diff options
| author |   Nayna Jain <nayna@linux.ibm.com> | 2019-10-30 23:31:31 -0400 |
|---|---|---|
| committer |   Michael Ellerman <mpe@ellerman.id.au> | 2019-11-12 12:25:50 +1100 |
| commit | 2434f7d2d488c3301ae81f1031e1c66c6f076fb7 (patch) | |
| tree | aa7a3fe1afeffd5f6c08cb78228a82d1da56e018 /certs | |
| parent | ima: Make process_buffer_measurement() generic (diff) | |
| download | wireguard-linux-2434f7d2d488c3301ae81f1031e1c66c6f076fb7.tar.xz wireguard-linux-2434f7d2d488c3301ae81f1031e1c66c6f076fb7.zip | |
certs: Add wrapper function to check blacklisted binary hash
The -EKEYREJECTED error returned by existing is_hash_blacklisted() is
misleading when called for checking against blacklisted hash of a
binary.
This patch adds a wrapper function is_binary_blacklisted() to return
-EPERM error if binary is blacklisted.
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1572492694-6520-7-git-send-email-zohar@linux.ibm.com
Diffstat (limited to 'certs')
| -rw-r--r-- | certs/blacklist.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/certs/blacklist.c b/certs/blacklist.c index ec00bf337eb6..6514f9ebc943 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -135,6 +135,15 @@ int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type) } EXPORT_SYMBOL_GPL(is_hash_blacklisted); +int is_binary_blacklisted(const u8 *hash, size_t hash_len) +{ + if (is_hash_blacklisted(hash, hash_len, "bin") == -EKEYREJECTED) + return -EPERM; + + return 0; +} +EXPORT_SYMBOL_GPL(is_binary_blacklisted); + /* * Initialise the blacklist */ |