aleph/lkl_linux
1
0
Fork 0
mirror of https://github.com/lkl/linux.git synced 2025-12-19 08:03:01 +09:00
Code Issues Packages Projects Releases Wiki Activity

integrity: PowerVM support for loading third party code signing keys

Browse Source 
On secure boot enabled PowerVM LPAR, third party code signing keys are
needed during early boot to verify signed third party modules. These
third party keys are stored in moduledb object in the Platform
KeyStore (PKS).

Load third party code signing keys onto .secondary_trusted_keys keyring.

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-and-tested-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
Nayna Jain
2023-08-15 07:27:22 -04:00
committed by Jarkko Sakkinen
parent d7d91c4743
commit 44e69ea538
5 changed files with 64 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
certs/system_keyring.c
View File

@@ -152,6 +152,36 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void
return restriction;
}
/**
* add_to_secondary_keyring - Add to secondary keyring.
* @source: Source of key
* @data: The blob holding the key
* @len: The length of the data blob
*
* Add a key to the secondary keyring. The key must be vouched for by a key in the builtin,
* machine or secondary keyring itself.
*/
void __init add_to_secondary_keyring(const char *source, const void *data, size_t len)
{
key_ref_t key;
key_perm_t perm;
perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW;
key = key_create_or_update(make_key_ref(secondary_trusted_keys, 1),
"asymmetric",
NULL, data, len, perm,
KEY_ALLOC_NOT_IN_QUOTA);
if (IS_ERR(key)) {
pr_err("Problem loading X.509 certificate from %s to secondary keyring %ld\n",
source, PTR_ERR(key));
return;
}
pr_notice("Loaded X.509 cert '%s'\n", key_ref_to_ptr(key)->description);
key_ref_put(key);
}
#endif
#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
void __init set_machine_trusted_keys(struct key *keyring)