|
Packit |
6c4009 |
/* FIPS compliance status test for GNU/Linux systems.
|
|
Packit |
6c4009 |
Copyright (C) 2012-2018 Free Software Foundation, Inc.
|
|
Packit |
6c4009 |
This file is part of the GNU C Library.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
The GNU C Library is free software; you can redistribute it and/or
|
|
Packit |
6c4009 |
modify it under the terms of the GNU Lesser General Public
|
|
Packit |
6c4009 |
License as published by the Free Software Foundation; either
|
|
Packit |
6c4009 |
version 2.1 of the License, or (at your option) any later version.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
The GNU C Library is distributed in the hope that it will be useful,
|
|
Packit |
6c4009 |
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit |
6c4009 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit |
6c4009 |
Lesser General Public License for more details.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
You should have received a copy of the GNU Lesser General Public
|
|
Packit |
6c4009 |
License along with the GNU C Library; if not, see
|
|
Packit |
6c4009 |
<http://www.gnu.org/licenses/>. */
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#ifndef _FIPS_PRIVATE_H
|
|
Packit |
6c4009 |
#define _FIPS_PRIVATE_H
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#include <errno.h>
|
|
Packit |
6c4009 |
#include <fcntl.h>
|
|
Packit |
6c4009 |
#include <stdlib.h>
|
|
Packit |
6c4009 |
#include <unistd.h>
|
|
Packit |
6c4009 |
#include <not-cancel.h>
|
|
Packit |
6c4009 |
#include <stdbool.h>
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Return true if FIPS mode is enabled. See
|
|
Packit |
6c4009 |
sysdeps/generic/fips-private.h for more information. */
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
static bool
|
|
Packit |
6c4009 |
fips_enabled_p (void)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
static enum
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
FIPS_UNTESTED = 0,
|
|
Packit |
6c4009 |
FIPS_ENABLED = 1,
|
|
Packit |
6c4009 |
FIPS_DISABLED = -1,
|
|
Packit |
6c4009 |
FIPS_TEST_FAILED = -2
|
|
Packit |
6c4009 |
} checked;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (checked == FIPS_UNTESTED)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
int fd = __open_nocancel ("/proc/sys/crypto/fips_enabled", O_RDONLY);
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (fd != -1)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
/* This is more than enough, the file contains a single integer. */
|
|
Packit |
6c4009 |
char buf[32];
|
|
Packit |
6c4009 |
ssize_t n;
|
|
Packit |
6c4009 |
n = TEMP_FAILURE_RETRY (__read_nocancel (fd, buf, sizeof (buf) - 1));
|
|
Packit |
6c4009 |
__close_nocancel_nostatus (fd);
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (n > 0)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
/* Terminate the string. */
|
|
Packit |
6c4009 |
buf[n] = '\0';
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
char *endp;
|
|
Packit |
6c4009 |
long int res = strtol (buf, &endp, 10);
|
|
Packit |
6c4009 |
if (endp != buf && (*endp == '\0' || *endp == '\n'))
|
|
Packit |
6c4009 |
checked = (res > 0) ? FIPS_ENABLED : FIPS_DISABLED;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (checked == FIPS_UNTESTED)
|
|
Packit |
6c4009 |
checked = FIPS_TEST_FAILED;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
return checked == FIPS_ENABLED;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#endif /* _FIPS_PRIVATE_H */
|