Re: [RFC PATCH 1/2] integrity, KEYS: add a reference to platform keyring

2019-01-09 Thread Mimi Zohar
On Thu, 2019-01-10 at 00:48 +0800, Kairui Song wrote: > Currently kexec_file_load will verify the kernel image being loaded > against .builtin_trusted_keys or .secondary_trusted_keys, but the > image could be signed with third part keys which will be provided by > platform or firmware and the keys

[RFC PATCH 1/2] integrity, KEYS: add a reference to platform keyring

2019-01-09 Thread Kairui Song
Currently kexec_file_load will verify the kernel image being loaded against .builtin_trusted_keys or .secondary_trusted_keys, but the image could be signed with third part keys which will be provided by platform or firmware and the keys won't be available in keyrings mentioned above. After commit