PKCS#7: Make trust determination dependent on contents of trust keyring

Browse source

Make the determination of the trustworthiness of a key dependent on whether
a key that can verify it is present in the supplied ring of trusted keys
rather than whether or not the verifying key has KEY_FLAG_TRUSTED set.

verify_pkcs7_signature() will return -ENOKEY if the PKCS#7 message trust
chain cannot be verified.

Signed-off-by: David Howells <dhowells@redhat.com>

...

This commit is contained in:

David Howells 2016-04-06 16:14:24 +01:00

parent e68503bd68

commit bda850cd21

9 changed files with 11 additions and 32 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/crypto/pkcs7.h

View file

1

include/linux/verification.h

View file