Don't automatically authorize new root certificates as trusted signers.

1 files changed, 1 insertions, 9 deletions

diff --git a/modsign.cxx b/modsign.cxx
index 0965b923..326534ce 100644
--- a/modsign.cxx
+++ b/modsign.cxx
@@ -49,20 +49,12 @@ using namespace std;
  */
 static int
 init_cert_db_path (const string &cert_db_path) {
-  int rc, rc1;
+  int rc;
 
   // Generate the certificate and database.
   string cmd = BINDIR "/stap-gen-cert " + cert_db_path;
   rc = system (cmd.c_str ()) == 0;
 
-  // If we are root, authorize the new certificate as a trusted
-  // signer. It is not an error if this fails.
-  if (geteuid () == 0)
-    {
-      cmd = BINDIR "/stap-authorize-signing-cert " + cert_db_path + "/stap.cert";
-      rc1 = system (cmd.c_str ());
-    }
-
   return rc;
 }