v0.5.22

Added

• The crypto API in the new crate rk-crypto, as crypto/ of Linux: the hashes SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512, the template hmac, the block cipher AES, and the templates ecb, cbc, ctr and xts with ciphertext stealing. The code is plain Rust. The unit tests use the vectors of crypto/testmgr.h of Linux (#541).
• The event log of the firmware at /sys/kernel/security/tpm0/binary_bios_measurements, as drivers/char/tpm/eventlog of Linux. The kernel copies the log area of the ACPI TPM2 table on x86-64, or the area of linux,sml-base and linux,sml-size of the device tree node of the TPM on arm64. The file has the first event and each next event of the crypto agile format, up to the first event that is not valid, as tpm2_binary_bios_measurements_show of Linux. On x86-64 the tpm boot test replays the log of SeaBIOS with tpm2_eventlog, and the SHA-256 PCRs of the log must be the PCRs of tpm2_pcrread (#541).
• The flowtables of nf_tables, as nf_tables_api.c and nft_flow_offload.c of Linux: NFT_MSG_NEWFLOWTABLE, NFT_MSG_GETFLOWTABLE, NFT_MSG_DELFLOWTABLE and NFT_MSG_DESTROYFLOWTABLE, with the ingress hook, the priority, the flags and the list of devices, and the flow_offload expression in the forward hook. A device can be in one flowtable of a table only (EEXIST), a flowtable that a rule uses cannot be deleted (EBUSY), and a device that goes away leaves the flowtable. The packets do not take a fast path: flow_offload does not change them (#542).
• AppArmor enforces the file rules of a profile in enforce mode, as file.c and domain.c of Linux. An open, a read, a write, a lock or a map that the rules do not allow gives EACCES and a DENIED record. So does an exec with no exec rule, an exec to a profile that is not there, and a change_profile or a change_onexec that the rules do not allow. A profile in complain mode gives an ALLOWED record and the operation goes on, and a profile in kill mode also kills the task. A deny rule denies in each mode (#540).