Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <20210217165058.1336155-1-eric.snowberg@oracle.com>
References: <20210217165058.1336155-1-eric.snowberg@oracle.com>
To:     Eric Snowberg <eric.snowberg@oracle.com>
Cc:     dhowells@redhat.com, jarkko@kernel.org, mic@linux.microsoft.com,
        dwmw2@infradead.org, keyrings@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] cert: Add kconfig dependency for validate_trust
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3524594.1614124044.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Tue, 23 Feb 2021 23:47:24 +0000
Message-ID: <3524595.1614124044@warthog.procyon.org.uk>
Precedence: bulk

Eric Snowberg <eric.snowberg@oracle.com> wrote:

> The kernel test robot reports when building with Kconfig
> CONFIG_INTEGRITY_PLATFORM_KEYRING defined and =

> CONFIG_SYSTEM_DATA_VERIFICATION undefined:
> =

> ld.lld: error: undefined symbol: pkcs7_validate_trust
> referenced by blacklist.c:128 (certs/blacklist.c:128)
>              blacklist.o:(is_key_on_revocation_list) in archive certs/bu=
ilt-in.a
> =

> Make CONFIG_SYSTEM_DATA_VERIFICATION a dependency for validate_trust.
> =

> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

I wonder if it's better to provide a separate config option for the revoca=
tion
list, say:

	config SYSTEM_REVOCATION_LIST
		bool "Add revocation certs to the blacklist keyring"
		depends on SYSTEM_BLACKLIST_KEYRING
		depends on PKCS7_MESSAGE_PARSER
		help
		  ...

and use that in blacklist.c.

In keys/system_keyring.h, is_key_on_revocation_list() can then be defaulte=
d to
return 0 if that is disabled.

Btw, I've just noticed that add_key_to_revocation_list() and
is_key_on_revocation_list() lack kernel doc comments.

David