[PATCH] ipe: fallback to platform keyring also if key in trusted keyring is rejected

[luca.boccassi at gmail.com]

From: Luca Boccassi <bluca at debian.org>

If enabled, we fallback to the platform keyring if the trusted keyring doesn't have
the key used to sign the roothash. But if pkcs7_verify() rejects the key for other
reasons, such as usage restrictions, we do not fallback. Do so, following the same
change in dm-verity.

Signed-off-by: Luca Boccassi <bluca at debian.org>
Suggested-by: Serge Hallyn <serge at hallyn.com>
---
The equivalent change in dm-verity was accepted, so apply it to IPE as well:
https://lore.kernel.org/all/63220688-ac55-e1fc-300d-c93a948801e3@redhat.com/

 security/ipe/policy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/ipe/policy.c b/security/ipe/policy.c
index 45f7d6a0ed23..b628f696e32b 100644
--- a/security/ipe/policy.c
+++ b/security/ipe/policy.c
@@ -178,7 +178,7 @@ struct ipe_policy *ipe_new_policy(const char *text, size_t textlen,
 					    VERIFYING_UNSPECIFIED_SIGNATURE,
 					    set_pkcs7_data, new);
 #ifdef CONFIG_IPE_POLICY_SIG_PLATFORM_KEYRING
-		if (rc == -ENOKEY)
+		if (rc == -ENOKEY || rc == -EKEYREJECTED)
 			rc = verify_pkcs7_signature(NULL, 0, new->pkcs7, pkcs7len,
 						    VERIFY_USE_PLATFORM_KEYRING,
 						    VERIFYING_UNSPECIFIED_SIGNATURE,
-- 
2.39.5