From: Song Liu <song@kernel.org>
To: bpf@vger.kernel.org, fsverity@lists.linux.dev
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
martin.lau@kernel.org, kernel-team@meta.com, ebiggers@kernel.org,
tytso@mit.edu, roberto.sassu@huaweicloud.com,
Song Liu <song@kernel.org>
Subject: [PATCH v3 bpf-next 0/9] bpf: File verification with LSM and fsverity
Date: Mon, 23 Oct 2023 09:03:40 -0700 [thread overview]
Message-ID: <20231023160349.4161154-1-song@kernel.org> (raw)
Changes v2 => v3:
1. Rebase and resolve conflicts.
Changes v1 => v2:
1. Let bpf_get_file_xattr() use const string for arg "name". (Alexei)
2. Add recursion prevention with allowlist. (Alexei)
3. Let bpf_get_file_xattr() use __vfs_getxattr() to avoid recursion,
as vfs_getxattr() calls into other LSM hooks.
4. Do not use dynptr->data directly, use helper insteadd. (Andrii)
5. Fixes with bpf_get_fsverity_digest. (Eric Biggers)
6. Add documentation. (Eric Biggers)
7. Fix some compile warnings. (kernel test robot)
This set enables file verification with BPF LSM and fsverity.
In this solution, fsverity is used to provide reliable and efficient hash
of files; and BPF LSM is used to implement signature verification (against
asymmetric keys), and to enforce access control.
This solution can be used to implement access control in complicated cases.
For example: only signed python binary and signed python script and access
special files/devices/ports.
Thanks,
Song
Song Liu (9):
bpf: Expose bpf_dynptr_slice* kfuncs for in kernel use
bpf: Factor out helper check_reg_const_str()
bpf: Introduce KF_ARG_PTR_TO_CONST_STR
bpf: Add kfunc bpf_get_file_xattr
bpf, fsverity: Add kfunc bpf_get_fsverity_digest
Documentation/bpf: Add documentation for filesystem kfuncs
selftests/bpf: Sort config in alphabetic order
selftests/bpf: Add tests for filesystem kfuncs
selftests/bpf: Add test that use fsverity and xattr to sign a file
Documentation/bpf/fs_kfuncs.rst | 21 +++
Documentation/bpf/index.rst | 1 +
Documentation/bpf/kfuncs.rst | 24 +++
fs/verity/fsverity_private.h | 10 ++
fs/verity/init.c | 1 +
fs/verity/measure.c | 82 +++++++++
include/linux/bpf.h | 4 +
kernel/bpf/verifier.c | 104 +++++++----
kernel/trace/bpf_trace.c | 71 +++++++-
tools/testing/selftests/bpf/bpf_kfuncs.h | 10 ++
tools/testing/selftests/bpf/config | 3 +-
.../selftests/bpf/prog_tests/fs_kfuncs.c | 132 ++++++++++++++
.../bpf/prog_tests/verify_pkcs7_sig.c | 163 +++++++++++++++++-
.../selftests/bpf/progs/test_fsverity.c | 46 +++++
.../selftests/bpf/progs/test_get_xattr.c | 37 ++++
.../selftests/bpf/progs/test_sig_in_xattr.c | 82 +++++++++
.../bpf/progs/test_verify_pkcs7_sig.c | 8 +-
.../testing/selftests/bpf/verify_sig_setup.sh | 25 +++
18 files changed, 775 insertions(+), 49 deletions(-)
create mode 100644 Documentation/bpf/fs_kfuncs.rst
create mode 100644 tools/testing/selftests/bpf/prog_tests/fs_kfuncs.c
create mode 100644 tools/testing/selftests/bpf/progs/test_fsverity.c
create mode 100644 tools/testing/selftests/bpf/progs/test_get_xattr.c
create mode 100644 tools/testing/selftests/bpf/progs/test_sig_in_xattr.c
--
2.34.1
next reply other threads:[~2023-10-23 16:03 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-23 16:03 Song Liu [this message]
2023-10-23 16:03 ` [PATCH v3 bpf-next 1/9] bpf: Expose bpf_dynptr_slice* kfuncs for in kernel use Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 2/9] bpf: Factor out helper check_reg_const_str() Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 3/9] bpf: Introduce KF_ARG_PTR_TO_CONST_STR Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 4/9] bpf: Add kfunc bpf_get_file_xattr Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 5/9] bpf, fsverity: Add kfunc bpf_get_fsverity_digest Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 6/9] Documentation/bpf: Add documentation for filesystem kfuncs Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 7/9] selftests/bpf: Sort config in alphabetic order Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 8/9] selftests/bpf: Add tests for filesystem kfuncs Song Liu
2023-10-23 16:03 ` [PATCH v3 bpf-next 9/9] selftests/bpf: Add test that use fsverity and xattr to sign a file Song Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231023160349.4161154-1-song@kernel.org \
--to=song@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=ebiggers@kernel.org \
--cc=fsverity@lists.linux.dev \
--cc=kernel-team@meta.com \
--cc=martin.lau@kernel.org \
--cc=roberto.sassu@huaweicloud.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).