diff options
| author | David Howells <dhowells@redhat.com> | 2022-05-18 19:15:34 +0300 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2022-06-21 18:05:12 +0300 |
| commit | 3cde3174eb910513d32a9ec8a9b95ea59be833df (patch) | |
| tree | 41ec5b5f807d1f7f04c5d95d2e8caf82e734238b /crypto/asymmetric_keys/x509_public_key.c | |
| parent | 60050ffe3d770dd1df5b641aa48f49d07a54bd84 (diff) | |
| download | linux-3cde3174eb910513d32a9ec8a9b95ea59be833df.tar.xz | |
certs: Add FIPS selftests
Add some selftests for signature checking when FIPS mode is enabled. These
need to be done before we start actually using the signature checking for
things and must panic the kernel upon failure.
Note that the tests must not check the blacklist lest this provide a way to
prevent a kernel from booting by installing a hash of a test key in the
appropriate UEFI table.
Reported-by: Simo Sorce <simo@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
Link: https://lore.kernel.org/r/165515742832.1554877.2073456606206090838.stgit@warthog.procyon.org.uk/
Diffstat (limited to 'crypto/asymmetric_keys/x509_public_key.c')
| -rw-r--r-- | crypto/asymmetric_keys/x509_public_key.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c index 77ed4e93ad56..0b4943a4592b 100644 --- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -244,9 +244,15 @@ static struct asymmetric_key_parser x509_key_parser = { /* * Module stuff */ +extern int __init certs_selftest(void); static int __init x509_key_init(void) { - return register_asymmetric_key_parser(&x509_key_parser); + int ret; + + ret = register_asymmetric_key_parser(&x509_key_parser); + if (ret < 0) + return ret; + return fips_signature_selftest(); } static void __exit x509_key_exit(void) |