imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-28 12:53:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

ipe: fallback to platform keyring also if key in trusted keyring is rejected

Browse Source 
If enabled, we fallback to the platform keyring if the trusted keyring
doesn't have the key used to sign the ipe policy. But if pkcs7_verify()
rejects the key for other reasons, such as usage restrictions, we do not
fallback. Do so, following the same change in dm-verity.

Signed-off-by: Luca Boccassi <[email protected]>
Suggested-by: Serge Hallyn <[email protected]>
[FW: fixed some line length issues and a typo in the commit message]
Signed-off-by: Fan Wu <[email protected]>
This commit is contained in:
Luca Boccassi authored and Fan Wu committed 2024-10-18 12:14:53 -07:00
1 parent 02e2f9aa33
commit f40998a8e6
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
security/ipe/policy.c
+1 -1
View File
@@ -178,7 +178,7 @@ struct ipe_policy *ipe_new_policy(const char *text, size_t textlen,
VERIFYING_UNSPECIFIED_SIGNATURE,
set_pkcs7_data, new);
#ifdef CONFIG_IPE_POLICY_SIG_PLATFORM_KEYRING
if (rc == -ENOKEY)
if (rc == -ENOKEY || rc == -EKEYREJECTED)
rc = verify_pkcs7_signature(NULL, 0, new->pkcs7, pkcs7len,
VERIFY_USE_PLATFORM_KEYRING,
VERIFYING_UNSPECIFIED_SIGNATURE,