include/keys/system_keyring.h

   1 /* SPDX-License-Identifier: GPL-2.0-or-later */
   2 /* System keyring containing trusted public keys.
   3  *
   4  * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
   5  * Written by David Howells (dhowells@redhat.com)
   6  */
   7
   8 #ifndef _KEYS_SYSTEM_KEYRING_H
   9 #define _KEYS_SYSTEM_KEYRING_H
  10
  11 #include <linux/key.h>
  12
  13 enum blacklist_hash_type {
  14         /* TBSCertificate hash */
  15         BLACKLIST_HASH_X509_TBS = 1,
  16         /* Raw data hash */
  17         BLACKLIST_HASH_BINARY = 2,
  18 };
  19
  20 #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
  21
  22 extern int restrict_link_by_builtin_trusted(struct key *keyring,
  23                                             const struct key_type *type,
  24                                             const union key_payload *payload,
  25                                             struct key *restriction_key);
  26 int restrict_link_by_digsig_builtin(struct key *dest_keyring,
  27                                     const struct key_type *type,
  28                                     const union key_payload *payload,
  29                                     struct key *restriction_key);
  30 extern __init int load_module_cert(struct key *keyring);
  31
  32 #else
  33 #define restrict_link_by_builtin_trusted restrict_link_reject
  34 #define restrict_link_by_digsig_builtin restrict_link_reject
  35
  36 static inline __init int load_module_cert(struct key *keyring)
  37 {
  38         return 0;
  39 }
  40
  41 #endif
  42
  43 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
  44 extern int restrict_link_by_builtin_and_secondary_trusted(
  45         struct key *keyring,
  46         const struct key_type *type,
  47         const union key_payload *payload,
  48         struct key *restriction_key);
  49 int restrict_link_by_digsig_builtin_and_secondary(struct key *keyring,
  50                                                   const struct key_type *type,
  51                                                   const union key_payload *payload,
  52                                                   struct key *restriction_key);
  53 void __init add_to_secondary_keyring(const char *source, const void *data, size_t len);
  54 #else
  55 #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
  56 #define restrict_link_by_digsig_builtin_and_secondary restrict_link_by_digsig_builtin
  57 static inline void __init add_to_secondary_keyring(const char *source, const void *data, size_t len)
  58 {
  59 }
  60 #endif
  61
  62 #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
  63 extern int restrict_link_by_builtin_secondary_and_machine(
  64         struct key *dest_keyring,
  65         const struct key_type *type,
  66         const union key_payload *payload,
  67         struct key *restrict_key);
  68 extern void __init set_machine_trusted_keys(struct key *keyring);
  69 #else
  70 #define restrict_link_by_builtin_secondary_and_machine restrict_link_by_builtin_trusted
  71 static inline void __init set_machine_trusted_keys(struct key *keyring)
  72 {
  73 }
  74 #endif
  75
  76 extern struct pkcs7_message *pkcs7;
  77 #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
  78 extern int mark_hash_blacklisted(const u8 *hash, size_t hash_len,
  79                                enum blacklist_hash_type hash_type);
  80 extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
  81                                enum blacklist_hash_type hash_type);
  82 extern int is_binary_blacklisted(const u8 *hash, size_t hash_len);
  83 #else
  84 static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
  85                                       enum blacklist_hash_type hash_type)
  86 {
  87         return 0;
  88 }
  89
  90 static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len)
  91 {
  92         return 0;
  93 }
  94 #endif
  95
  96 #ifdef CONFIG_SYSTEM_REVOCATION_LIST
  97 extern int add_key_to_revocation_list(const char *data, size_t size);
  98 extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7);
  99 #else
 100 static inline int add_key_to_revocation_list(const char *data, size_t size)
 101 {
 102         return 0;
 103 }
 104 static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7)
 105 {
 106         return -ENOKEY;
 107 }
 108 #endif
 109
 110 #ifdef CONFIG_IMA_BLACKLIST_KEYRING
 111 extern struct key *ima_blacklist_keyring;
 112
 113 static inline struct key *get_ima_blacklist_keyring(void)
 114 {
 115         return ima_blacklist_keyring;
 116 }
 117 #else
 118 static inline struct key *get_ima_blacklist_keyring(void)
 119 {
 120         return NULL;
 121 }
 122 #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
 123
 124 #if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \
 125         defined(CONFIG_SYSTEM_TRUSTED_KEYRING)
 126 extern void __init set_platform_trusted_keys(struct key *keyring);
 127 #else
 128 static inline void set_platform_trusted_keys(struct key *keyring)
 129 {
 130 }
 131 #endif
 132
 133 #endif /* _KEYS_SYSTEM_KEYRING_H */