summaryrefslogtreecommitdiffstats
path: root/certs
diff options
context:
space:
mode:
authorKairui Song <kasong@redhat.com>2019-01-21 17:59:29 +0800
committerMimi Zohar <zohar@linux.ibm.com>2019-02-04 17:34:07 -0500
commit278311e417be60f7caef6fcb12bda4da2711ceff (patch)
treec322d3e96510244468ed35ea2f612dd71f7035ad /certs
parent219a3e8676f3132d27b530c7d2d6bcab89536b57 (diff)
downloadlinux-278311e417be60f7caef6fcb12bda4da2711ceff.tar.gz
linux-278311e417be60f7caef6fcb12bda4da2711ceff.tar.bz2
linux-278311e417be60f7caef6fcb12bda4da2711ceff.zip
kexec, KEYS: Make use of platform keyring for signature verify
This patch allows the kexec_file_load syscall to verify the PE signed kernel image signature based on the preboot keys stored in the .platform keyring, as fall back, if the signature verification failed due to not finding the public key in the secondary or builtin keyrings. This commit adds a VERIFY_USE_PLATFORM_KEYRING similar to previous VERIFY_USE_SECONDARY_KEYRING indicating that verify_pkcs7_signature should verify the signature using platform keyring. Also, decrease the error message log level when verification failed with -ENOKEY, so that if called tried multiple time with different keyring it won't generate extra noises. Signed-off-by: Kairui Song <kasong@redhat.com> Cc: David Howells <dhowells@redhat.com> Acked-by: Dave Young <dyoung@redhat.com> (for kexec_file_load part) [zohar@linux.ibm.com: tweaked the first paragraph of the patch description, and fixed checkpatch warning.] Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'certs')
-rw-r--r--certs/system_keyring.c13
1 files changed, 12 insertions, 1 deletions
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index da055e901df4..c05c29ae4d5d 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -240,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
#else
trusted_keys = builtin_trusted_keys;
#endif
+ } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+ trusted_keys = platform_trusted_keys;
+#else
+ trusted_keys = NULL;
+#endif
+ if (!trusted_keys) {
+ ret = -ENOKEY;
+ pr_devel("PKCS#7 platform keyring is not available\n");
+ goto error;
+ }
}
ret = pkcs7_validate_trust(pkcs7, trusted_keys);
if (ret < 0) {
if (ret == -ENOKEY)
- pr_err("PKCS#7 signature not signed with a trusted key\n");
+ pr_devel("PKCS#7 signature not signed with a trusted key\n");
goto error;
}