1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /* System keyring containing trusted public keys.
3 *
4 * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8 #ifndef _KEYS_SYSTEM_KEYRING_H
9 #define _KEYS_SYSTEM_KEYRING_H
10
11 #include <linux/key.h>
12
13 enum blacklist_hash_type {
14 /* TBSCertificate hash */
15 BLACKLIST_HASH_X509_TBS = 1,
16 /* Raw data hash */
17 BLACKLIST_HASH_BINARY = 2,
18 };
19
20 #ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
21
22 extern int restrict_link_by_builtin_trusted(struct key *keyring,
23 const struct key_type *type,
24 const union key_payload *payload,
25 struct key *restriction_key);
26 int restrict_link_by_digsig_builtin(struct key *dest_keyring,
27 const struct key_type *type,
28 const union key_payload *payload,
29 struct key *restriction_key);
30 extern __init int load_module_cert(struct key *keyring);
31
32 #else
33 #define restrict_link_by_builtin_trusted restrict_link_reject
34 #define restrict_link_by_digsig_builtin restrict_link_reject
35
load_module_cert(struct key * keyring)36 static inline __init int load_module_cert(struct key *keyring)
37 {
38 return 0;
39 }
40
41 #endif
42
43 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
44 extern int restrict_link_by_builtin_and_secondary_trusted(
45 struct key *keyring,
46 const struct key_type *type,
47 const union key_payload *payload,
48 struct key *restriction_key);
49 int restrict_link_by_digsig_builtin_and_secondary(struct key *keyring,
50 const struct key_type *type,
51 const union key_payload *payload,
52 struct key *restriction_key);
53 void __init add_to_secondary_keyring(const char *source, const void *data, size_t len);
54 #else
55 #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
56 #define restrict_link_by_digsig_builtin_and_secondary restrict_link_by_digsig_builtin
add_to_secondary_keyring(const char * source,const void * data,size_t len)57 static inline void __init add_to_secondary_keyring(const char *source, const void *data, size_t len)
58 {
59 }
60 #endif
61
62 #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
63 extern int restrict_link_by_builtin_secondary_and_machine(
64 struct key *dest_keyring,
65 const struct key_type *type,
66 const union key_payload *payload,
67 struct key *restrict_key);
68 extern void __init set_machine_trusted_keys(struct key *keyring);
69 #else
70 #define restrict_link_by_builtin_secondary_and_machine restrict_link_by_builtin_trusted
set_machine_trusted_keys(struct key * keyring)71 static inline void __init set_machine_trusted_keys(struct key *keyring)
72 {
73 }
74 #endif
75
76 extern struct pkcs7_message *pkcs7;
77 #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
78 extern int mark_hash_blacklisted(const u8 *hash, size_t hash_len,
79 enum blacklist_hash_type hash_type);
80 extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
81 enum blacklist_hash_type hash_type);
82 extern int is_binary_blacklisted(const u8 *hash, size_t hash_len);
83 #else
is_hash_blacklisted(const u8 * hash,size_t hash_len,enum blacklist_hash_type hash_type)84 static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
85 enum blacklist_hash_type hash_type)
86 {
87 return 0;
88 }
89
is_binary_blacklisted(const u8 * hash,size_t hash_len)90 static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len)
91 {
92 return 0;
93 }
94 #endif
95
96 #ifdef CONFIG_SYSTEM_REVOCATION_LIST
97 extern int add_key_to_revocation_list(const char *data, size_t size);
98 extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7);
99 #else
add_key_to_revocation_list(const char * data,size_t size)100 static inline int add_key_to_revocation_list(const char *data, size_t size)
101 {
102 return 0;
103 }
is_key_on_revocation_list(struct pkcs7_message * pkcs7)104 static inline int is_key_on_revocation_list(struct pkcs7_message *pkcs7)
105 {
106 return -ENOKEY;
107 }
108 #endif
109
110 #ifdef CONFIG_IMA_BLACKLIST_KEYRING
111 extern struct key *ima_blacklist_keyring;
112
get_ima_blacklist_keyring(void)113 static inline struct key *get_ima_blacklist_keyring(void)
114 {
115 return ima_blacklist_keyring;
116 }
117 #else
get_ima_blacklist_keyring(void)118 static inline struct key *get_ima_blacklist_keyring(void)
119 {
120 return NULL;
121 }
122 #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
123
124 #if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \
125 defined(CONFIG_SYSTEM_TRUSTED_KEYRING)
126 extern void __init set_platform_trusted_keys(struct key *keyring);
127 #else
set_platform_trusted_keys(struct key * keyring)128 static inline void set_platform_trusted_keys(struct key *keyring)
129 {
130 }
131 #endif
132
133 #endif /* _KEYS_SYSTEM_KEYRING_H */
134
