mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 07:16:21 +09:00
certs: Add wrapper function to check blacklisted binary hash
[ Upstream commit 2434f7d2d488c3301ae81f1031e1c66c6f076fb7 ] The -EKEYREJECTED error returned by existing is_hash_blacklisted() is misleading when called for checking against blacklisted hash of a binary. This patch adds a wrapper function is_binary_blacklisted() to return -EPERM error if binary is blacklisted. Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/1572492694-6520-7-git-send-email-zohar@linux.ibm.com Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
61168eafe0
commit
ac7d3f5544
|
@ -135,6 +135,15 @@ int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type)
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(is_hash_blacklisted);
|
EXPORT_SYMBOL_GPL(is_hash_blacklisted);
|
||||||
|
|
||||||
|
int is_binary_blacklisted(const u8 *hash, size_t hash_len)
|
||||||
|
{
|
||||||
|
if (is_hash_blacklisted(hash, hash_len, "bin") == -EKEYREJECTED)
|
||||||
|
return -EPERM;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
EXPORT_SYMBOL_GPL(is_binary_blacklisted);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Initialise the blacklist
|
* Initialise the blacklist
|
||||||
*/
|
*/
|
||||||
|
|
|
@ -35,12 +35,18 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
|
||||||
extern int mark_hash_blacklisted(const char *hash);
|
extern int mark_hash_blacklisted(const char *hash);
|
||||||
extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
|
extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
|
||||||
const char *type);
|
const char *type);
|
||||||
|
extern int is_binary_blacklisted(const u8 *hash, size_t hash_len);
|
||||||
#else
|
#else
|
||||||
static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
|
static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
|
||||||
const char *type)
|
const char *type)
|
||||||
{
|
{
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len)
|
||||||
|
{
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#ifdef CONFIG_IMA_BLACKLIST_KEYRING
|
#ifdef CONFIG_IMA_BLACKLIST_KEYRING
|
||||||
|
|
Loading…
Reference in New Issue
Block a user