I am trying to use certificate chain verification in Linux kernel.
The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA.
The credentials created by these scripts are:
ima-local-ca.pem: Private key used to sign keys
ima-local-ca.x509: Self signed public key to be compiled into Linux kernel.
privkey_ima.pem: Private key used to create file signatures
x509_ima.der: Certificate with public key signed by root CA. Used to be loaded into keyring
"_ima"for IMA signature verification.
The idea is that I want to use only keys that are signed by the root CA certificate compiled into the kernel.
I have seen functionality in
keyctl to add restrictions to a keyring requiring keys to be signed by another key or any key in another keyring.
With this approach I assume I have to add another keyring holding the root certificate and add such a restriction to
Unfortunately this is only available from Kernel v4.12 onwards while I have to use a version that is older than that.
What was the proper way to enforce verification of the certificate chain in kernel versions prior to 4.12?
For my purpose it doesn't matter if faulty keys can be loaded into the keyring as long as validating a signature with that key will fail.
A solution allowing the usage of intermediate CA as well would be prefered.