On Thu, 2024-10-17 at 09:55 -0600, Eric Snowberg wrote: > Introduce system_key_link(), a new function to allow a keyring to > link > to a key contained within one of the system keyrings (builtin, > secondary, > or platform). Depending on how the kernel is built, if the machine > keyring is available, it will be checked as well, since it is linked > to > the secondary keyring. If the asymmetric key id matches a key within > one > of these system keyrings, the matching key is linked into the passed > in > keyring. > > Signed-off-by: Eric Snowberg <eric.snowberg@xxxxxxxxxx> > --- > certs/system_keyring.c | 30 ++++++++++++++++++++++++++++++ > include/keys/system_keyring.h | 7 ++++++- > 2 files changed, 36 insertions(+), 1 deletion(-) > > diff --git a/certs/system_keyring.c b/certs/system_keyring.c > index e344cee10d28..4abee7514442 100644 > --- a/certs/system_keyring.c > +++ b/certs/system_keyring.c > @@ -20,6 +20,9 @@ > static struct key *builtin_trusted_keys; > #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING > static struct key *secondary_trusted_keys; /* * Explain system_trusted_keys (nothing too detailed, only the gist) */ > +#define system_trusted_keys secondary_trusted_keys > +#else > +#define system_trusted_keys builtin_trusted_keys > #endif > #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING > static struct key *machine_trusted_keys; We have enough these to make this quite convoluted so let's put some helpful reminders. I would forget this in no time ;-) So if it comes down to that, please put something because I have a goldfish memory. BR, Jarkko
