_entry hash_allowlist[] = {
{ "cmac(aes)", true }, /* iwd, bluez */
{ "hmac(md5)", true }, /* iwd */
{ "hmac(sha1)", true }, /* iwd */
{ "hmac(sha224)", true }, /* iwd */
{ "hmac(sha256)", true }, /* iwd */
{ "hmac(sha384)", true }, /* iwd */
{ "hmac(sha512)", true }, /* iwd, sha512hmac */
{ "md4", true }, /* iwd */
{ "md5", true }, /* iwd */
{ "sha1", false }, /* iwd, iproute2 < 7.0 */
{ "sha224", true }, /* iwd */
{ "sha256", true }, /* iwd */
{ "sha384", true }, /* iwd */
{ "sha512", true }, /* iwd */
{ "cmac(aes)" }, /* iwd, bluez */
{ "hmac(md5)" }, /* iwd */
{ "hmac(sha1)" }, /* iwd */
{ "hmac(sha224)" }, /* iwd */
{ "hmac(sha256)" }, /* iwd */
{ "hmac(sha384)" }, /* iwd */
{ "hmac(sha512)" }, /* iwd, sha512hmac */
{ "md4" }, /* iwd */
{ "md5" }, /* iwd */
{ "sha1", AF_ALG_UNPRIVILEGED }, /* iwd, iproute2 < 7.0 */
{ "sha224" }, /* iwd */
{ "sha256" }, /* iwd */
{ "sha384" }, /* iwd */
{ "sha512" }, /* iwd */
{},
};

28
crypto/algif_skcipher.c
View File

@@ -36,20 +36,20 @@
#include <net/sock.h>
static const struct af_alg_allowlist_entry skcipher_allowlist[] = {
{ "adiantum(xchacha12,aes)", false }, /* cryptsetup */
{ "adiantum(xchacha20,aes)", false }, /* cryptsetup */
{ "cbc(aes)", true }, /* iwd */
{ "cbc(des)", true }, /* iwd */
{ "cbc(des3_ede)", true }, /* iwd */
{ "cbc(paes)", true }, /* caam and others */
{ "ctr(aes)", true }, /* iwd */
{ "ecb(aes)", true }, /* iwd, bluez */
{ "ecb(des)", true }, /* iwd */
{ "hctr2(aes)", false }, /* cryptsetup */
{ "xts(aes)", false }, /* cryptsetup benchmark */
{ "xts(camellia)", false }, /* cryptsetup */
{ "xts(serpent)", false }, /* cryptsetup */
{ "xts(twofish)", false }, /* cryptsetup */
{ "adiantum(xchacha12,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
{ "adiantum(xchacha20,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
{ "cbc(aes)" }, /* iwd */
{ "cbc(des)" }, /* iwd */
{ "cbc(des3_ede)" }, /* iwd */
{ "cbc(paes)" }, /* caam and others */
{ "ctr(aes)" }, /* iwd */
{ "ecb(aes)" }, /* iwd, bluez */
{ "ecb(des)" }, /* iwd */
{ "hctr2(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
{ "xts(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup benchmark */
{ "xts(camellia)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
{ "xts(serpent)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
{ "xts(twofish)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
{},
};

6
include/crypto/if_alg.h
View File

@@ -8,6 +8,7 @@
#ifndef _CRYPTO_IF_ALG_H
#define _CRYPTO_IF_ALG_H
#include <linux/bits.h>
#include <linux/compiler.h>
#include <linux/completion.h>
#include <linux/if_alg.h>
@@ -161,9 +162,12 @@ struct af_alg_ctx {
unsigned int inflight;
};
/* Flags for af_alg_allowlist_entry::flags: */
#define AF_ALG_UNPRIVILEGED BIT(0) /* Unprivileged use is allowed */
struct af_alg_allowlist_entry {
const char *name;
bool privileged;
u32 flags;
};
int af_alg_register_type(const struct af_alg_type *type);