diff options
| author | Nayna Jain <nayna@linux.ibm.com> | 2019-11-10 21:10:36 -0600 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2019-11-13 00:33:23 +1100 |
| commit | 8220e22d11a05049aab9693839ab82e5e177ccde (patch) | |
| tree | 565ae2c0ff755e7454f137a03bfc3e63870d8060 /security/integrity/Kconfig | |
| parent | ad723674d6758478829ee766e3f1a2a24d56236f (diff) | |
| download | lwn-8220e22d11a05049aab9693839ab82e5e177ccde.tar.gz lwn-8220e22d11a05049aab9693839ab82e5e177ccde.zip | |
powerpc: Load firmware trusted keys/hashes into kernel keyring
The keys used to verify the Host OS kernel are managed by firmware as
secure variables. This patch loads the verification keys into the
.platform keyring and revocation hashes into .blacklist keyring. This
enables verification and loading of the kernels signed by the boot
time keys which are trusted by firmware.
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Eric Richter <erichte@linux.ibm.com>
[mpe: Search by compatible in load_powerpc_certs(), not using format]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1573441836-3632-5-git-send-email-nayna@linux.ibm.com
Diffstat (limited to 'security/integrity/Kconfig')
| -rw-r--r-- | security/integrity/Kconfig | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 0bae6adb63a9..71f0177e8716 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -72,6 +72,15 @@ config LOAD_IPL_KEYS depends on S390 def_bool y +config LOAD_PPC_KEYS + bool "Enable loading of platform and blacklisted keys for POWER" + depends on INTEGRITY_PLATFORM_KEYRING + depends on PPC_SECURE_BOOT + default y + help + Enable loading of keys to the .platform keyring and blacklisted + hashes to the .blacklist keyring for powerpc based platforms. + config INTEGRITY_AUDIT bool "Enables integrity auditing support " depends on AUDIT |