Messages in this thread | | | Subject | Re: [PATCH v3 0/9] bpf-lsm: Extend interoperability with IMA | From | Mimi Zohar <> | Date | Mon, 07 Mar 2022 15:44:51 -0500 |
| |
On Mon, 2022-03-07 at 14:17 +0100, KP Singh wrote: > On Mon, Mar 7, 2022 at 3:57 AM Mimi Zohar <zohar@linux.ibm.com> wrote: > > > > On Thu, 2022-03-03 at 14:39 -0800, Alexei Starovoitov wrote: > > > > > . There is no such thing as "eBPF modules". There are BPF programs. > > > They cannot be signed the same way as kernel modules. > > > We've been working on providing a way to sign them for more > > > than a year now. That work is still ongoing. > > > > > > . IMA cannot be used for integrity check of BPF programs for the same > > > reasons why kernel module like signing cannot be used. > > > > I assume the issue isn't where the signature is stored (e.g. appended, > > xattr), but of calculating the hash. Where is the discussion taking > > This has the relevant background: https://lwn.net/Articles/853489/
Thanks, Jon!
> > We had some more discussions in one of our BSC meeting: > > https://github.com/ebpf-io/bsc/blob/master/minutes.md > > and we expect the discussions to continue over conferences this year > (e.g. LSF/MM/BPF, Linux Plumbers). As I mentioned on another thread > we don't have to wait for conferences and we can discuss this in the BPF > office hours. Please feel free to add an agenda at: > > https://docs.google.com/spreadsheets/d/1LfrDXZ9-fdhvPEp_LHkxAMYyxxpwBXjywWa0AejEveU/edit#gid=0 > > (best is to give some notice so that interested folks can join).
Right, but probably a good idea to understand the issues at least at a high level, before a meeting.
> > > place? Are there any summaries of what has been discussed? > > > > FYI, IMA isn't limited to measuring files. Support was added for > > buffer measurements (e.g kexec boot command line, certificates) and > > measuring kernel critical data (e.g. SELinux in memory policy & state, > > device mapper). > > Nice. I need to look at how this is implemented.
ima_measure_critical_data() is of kernel state info, so signature verification is currently not needed or supported, only measurement.
thanks,
Mimi
| |