Commit 579b2ba4 authored by Luca Boccassi's avatar Luca Boccassi Committed by Mikulas Patocka
Browse files

dm verity: fallback to platform keyring also if key in trusted keyring is rejected 



If enabled, we fallback to the platform keyring if the trusted keyring doesn't have
the key used to sign the roothash. But if pkcs7_verify() rejects the key for other
reasons, such as usage restrictions, we do not fallback. Do so.

Follow-up for 6fce1f40

Suggested-by: default avatarSerge Hallyn <serge@hallyn.com>
Signed-off-by: default avatarLuca Boccassi <bluca@debian.org>
Acked-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
parent e6a3531d

drivers/md/dm-verity-verify-sig.c

+1 −1
Original line number Diff line number Diff line
@@ -127,7 +127,7 @@ int verity_verify_root_hash(const void *root_hash, size_t root_hash_len, 
#endif

				VERIFYING_UNSPECIFIED_SIGNATURE, NULL, NULL);

#ifdef CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING

	if (ret == -ENOKEY)

	if (ret == -ENOKEY || ret == -EKEYREJECTED)

		ret = verify_pkcs7_signature(root_hash, root_hash_len, sig_data,

					sig_len,

					VERIFY_USE_PLATFORM_KEYRING,