KEYS: Reserve an extra certificate symbol for inserting without recompiling

Place a system_extra_cert buffer of configurable size, right after the
system_certificate_list, so that inserted keys can be readily processed by
the existing mechanism. Added script takes a key file and a kernel image
and inserts its contents to the reserved area. The
system_certificate_list_size is also adjusted accordingly.

Call the script as:

    scripts/insert-sys-cert -b <vmlinux> -c <certfile>

If vmlinux has no symbol table, supply System.map file with -s flag.
Subsequent runs replace the previously inserted key, instead of appending
the new one.

Signed-off-by: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

1 files changed, 16 insertions, 0 deletions

diff --git a/certs/Kconfig b/certs/Kconfig
index b030b9c7ed34..f0f8a4433685 100644
--- a/certs/Kconfig
+++ b/certs/Kconfig
@@ -39,4 +39,20 @@ config SYSTEM_TRUSTED_KEYS
           form of DER-encoded *.x509 files in the top-level build directory,
           those are no longer used. You will need to set this option instead.
 
+config SYSTEM_EXTRA_CERTIFICATE
+        bool "Reserve area for inserting a certificate without recompiling"
+        depends on SYSTEM_TRUSTED_KEYRING
+        help
+          If set, space for an extra certificate will be reserved in the kernel
+          image. This allows introducing a trusted certificate to the default
+          system keyring without recompiling the kernel.
+
+config SYSTEM_EXTRA_CERTIFICATE_SIZE
+        int "Number of bytes to reserve for the extra certificate"
+        depends on SYSTEM_EXTRA_CERTIFICATE
+        default 4096
+        help
+          This is the number of bytes reserved in the kernel image for a
+          certificate to be inserted.
+
 endmenu