From: Song Liu <song@kernel.org>
To: bpf@vger.kernel.org, fsverity@lists.linux.dev
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
martin.lau@kernel.org, kernel-team@meta.com, ebiggers@kernel.org,
tytso@mit.edu, roberto.sassu@huaweicloud.com,
Song Liu <song@kernel.org>
Subject: [PATCH v6 bpf-next 0/9] bpf: File verification with LSM and fsverity
Date: Tue, 24 Oct 2023 16:55:42 -0700 [thread overview]
Message-ID: <20231024235551.2769174-1-song@kernel.org> (raw)
Changes v5 => v6:
1. Let fsverity_init_bpf() return void. (Eric Biggers)
2. Sort things in alphabetic orders. (Eric Biggers)
Changes v4 => v5:
1. Revise commit logs. (Alexei)
Changes v3 => v4:
1. Fix error reported by CI.
2. Update comments of bpf_dynptr_slice* that they may return error pointer.
Changes v2 => v3:
1. Rebase and resolve conflicts.
Changes v1 => v2:
1. Let bpf_get_file_xattr() use const string for arg "name". (Alexei)
2. Add recursion prevention with allowlist. (Alexei)
3. Let bpf_get_file_xattr() use __vfs_getxattr() to avoid recursion,
as vfs_getxattr() calls into other LSM hooks.
4. Do not use dynptr->data directly, use helper insteadd. (Andrii)
5. Fixes with bpf_get_fsverity_digest. (Eric Biggers)
6. Add documentation. (Eric Biggers)
7. Fix some compile warnings. (kernel test robot)
This set enables file verification with BPF LSM and fsverity.
In this solution, fsverity is used to provide reliable and efficient hash
of files; and BPF LSM is used to implement signature verification (against
asymmetric keys), and to enforce access control.
This solution can be used to implement access control in complicated cases.
For example: only signed python binary and signed python script and access
special files/devices/ports.
Thanks,
Song
Song Liu (9):
bpf: Expose bpf_dynptr_slice* kfuncs for in kernel use
bpf: Factor out helper check_reg_const_str()
bpf: Introduce KF_ARG_PTR_TO_CONST_STR
bpf: Add kfunc bpf_get_file_xattr
bpf, fsverity: Add kfunc bpf_get_fsverity_digest
Documentation/bpf: Add documentation for filesystem kfuncs
selftests/bpf: Sort config in alphabetic order
selftests/bpf: Add tests for filesystem kfuncs
selftests/bpf: Add test that uses fsverity and xattr to sign a file
Documentation/bpf/fs_kfuncs.rst | 21 +++
Documentation/bpf/index.rst | 1 +
Documentation/bpf/kfuncs.rst | 24 +++
fs/verity/fsverity_private.h | 10 ++
fs/verity/init.c | 1 +
fs/verity/measure.c | 85 +++++++++
include/linux/bpf.h | 4 +
kernel/bpf/helpers.c | 16 +-
kernel/bpf/verifier.c | 104 +++++++----
kernel/trace/bpf_trace.c | 74 +++++++-
tools/testing/selftests/bpf/bpf_kfuncs.h | 10 ++
tools/testing/selftests/bpf/config | 3 +-
.../selftests/bpf/prog_tests/fs_kfuncs.c | 132 ++++++++++++++
.../bpf/prog_tests/verify_pkcs7_sig.c | 163 +++++++++++++++++-
.../selftests/bpf/progs/test_fsverity.c | 46 +++++
.../selftests/bpf/progs/test_get_xattr.c | 37 ++++
.../selftests/bpf/progs/test_sig_in_xattr.c | 82 +++++++++
.../bpf/progs/test_verify_pkcs7_sig.c | 8 +-
.../testing/selftests/bpf/verify_sig_setup.sh | 25 +++
19 files changed, 789 insertions(+), 57 deletions(-)
create mode 100644 Documentation/bpf/fs_kfuncs.rst
create mode 100644 tools/testing/selftests/bpf/prog_tests/fs_kfuncs.c
create mode 100644 tools/testing/selftests/bpf/progs/test_fsverity.c
create mode 100644 tools/testing/selftests/bpf/progs/test_get_xattr.c
create mode 100644 tools/testing/selftests/bpf/progs/test_sig_in_xattr.c
--
2.34.1
next reply other threads:[~2023-10-24 23:56 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-24 23:55 Song Liu [this message]
2023-10-24 23:55 ` [PATCH v6 bpf-next 1/9] bpf: Expose bpf_dynptr_slice* kfuncs for in kernel use Song Liu
2023-11-02 16:56 ` Andrii Nakryiko
2023-11-02 17:09 ` Andrii Nakryiko
2023-11-02 17:16 ` Andrii Nakryiko
2023-11-02 18:09 ` Song Liu
2023-11-02 18:12 ` Andrii Nakryiko
2023-11-02 18:16 ` Song Liu
2023-11-02 19:06 ` Andrii Nakryiko
2023-10-24 23:55 ` [PATCH v6 bpf-next 2/9] bpf: Factor out helper check_reg_const_str() Song Liu
2023-11-02 16:58 ` Andrii Nakryiko
2023-10-24 23:55 ` [PATCH v6 bpf-next 3/9] bpf: Introduce KF_ARG_PTR_TO_CONST_STR Song Liu
2023-11-02 5:58 ` Alexei Starovoitov
2023-11-02 6:09 ` Song Liu
2023-10-24 23:55 ` [PATCH v6 bpf-next 4/9] bpf: Add kfunc bpf_get_file_xattr Song Liu
2023-11-02 17:01 ` Andrii Nakryiko
2023-10-24 23:55 ` [PATCH v6 bpf-next 5/9] bpf, fsverity: Add kfunc bpf_get_fsverity_digest Song Liu
2023-11-02 3:11 ` Eric Biggers
2023-10-24 23:55 ` [PATCH v6 bpf-next 6/9] Documentation/bpf: Add documentation for filesystem kfuncs Song Liu
2023-10-24 23:55 ` [PATCH v6 bpf-next 7/9] selftests/bpf: Sort config in alphabetic order Song Liu
2023-10-24 23:55 ` [PATCH v6 bpf-next 8/9] selftests/bpf: Add tests for filesystem kfuncs Song Liu
2023-10-24 23:55 ` [PATCH v6 bpf-next 9/9] selftests/bpf: Add test that uses fsverity and xattr to sign a file Song Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231024235551.2769174-1-song@kernel.org \
--to=song@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=ebiggers@kernel.org \
--cc=fsverity@lists.linux.dev \
--cc=kernel-team@meta.com \
--cc=martin.lau@kernel.org \
--cc=roberto.sassu@huaweicloud.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).