KEYS: Separate the kernel signature checking keyring from module signing

Separate the kernel signature checking keyring from module signing so that it
can be used by code other than the module-signing code.

Signed-off-by: David Howells <dhowells@redhat.com>

1 files changed, 12 insertions, 0 deletions

diff --git a/kernel/system_certificates.S b/kernel/system_certificates.S
new file mode 100644
index 000000000000..552d47b2d463
--- /dev/null
+++ b/kernel/system_certificates.S
@@ -0,0 +1,12 @@
+#include <linux/export.h>
+#include <linux/init.h>
+
+#define GLOBAL(name)    \
+        .globl VMLINUX_SYMBOL(name);    \
+        VMLINUX_SYMBOL(name):
+
+        __INITRODATA
+
+GLOBAL(system_certificate_list)
+        .incbin "kernel/x509_certificate_list"
+GLOBAL(system_certificate_list_end)