pefile: Validate PKCS#7 trust chain

Validate the PKCS#7 trust chain against the contents of the system keyring.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Vivek Goyal <vgoyal@redhat.com>

diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 029a36510e805e0dec72f7007a372e2896c909af..79175e6ea0b28493f26079d5a17926e0aab63984 100644 (file)
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -449,7 +449,7 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
        if (ret < 0)
                goto error;
 
-       ret = -ENOANO; // Not yet complete
+       ret = pkcs7_validate_trust(pkcs7, trusted_keyring, _trusted);
 
 error:
        pkcs7_free_message(ctx.pkcs7);