diff options
| author |   David Howells <dhowells@redhat.com> | 2015-07-20 21:16:28 +0100 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2015-08-07 16:26:13 +0100 |
| commit | 091f6e26eb326adbd718f406e440c838bed8ebb6 (patch) | |
| tree | 9562f51745eb81fdf44d1fb56d6e79090935d2e4 /init | |
| parent | system_keyring.c doesn't need to #include module-internal.h (diff) | |
| download | linux-dev-091f6e26eb326adbd718f406e440c838bed8ebb6.tar.xz linux-dev-091f6e26eb326adbd718f406e440c838bed8ebb6.zip | |
MODSIGN: Extract the blob PKCS#7 signature verifier from module signing
Extract the function that drives the PKCS#7 signature verification given a
data blob and a PKCS#7 blob out from the module signing code and lump it with
the system keyring code as it's generic. This makes it independent of module
config options and opens it to use by the firmware loader.
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Kyle McMartin <kyle@kernel.org>
Diffstat (limited to 'init')
| -rw-r--r-- | init/Kconfig | 29 |
1 files changed, 19 insertions, 10 deletions
diff --git a/init/Kconfig b/init/Kconfig index e16d9e587cee..14b3d8422502 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1752,6 +1752,24 @@ config SYSTEM_TRUSTED_KEYRING Keys in this keyring are used by module signature checking. +config SYSTEM_DATA_VERIFICATION + def_bool n + select SYSTEM_TRUSTED_KEYRING + select KEYS + select CRYPTO + select ASYMMETRIC_KEY_TYPE + select ASYMMETRIC_PUBLIC_KEY_SUBTYPE + select PUBLIC_KEY_ALGO_RSA + select ASN1 + select OID_REGISTRY + select X509_CERTIFICATE_PARSER + select PKCS7_MESSAGE_PARSER + help + Provide PKCS#7 message verification using the contents of the system + trusted keyring to provide public keys. This then can be used for + module verification, kexec image verification and firmware blob + verification. + config PROFILING bool "Profiling support" help @@ -1860,16 +1878,7 @@ config MODULE_SRCVERSION_ALL config MODULE_SIG bool "Module signature verification" depends on MODULES - select SYSTEM_TRUSTED_KEYRING - select KEYS - select CRYPTO - select ASYMMETRIC_KEY_TYPE - select ASYMMETRIC_PUBLIC_KEY_SUBTYPE - select PUBLIC_KEY_ALGO_RSA - select ASN1 - select OID_REGISTRY - select X509_CERTIFICATE_PARSER - select PKCS7_MESSAGE_PARSER + select SYSTEM_DATA_VERIFICATION help Check modules for valid signatures upon load: the signature is simply appended to the module. For more information see |