diff options
| author | Mickaël Salaün <mic@linux.microsoft.com> | 2020-10-23 19:05:12 +0200 |
|---|---|---|
| committer | Mike Snitzer <snitzer@redhat.com> | 2020-12-05 00:04:35 +0100 |
| commit | 4da8f8c8a1e07ad18f057f4044ad96f4135dc877 (patch) | |
| tree | 99247a48d846727f3288051098cf927be70f55a1 /drivers/md/dm-verity-verify-sig.c | |
| parent | dm: remove unnecessary current->bio_list check when submitting split bio (diff) | |
| download | linux-4da8f8c8a1e07ad18f057f4044ad96f4135dc877.tar.xz linux-4da8f8c8a1e07ad18f057f4044ad96f4135dc877.zip | |
dm verity: Add support for signature verification with 2nd keyring
Add a new configuration DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
to enable dm-verity signatures to be verified against the secondary
trusted keyring. Instead of relying on the builtin trusted keyring
(with hard-coded certificates), the second trusted keyring can include
certificate authorities from the builtin trusted keyring and child
certificates loaded at run time. Using the secondary trusted keyring
enables to use dm-verity disks (e.g. loop devices) signed by keys which
did not exist at kernel build time, leveraging the certificate chain of
trust model. In practice, this makes it possible to update certificates
without kernel update and reboot, aligning with module and kernel
(kexec) signature verification which already use the secondary trusted
keyring.
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Diffstat (limited to 'drivers/md/dm-verity-verify-sig.c')
| -rw-r--r-- | drivers/md/dm-verity-verify-sig.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c index 614e43db93aa..29385dc470d5 100644 --- a/drivers/md/dm-verity-verify-sig.c +++ b/drivers/md/dm-verity-verify-sig.c @@ -119,8 +119,13 @@ int verity_verify_root_hash(const void *root_hash, size_t root_hash_len, } ret = verify_pkcs7_signature(root_hash, root_hash_len, sig_data, - sig_len, NULL, VERIFYING_UNSPECIFIED_SIGNATURE, - NULL, NULL); + sig_len, +#ifdef CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING + VERIFY_USE_SECONDARY_KEYRING, +#else + NULL, +#endif + VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL); return ret; } |