diff options
| author | David Howells <dhowells@redhat.com> | 2016-04-06 17:14:24 +0200 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2016-04-06 17:14:24 +0200 |
| commit | bda850cd214e90b1be0cc25bc48c4f6ac53eb543 (patch) | |
| tree | acb936239ac766592c557295aec265ec9a2d04fb /certs | |
| parent | KEYS: Generalise system_verify_data() to provide access to internal content (diff) | |
| download | linux-bda850cd214e90b1be0cc25bc48c4f6ac53eb543.tar.xz linux-bda850cd214e90b1be0cc25bc48c4f6ac53eb543.zip | |
PKCS#7: Make trust determination dependent on contents of trust keyring
Make the determination of the trustworthiness of a key dependent on whether
a key that can verify it is present in the supplied ring of trusted keys
rather than whether or not the verifying key has KEY_FLAG_TRUSTED set.
verify_pkcs7_signature() will return -ENOKEY if the PKCS#7 message trust
chain cannot be verified.
Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'certs')
| -rw-r--r-- | certs/system_keyring.c | 13 |
1 files changed, 4 insertions, 9 deletions
diff --git a/certs/system_keyring.c b/certs/system_keyring.c index a83bffedc0aa..dc18869ff680 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -121,7 +121,6 @@ late_initcall(load_system_certificate_list); int verify_pkcs7_signature(const void *data, size_t len, const void *raw_pkcs7, size_t pkcs7_len, struct key *trusted_keys, - int untrusted_error, enum key_being_used_for usage, int (*view_content)(void *ctx, const void *data, size_t len, @@ -129,7 +128,6 @@ int verify_pkcs7_signature(const void *data, size_t len, void *ctx) { struct pkcs7_message *pkcs7; - bool trusted; int ret; pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len); @@ -149,13 +147,10 @@ int verify_pkcs7_signature(const void *data, size_t len, if (!trusted_keys) trusted_keys = system_trusted_keyring; - ret = pkcs7_validate_trust(pkcs7, trusted_keys, &trusted); - if (ret < 0) - goto error; - - if (!trusted && untrusted_error) { - pr_err("PKCS#7 signature not signed with a trusted key\n"); - ret = untrusted_error; + ret = pkcs7_validate_trust(pkcs7, trusted_keys); + if (ret < 0) { + if (ret == -ENOKEY) + pr_err("PKCS#7 signature not signed with a trusted key\n"); goto error; } |