[PATCH 2/3] crypto: af_alg - Replace 'bool privileged' with flags

[Eric Biggers <ebiggers@kernel.org>]

It isn't obvious what false/true mean at the definition sites, so let's
replace it with flags instead.  Also flip the polarity to make the
default zero-initialized value be the secure (privileged-only) value.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 crypto/af_alg.c         |  3 ++-
 crypto/algif_aead.c     |  2 +-
 crypto/algif_hash.c     | 28 ++++++++++++++--------------
 crypto/algif_skcipher.c | 28 ++++++++++++++--------------
 include/crypto/if_alg.h |  6 +++++-
 5 files changed, 36 insertions(+), 31 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 34b801568fba..1e5da61b315c 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -146,7 +146,8 @@ int af_alg_check_restriction(const char *name,
 		for (const struct af_alg_allowlist_entry *ent = allowlist;
 		     ent->name; ent++) {
 			if (strcmp(name, ent->name) == 0 &&
-			    (!ent->privileged || af_alg_capable()))
+			    ((ent->flags & AF_ALG_UNPRIVILEGED) ||
+			     af_alg_capable()))
 				return 0;
 		}
 	}
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index b9217f9086aa..5574e2d70539 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -35,7 +35,7 @@
 #include <net/sock.h>
 
 static const struct af_alg_allowlist_entry aead_allowlist[] = {
-	{ "ccm(aes)", true }, /* bluez */
+	{ "ccm(aes)" }, /* bluez */
 	{},
 };
 
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index a8d958d51ece..6e8b5fb82a7f 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -17,20 +17,20 @@
 #include <net/sock.h>
 
 static const struct af_alg_allowlist_entry hash_allowlist[] = {
-	{ "cmac(aes)", true }, /* iwd, bluez */
-	{ "hmac(md5)", true }, /* iwd */
-	{ "hmac(sha1)", true }, /* iwd */
-	{ "hmac(sha224)", true }, /* iwd */
-	{ "hmac(sha256)", true }, /* iwd */
-	{ "hmac(sha384)", true }, /* iwd */
-	{ "hmac(sha512)", true }, /* iwd, sha512hmac */
-	{ "md4", true }, /* iwd */
-	{ "md5", true }, /* iwd */
-	{ "sha1", false }, /* iwd, iproute2 < 7.0 */
-	{ "sha224", true }, /* iwd */
-	{ "sha256", true }, /* iwd */
-	{ "sha384", true }, /* iwd */
-	{ "sha512", true }, /* iwd */
+	{ "cmac(aes)" }, /* iwd, bluez */
+	{ "hmac(md5)" }, /* iwd */
+	{ "hmac(sha1)" }, /* iwd */
+	{ "hmac(sha224)" }, /* iwd */
+	{ "hmac(sha256)" }, /* iwd */
+	{ "hmac(sha384)" }, /* iwd */
+	{ "hmac(sha512)" }, /* iwd, sha512hmac */
+	{ "md4" }, /* iwd */
+	{ "md5" }, /* iwd */
+	{ "sha1", AF_ALG_UNPRIVILEGED }, /* iwd, iproute2 < 7.0 */
+	{ "sha224" }, /* iwd */
+	{ "sha256" }, /* iwd */
+	{ "sha384" }, /* iwd */
+	{ "sha512" }, /* iwd */
 	{},
 };
 
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 68b48d805e92..1e61fe6e24b9 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -36,20 +36,20 @@
 #include <net/sock.h>
 
 static const struct af_alg_allowlist_entry skcipher_allowlist[] = {
-	{ "adiantum(xchacha12,aes)", false }, /* cryptsetup */
-	{ "adiantum(xchacha20,aes)", false }, /* cryptsetup */
-	{ "cbc(aes)", true }, /* iwd */
-	{ "cbc(des)", true }, /* iwd */
-	{ "cbc(des3_ede)", true }, /* iwd */
-	{ "cbc(paes)", true }, /* caam and others */
-	{ "ctr(aes)", true }, /* iwd */
-	{ "ecb(aes)", true }, /* iwd, bluez */
-	{ "ecb(des)", true }, /* iwd */
-	{ "hctr2(aes)", false }, /* cryptsetup */
-	{ "xts(aes)", false }, /* cryptsetup benchmark */
-	{ "xts(camellia)", false }, /* cryptsetup */
-	{ "xts(serpent)", false }, /* cryptsetup */
-	{ "xts(twofish)", false }, /* cryptsetup */
+	{ "adiantum(xchacha12,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "adiantum(xchacha20,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "cbc(aes)" }, /* iwd */
+	{ "cbc(des)" }, /* iwd */
+	{ "cbc(des3_ede)" }, /* iwd */
+	{ "cbc(paes)" }, /* caam and others */
+	{ "ctr(aes)" }, /* iwd */
+	{ "ecb(aes)" }, /* iwd, bluez */
+	{ "ecb(des)" }, /* iwd */
+	{ "hctr2(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "xts(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup benchmark */
+	{ "xts(camellia)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "xts(serpent)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "xts(twofish)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
 	{},
 };
 
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index dbf6a97c72a2..0d51428c1da4 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -8,6 +8,7 @@
 #ifndef _CRYPTO_IF_ALG_H
 #define _CRYPTO_IF_ALG_H
 
+#include <linux/bits.h>
 #include <linux/compiler.h>
 #include <linux/completion.h>
 #include <linux/if_alg.h>
@@ -161,9 +162,12 @@ struct af_alg_ctx {
 	unsigned int inflight;
 };
 
+/* Flags for af_alg_allowlist_entry::flags: */
+#define AF_ALG_UNPRIVILEGED BIT(0) /* Unprivileged use is allowed */
+
 struct af_alg_allowlist_entry {
 	const char *name;
-	bool privileged;
+	u32 flags;
 };
 
 int af_alg_register_type(const struct af_alg_type *type);
-- 
2.55.0