KEYS: verify a certificate is signed by a 'trusted' key
authorMimi Zohar <zohar@linux.vnet.ibm.com>
Tue, 20 Aug 2013 18:36:27 +0000 (14:36 -0400)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Thu, 17 Jul 2014 13:35:15 +0000 (09:35 -0400)
commit3be4beaf7c91ec9c6fefa5f11173af37113d10ae
treec4007c5fc0ddd6bccb279fbae8a5ee52f7af01de
parenta4e3b8d79a5c6d40f4a9703abf7fe3abcc6c3b8d
KEYS: verify a certificate is signed by a 'trusted' key

Only public keys, with certificates signed by an existing
'trusted' key on the system trusted keyring, should be added
to a trusted keyring.  This patch adds support for verifying
a certificate's signature.

This is derived from David Howells pkcs7_request_asymmetric_key() patch.

Changelog v6:
- on error free key - Dmitry
- validate trust only for not already trusted keys - Dmitry
- formatting cleanup

Changelog:
- define get_system_trusted_keyring() to fix kbuild issues

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
crypto/asymmetric_keys/x509_public_key.c
include/keys/system_keyring.h