system_keyring.h 2.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /* System keyring containing trusted public keys.
  3. *
  4. * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #ifndef _KEYS_SYSTEM_KEYRING_H
  8. #define _KEYS_SYSTEM_KEYRING_H
  9. #include <linux/key.h>
  10. #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
  11. extern int restrict_link_by_builtin_trusted(struct key *keyring,
  12. const struct key_type *type,
  13. const union key_payload *payload,
  14. struct key *restriction_key);
  15. #else
  16. #define restrict_link_by_builtin_trusted restrict_link_reject
  17. #endif
  18. #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
  19. extern int restrict_link_by_builtin_and_secondary_trusted(
  20. struct key *keyring,
  21. const struct key_type *type,
  22. const union key_payload *payload,
  23. struct key *restriction_key);
  24. #else
  25. #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
  26. #endif
  27. extern struct pkcs7_message *pkcs7;
  28. #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
  29. extern int mark_hash_blacklisted(const char *hash);
  30. extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
  31. const char *type);
  32. extern int is_binary_blacklisted(const u8 *hash, size_t hash_len);
  33. #else
  34. static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
  35. const char *type)
  36. {
  37. return 0;
  38. }
  39. static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len)
  40. {
  41. return 0;
  42. }
  43. #endif
  44. #ifdef CONFIG_SYSTEM_REVOCATION_LIST
  45. extern int add_key_to_revocation_list(const char *data, size_t size);
  46. extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7);
  47. #else
  48. static inline int add_key_to_revocation_list(const char *data, size_t size)
  49. {
  50. return 0;
  51. }
  52. static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7)
  53. {
  54. return -ENOKEY;
  55. }
  56. #endif
  57. #ifdef CONFIG_IMA_BLACKLIST_KEYRING
  58. extern struct key *ima_blacklist_keyring;
  59. static inline struct key *get_ima_blacklist_keyring(void)
  60. {
  61. return ima_blacklist_keyring;
  62. }
  63. #else
  64. static inline struct key *get_ima_blacklist_keyring(void)
  65. {
  66. return NULL;
  67. }
  68. #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
  69. #if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \
  70. defined(CONFIG_SYSTEM_TRUSTED_KEYRING)
  71. extern void __init set_platform_trusted_keys(struct key *keyring);
  72. #else
  73. static inline void set_platform_trusted_keys(struct key *keyring)
  74. {
  75. }
  76. #endif
  77. #endif /* _KEYS_SYSTEM_KEYRING_H */