Re: [PATCH v5 08/12] KEYS: integrity: change link restriction to trust the machine keyring
From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2021-09-09 17:27:43
Also in:
keyrings, linux-crypto, linux-integrity, lkml
Hi Eric, On Tue, 2021-09-07 at 12:01 -0400, Eric Snowberg wrote:
quoted hunk ↗ jump to hunk
diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 955bd57815f4..747f0c528fec 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c@@ -89,7 +89,10 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void if (!restriction) panic("Can't allocate secondary trusted keyring restriction\n"); - restriction->check = restrict_link_by_builtin_and_secondary_trusted; + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + restriction->check = restrict_link_by_builtin_secondary_and_ca_trusted;
Returning the new restriction in a function named get_builtin_and_secondary_restriction() is kind of weird. Renaming the function to get_secondary_restriction() would be clearer. thanks, Mimi