diff options
| author |   Eric Snowberg <eric.snowberg@oracle.com> | 2021-01-22 13:10:54 -0500 |
|---|---|---|
| committer |   David Howells <dhowells@redhat.com> | 2021-03-11 16:34:48 +0000 |
| commit | ebd9c2ae369a45bdd9f8615484db09be58fc242b (patch) | |
| tree | 252555f34d05a05b0a19484b1b6c33982440f5e9 /include/keys | |
| parent | certs: Add ability to preload revocation certs (diff) | |
| download | wireguard-linux-ebd9c2ae369a45bdd9f8615484db09be58fc242b.tar.xz wireguard-linux-ebd9c2ae369a45bdd9f8615484db09be58fc242b.zip | |
integrity: Load mokx variables into the blacklist keyring
During boot the Secure Boot Forbidden Signature Database, dbx,
is loaded into the blacklist keyring. Systems booted with shim
have an equivalent Forbidden Signature Database called mokx.
Currently mokx is only used by shim and grub, the contents are
ignored by the kernel.
Add the ability to load mokx into the blacklist keyring during boot.
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
cc: keyrings@vger.kernel.org
Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/
Link: https://lore.kernel.org/r/20210122181054.32635-5-eric.snowberg@oracle.com/ # v5
Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/
Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/ # v2
Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/ # v3
Diffstat (limited to 'include/keys')
0 files changed, 0 insertions, 0 deletions