linux-kernel - Re: [PATCH v2] certs: Add EFI_CERT_X509

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <0D3BE738-67D5-41DB-B58E-FCD2ECD9A4F0@oracle.com>
Date:   Wed, 9 Sep 2020 16:44:37 -0600
From:   Eric Snowberg <eric.snowberg@...cle.com>
To:     Randy Dunlap <rdunlap@...radead.org>
Cc:     dhowells@...hat.com, dwmw2@...radead.org,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        herbert@...dor.apana.org.au, davem@...emloft.net,
        jmorris@...ei.org, serge@...lyn.com, nayna@...ux.ibm.com,
        Mimi Zohar <zohar@...ux.ibm.com>, erichte@...ux.ibm.com,
        mpe@...erman.id.au, keyrings@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: Re: [PATCH v2] certs: Add EFI_CERT_X509_GUID support for dbx entries


> On Sep 9, 2020, at 11:40 AM, Randy Dunlap <rdunlap@...radead.org> wrote:
> 
> On 9/9/20 10:27 AM, Eric Snowberg wrote:
>> diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
>> index 38ec7f5f9041..d8f2e0fdfbf4 100644
>> --- a/include/crypto/pkcs7.h
>> +++ b/include/crypto/pkcs7.h
>> @@ -26,11 +26,19 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
>> 				  const void **_data, size_t *_datalen,
>> 				  size_t *_headerlen);
>> 
>> +#ifdef CONFIG_PKCS7_MESSAGE_PARSER
>> /*
>>  * pkcs7_trust.c
>>  */
>> extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
>> 				struct key *trust_keyring);
>> +#else
>> +static inline int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
>> +				       struct key *trust_keyring)
>> +{
>> +	return -ENOKEY;
>> +}
>> +#endif
> 
> Just to be clear, you want to do the #else block when
> CONFIG_PKCS7_MESSAGE_PARSER=m.  Is that correct?
> 
> If so, it might be clearer to use
> 
> #if IS_BUILTIN(CONFIG_PKCS7_MESSAGE_PARSER)
> 

I just added this part to fix a build error when none of the
asymmetrical keys are defined within a config.  I failed to notice
CONFIG_PKCS7_MESSAGE_PARSER could be configured to build as a module
too.  The code I added that uses pkcs7_validate_trust is always 
builtin. Taking this into account, please disregard this patch.  
I will need to solve this a different way.  Thanks for pointing this 
out.