write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/certs/Kconfig
..
..
@@ -83,4 +83,21 @@
83
83
 	  wrapper to incorporate the list into the kernel.  Each <hash> should
84
84
 	  be a string of hex digits.
85
85
 
86
+config SYSTEM_REVOCATION_LIST
87
+	bool "Provide system-wide ring of revocation certificates"
88
+	depends on SYSTEM_BLACKLIST_KEYRING
89
+	depends on PKCS7_MESSAGE_PARSER=y
90
+	help
91
+	  If set, this allows revocation certificates to be stored in the
92
+	  blacklist keyring and implements a hook whereby a PKCS#7 message can
93
+	  be checked to see if it matches such a certificate.
94
+
95
+config SYSTEM_REVOCATION_KEYS
96
+	string "X.509 certificates to be preloaded into the system blacklist keyring"
97
+	depends on SYSTEM_REVOCATION_LIST
98
+	help
99
+	  If set, this option should be the filename of a PEM-formatted file
100
+	  containing X.509 certificates to be included in the default blacklist
101
+	  keyring.
102
+
86
103
 endmenu