mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-16 04:04:06 +00:00
KEYS: Make use of platform keyring for module signature verify
This patch completes commit 278311e417
("kexec, KEYS: Make use of
platform keyring for signature verify") which, while adding the
platform keyring for bzImage verification, neglected to also add
this keyring for module verification.
As such, kernel modules signed with keys from the MokList variable
were not successfully verified.
Signed-off-by: Robert Holmes <robeholmes@gmail.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
This commit is contained in:
parent
52b359368f
commit
8140934dbc
1 changed files with 8 additions and 1 deletions
|
@ -38,8 +38,15 @@ int mod_verify_sig(const void *mod, struct load_info *info)
|
|||
modlen -= sig_len + sizeof(ms);
|
||||
info->len = modlen;
|
||||
|
||||
return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
||||
ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
||||
VERIFY_USE_SECONDARY_KEYRING,
|
||||
VERIFYING_MODULE_SIGNATURE,
|
||||
NULL, NULL);
|
||||
if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
|
||||
ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
||||
VERIFY_USE_PLATFORM_KEYRING,
|
||||
VERIFYING_MODULE_SIGNATURE,
|
||||
NULL, NULL);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
|
Loading…
Add table
Reference in a new issue