blob: c1a96fdf598bc26346e5581769736cdfbf574b12 [file] [log] [blame]
Thomas Gleixnerb4d0d232019-05-20 19:08:01 +02001/* SPDX-License-Identifier: GPL-2.0-or-later */
David Howellsb56e5a12013-08-30 16:07:30 +01002/* System keyring containing trusted public keys.
3 *
4 * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
David Howellsb56e5a12013-08-30 16:07:30 +01006 */
7
8#ifndef _KEYS_SYSTEM_KEYRING_H
9#define _KEYS_SYSTEM_KEYRING_H
10
David Howellsa511e1a2016-04-06 16:14:26 +010011#include <linux/key.h>
12
David Howellsb56e5a12013-08-30 16:07:30 +010013#ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
14
David Howellsa511e1a2016-04-06 16:14:26 +010015extern int restrict_link_by_builtin_trusted(struct key *keyring,
16 const struct key_type *type,
Mat Martineauaaf66c82016-08-30 11:33:13 -070017 const union key_payload *payload,
18 struct key *restriction_key);
David Howellsb56e5a12013-08-30 16:07:30 +010019
Mimi Zohar3be4bea2013-08-20 14:36:27 -040020#else
David Howellsa511e1a2016-04-06 16:14:26 +010021#define restrict_link_by_builtin_trusted restrict_link_reject
David Howellsb56e5a12013-08-30 16:07:30 +010022#endif
23
David Howellsd3bfe842016-04-06 16:14:27 +010024#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
25extern int restrict_link_by_builtin_and_secondary_trusted(
26 struct key *keyring,
27 const struct key_type *type,
Mat Martineauaaf66c82016-08-30 11:33:13 -070028 const union key_payload *payload,
29 struct key *restriction_key);
David Howellsd3bfe842016-04-06 16:14:27 +010030#else
31#define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
32#endif
33
David Howells734114f2017-04-03 16:07:24 +010034#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
35extern int mark_hash_blacklisted(const char *hash);
36extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
37 const char *type);
38#else
39static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
40 const char *type)
41{
42 return 0;
43}
44#endif
45
David Howells56104cf2016-04-07 09:45:23 +010046#ifdef CONFIG_IMA_BLACKLIST_KEYRING
Petko Manolov41c89b62015-12-02 17:47:55 +020047extern struct key *ima_blacklist_keyring;
48
Petko Manolov41c89b62015-12-02 17:47:55 +020049static inline struct key *get_ima_blacklist_keyring(void)
50{
51 return ima_blacklist_keyring;
52}
53#else
Petko Manolov41c89b62015-12-02 17:47:55 +020054static inline struct key *get_ima_blacklist_keyring(void)
55{
56 return NULL;
57}
David Howells56104cf2016-04-07 09:45:23 +010058#endif /* CONFIG_IMA_BLACKLIST_KEYRING */
Petko Manolov41c89b62015-12-02 17:47:55 +020059
Kairui Song219a3e82019-01-21 17:59:28 +080060#if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \
61 defined(CONFIG_SYSTEM_TRUSTED_KEYRING)
62extern void __init set_platform_trusted_keys(struct key *keyring);
63#else
64static inline void set_platform_trusted_keys(struct key *keyring)
65{
66}
67#endif
Petko Manolov41c89b62015-12-02 17:47:55 +020068
David Howellsb56e5a12013-08-30 16:07:30 +010069#endif /* _KEYS_SYSTEM_KEYRING_H */