path: root/scripts
diff options
authorLinus Torvalds <>2021-04-26 08:38:10 -0700
committerLinus Torvalds <>2021-04-26 08:38:10 -0700
commitb0e22b47f650b53dbb094cd0011a48f6f3ae3e29 (patch)
tree1fff058e8140ea312b1bad64750469fa4469986d /scripts
parent87f27e7b189f54a9e928efb4ea98bf375708ff1f (diff)
parentebd9c2ae369a45bdd9f8615484db09be58fc242b (diff)
Merge tag 'keys-cve-2020-26541-v3' of git://
Pull x509 dbx/mokx UEFI support from David Howells: "Here's a set of patches from Eric Snowberg[1] that add support for EFI_CERT_X509_GUID entries in the dbx and mokx UEFI tables (such entries cause matching certificates to be rejected). These are currently ignored and only the hash entries are made use of. Additionally Eric included his patches to allow such certificates to be preloaded. These patches deal with CVE-2020-26541. To quote Eric: 'This is the fifth patch series for adding support for EFI_CERT_X509_GUID entries [2]. It has been expanded to not only include dbx entries but also entries in the mokx. Additionally my series to preload these certificate [3] has also been included'" Link: [1] Link: [2] Link: [3] * tag 'keys-cve-2020-26541-v3' of git:// integrity: Load mokx variables into the blacklist keyring certs: Add ability to preload revocation certs certs: Move load_system_certificate_list to a common function certs: Add EFI_CERT_X509_GUID support for dbx entries
Diffstat (limited to 'scripts')
1 files changed, 1 insertions, 0 deletions
diff --git a/scripts/Makefile b/scripts/Makefile
index c36106bce80e..9adb6d247818 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -14,6 +14,7 @@ hostprogs-always-$(CONFIG_ASN1) += asn1_compiler
hostprogs-always-$(CONFIG_MODULE_SIG_FORMAT) += sign-file
hostprogs-always-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += extract-cert
hostprogs-always-$(CONFIG_SYSTEM_EXTRA_CERTIFICATE) += insert-sys-cert
+hostprogs-always-$(CONFIG_SYSTEM_REVOCATION_LIST) += extract-cert
HOSTCFLAGS_sorttable.o = -I$(srctree)/tools/include
HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include