diff options
| author | David Howells <dhowells@redhat.com> | 2016-04-06 16:14:24 +0100 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2016-04-06 16:14:24 +0100 |
| commit | 6ffe54807bf7228798dc6f695d68332a02f39d28 (patch) | |
| tree | 9c6c1e6b1348affa0f4e54af4b7ac3b206233ea0 /crypto/asymmetric_keys/verify_pefile.c | |
| parent | b8cc7ddcdc1f06b141f4f0382e0d1bb5f67c8d3b (diff) | |
| download | linux-crypto-6ffe54807bf7228798dc6f695d68332a02f39d28.tar.gz linux-crypto-6ffe54807bf7228798dc6f695d68332a02f39d28.zip | |
PKCS#7: Make trust determination dependent on contents of trust keyring
Make the determination of the trustworthiness of a key dependent on whether
a key that can verify it is present in the supplied ring of trusted keys
rather than whether or not the verifying key has KEY_FLAG_TRUSTED set.
verify_pkcs7_signature() will return -ENOKEY if the PKCS#7 message trust
chain cannot be verified.
Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'crypto/asymmetric_keys/verify_pefile.c')
| -rw-r--r-- | crypto/asymmetric_keys/verify_pefile.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c index 26535107..672a94c2 100644 --- a/crypto/asymmetric_keys/verify_pefile.c +++ b/crypto/asymmetric_keys/verify_pefile.c @@ -436,7 +436,7 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen, ret = verify_pkcs7_signature(NULL, 0, pebuf + ctx.sig_offset, ctx.sig_len, - trusted_keys, -EKEYREJECTED, usage, + trusted_keys, usage, mscode_parse, &ctx); if (ret < 0) goto error; |