On Mon, 2022-03-07 at 14:17 +0100, KP Singh wrote:
On Mon, Mar 7, 2022 at 3:57 AM Mimi Zohar zohar@linux.ibm.com wrote:
On Thu, 2022-03-03 at 14:39 -0800, Alexei Starovoitov wrote:
. There is no such thing as "eBPF modules". There are BPF programs. They cannot be signed the same way as kernel modules. We've been working on providing a way to sign them for more than a year now. That work is still ongoing.
. IMA cannot be used for integrity check of BPF programs for the same reasons why kernel module like signing cannot be used.
I assume the issue isn't where the signature is stored (e.g. appended, xattr), but of calculating the hash. Where is the discussion taking
This has the relevant background: https://lwn.net/Articles/853489/
Thanks, Jon!
We had some more discussions in one of our BSC meeting:
https://github.com/ebpf-io/bsc/blob/master/minutes.md
and we expect the discussions to continue over conferences this year (e.g. LSF/MM/BPF, Linux Plumbers). As I mentioned on another thread we don't have to wait for conferences and we can discuss this in the BPF office hours. Please feel free to add an agenda at:
https://docs.google.com/spreadsheets/d/1LfrDXZ9-fdhvPEp_LHkxAMYyxxpwBXjywWa0...
(best is to give some notice so that interested folks can join).
Right, but probably a good idea to understand the issues at least at a high level, before a meeting.
place? Are there any summaries of what has been discussed?
FYI, IMA isn't limited to measuring files. Support was added for buffer measurements (e.g kexec boot command line, certificates) and measuring kernel critical data (e.g. SELinux in memory policy & state, device mapper).
Nice. I need to look at how this is implemented.
ima_measure_critical_data() is of kernel state info, so signature verification is currently not needed or supported, only measurement.
thanks,
Mimi