lkml.org 
[lkml]   [2021]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] cert: Add kconfig dependency for validate_trust
Date
Eric Snowberg <eric.snowberg@oracle.com> wrote:

> The kernel test robot reports when building with Kconfig
> CONFIG_INTEGRITY_PLATFORM_KEYRING defined and
> CONFIG_SYSTEM_DATA_VERIFICATION undefined:
>
> ld.lld: error: undefined symbol: pkcs7_validate_trust
> referenced by blacklist.c:128 (certs/blacklist.c:128)
> blacklist.o:(is_key_on_revocation_list) in archive certs/built-in.a
>
> Make CONFIG_SYSTEM_DATA_VERIFICATION a dependency for validate_trust.
>
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

I wonder if it's better to provide a separate config option for the revocation
list, say:

config SYSTEM_REVOCATION_LIST
bool "Add revocation certs to the blacklist keyring"
depends on SYSTEM_BLACKLIST_KEYRING
depends on PKCS7_MESSAGE_PARSER
help
...

and use that in blacklist.c.

In keys/system_keyring.h, is_key_on_revocation_list() can then be defaulted to
return 0 if that is disabled.

Btw, I've just noticed that add_key_to_revocation_list() and
is_key_on_revocation_list() lack kernel doc comments.

David

\
 
 \ /
  Last update: 2021-02-24 01:48    [W:0.360 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site