path: root/certs/blacklist.c
diff options
authorEric Snowberg <>2021-01-22 13:10:53 -0500
committerDavid Howells <>2021-03-11 16:33:49 +0000
commitd1f044103dad70c1cec0a8f3abdf00834fec8b98 (patch)
treee45d2379279888aa5b242d12f49e51742a6018ac /certs/blacklist.c
parent2565ca7f5ec1a98d51eea8860c4ab923f1ca2c85 (diff)
certs: Add ability to preload revocation certs
Add a new Kconfig option called SYSTEM_REVOCATION_KEYS. If set, this option should be the filename of a PEM-formated file containing X.509 certificates to be included in the default blacklist keyring. DH Changes: - Make the new Kconfig option depend on SYSTEM_REVOCATION_LIST. - Fix SYSTEM_REVOCATION_KEYS=n, but CONFIG_SYSTEM_REVOCATION_LIST=y[1][2]. - Use CONFIG_SYSTEM_REVOCATION_LIST for extract-cert[3]. - Use CONFIG_SYSTEM_REVOCATION_LIST for revocation_certificates.o[3]. Signed-off-by: Eric Snowberg <> Acked-by: Jarkko Sakkinen <> Signed-off-by: David Howells <> cc: Randy Dunlap <> cc: Link: [1] Link: [2] Link: [3] Link: Link: # v5 Link: Link: # v2 Link: # v3
Diffstat (limited to 'certs/blacklist.c')
1 files changed, 21 insertions, 0 deletions
diff --git a/certs/blacklist.c b/certs/blacklist.c
index 2b8644123d5f..c9a435b15af4 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -17,9 +17,15 @@
#include <linux/uidgid.h>
#include <keys/system_keyring.h>
#include "blacklist.h"
+#include "common.h"
static struct key *blacklist_keyring;
+extern __initconst const u8 revocation_certificate_list[];
+extern __initconst const unsigned long revocation_certificate_list_size;
* The description must be a type prefix, a colon and then an even number of
* hex digits. The hash is kept in the description.
@@ -220,3 +226,18 @@ static int __init blacklist_init(void)
* Must be initialised before we try and load the keys into the keyring.
+ * Load the compiled-in list of revocation X.509 certificates.
+ */
+static __init int load_revocation_certificate_list(void)
+ if (revocation_certificate_list_size)
+ pr_notice("Loading compiled-in revocation X.509 certificates\n");
+ return load_certificate_list(revocation_certificate_list, revocation_certificate_list_size,
+ blacklist_keyring);