Re: [PATCH v2] certs: Add EFI_CERT_X509_GUID support for dbx entries

On Sep 9, 2020, at 11:40 AM, Randy Dunlap [off-list ref] wrote:

On 9/9/20 10:27 AM, Eric Snowberg wrote:

quoted

diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
index 38ec7f5f9041..d8f2e0fdfbf4 100644
--- a/include/crypto/pkcs7.h
+++ b/include/crypto/pkcs7.h

@@ -26,11 +26,19 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,

				  const void **_data, size_t *_datalen,
				  size_t *_headerlen);

+#ifdef CONFIG_PKCS7_MESSAGE_PARSER
/*
 * pkcs7_trust.c
 */
extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
				struct key *trust_keyring);
+#else
+static inline int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
+				       struct key *trust_keyring)
+{
+	return -ENOKEY;
+}
+#endif

Just to be clear, you want to do the #else block when
CONFIG_PKCS7_MESSAGE_PARSER=m.  Is that correct?

If so, it might be clearer to use

#if IS_BUILTIN(CONFIG_PKCS7_MESSAGE_PARSER)

I just added this part to fix a build error when none of the
asymmetrical keys are defined within a config.  I failed to notice
CONFIG_PKCS7_MESSAGE_PARSER could be configured to build as a module
too.  The code I added that uses pkcs7_validate_trust is always 
builtin. Taking this into account, please disregard this patch.  
I will need to solve this a different way.  Thanks for pointing this 
out.