From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44E1E23DEAD; Mon, 21 Jul 2025 21:20:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753132823; cv=none; b=qlRcUUxEgEzJyPbA5uPBfMO6izbB01WwX1guiFUB38IX8O7XGGMnO44ZdGPMyOSjFcIPoUpaRXyGJC+zeqQ71XQKjQGRuu/f19JF5hIQ4KMnIenLtwuEfYMzkMjvPN2s+jYx6lWA8hPqWbTSjnzMVD0oYbci9yYyQE1vNRlyh7Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753132823; c=relaxed/simple; bh=Lfo3m63uVYMfSVFBvlDJ7wABTjkxp7cKYbdGv51NAVs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PGPpx8jVj2kNuyCvFleqFQekpl+AwWQm2SiU18K6YpQYgALCYdCLTZZXX6oW5deI9FDXnk8+Q01gNAzESbg6oNZe1n3eSsvxXu7XljKuXtnHybQ+2WiF8ZJFi34T2WxwL3JqEOBaemUchqSat6vXrB0SQIS4aSRp9K0x8fM5dIw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=okvYUBT0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="okvYUBT0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 521D0C4CEF4; Mon, 21 Jul 2025 21:20:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1753132823; bh=Lfo3m63uVYMfSVFBvlDJ7wABTjkxp7cKYbdGv51NAVs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=okvYUBT02AwuWt3KHmh6xCFu5S0o0dbYMGllIhbfZGnD8UQVcnw1KAef/JmCPIuk5 NZ8MNNkcrghobNq4A0kHG9uf9nV7oEoFPaeY+5yEog/fKFuHIYv1jlvKjcXwV0/Mf3 YKaBa5kIxMrLdBIjNZ7nedbXAkO7aWesNp1dqKifdtuE9BE3Jk4iMGUx2dFF3mxm8L zJF4iR0JT+L55s5q5LXcG8k7eAy+Ebx6gZr6HfaqND1rEe3oikNPtDF/2mi6W+GT4b Mp/qNOik5+C2rx94QForJD0MTudfjNLqwtiNOPyz8gmOA3R9m2krbYZ3EeeodX9Eq0 IyzIDugk1ea8A== From: KP Singh To: bpf@vger.kernel.org, linux-security-module@vger.kernel.org Cc: bboscaccy@linux.microsoft.com, paul@paul-moore.com, kys@microsoft.com, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, KP Singh Subject: [PATCH v2 08/13] bpf: Implement signature verification for BPF programs Date: Mon, 21 Jul 2025 23:19:53 +0200 Message-ID: <20250721211958.1881379-9-kpsingh@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250721211958.1881379-1-kpsingh@kernel.org> References: <20250721211958.1881379-1-kpsingh@kernel.org> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This patch extends the BPF_PROG_LOAD command by adding three new fields to `union bpf_attr` in the user-space API: - signature: A pointer to the signature blob. - signature_size: The size of the signature blob. - keyring_id: The serial number of a loaded kernel keyring (e.g., the user or session keyring) containing the trusted public keys. When a BPF program is loaded with a signature, the kernel: 1. Retrieves the trusted keyring using the provided `keyring_id`. 2. Verifies the supplied signature against the BPF program's instruction buffer. 3. If the signature is valid and was generated by a key in the trusted keyring, the program load proceeds. 4. If no signature is provided, the load proceeds as before, allowing for backward compatibility. LSMs can chose to restrict unsigned programs and implement a security policy. 5. If signature verification fails for any reason, the program is not loaded. Signed-off-by: KP Singh --- crypto/asymmetric_keys/pkcs7_verify.c | 1 + include/linux/verification.h | 1 + include/uapi/linux/bpf.h | 10 +++++++ kernel/bpf/helpers.c | 2 +- kernel/bpf/syscall.c | 41 ++++++++++++++++++++++++++- tools/include/uapi/linux/bpf.h | 10 +++++++ tools/lib/bpf/bpf.c | 2 +- 7 files changed, 64 insertions(+), 3 deletions(-) diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c index f0d4ff3c20a8..6d6475e3a9bf 100644 --- a/crypto/asymmetric_keys/pkcs7_verify.c +++ b/crypto/asymmetric_keys/pkcs7_verify.c @@ -429,6 +429,7 @@ int pkcs7_verify(struct pkcs7_message *pkcs7, /* Authattr presence checked in parser */ break; case VERIFYING_UNSPECIFIED_SIGNATURE: + case VERIFYING_BPF_SIGNATURE: if (pkcs7->data_type != OID_data) { pr_warn("Invalid unspecified sig (not pkcs7-data)\n"); return -EKEYREJECTED; diff --git a/include/linux/verification.h b/include/linux/verification.h index 4f3022d081c3..dec7f2beabfd 100644 --- a/include/linux/verification.h +++ b/include/linux/verification.h @@ -36,6 +36,7 @@ enum key_being_used_for { VERIFYING_KEY_SIGNATURE, VERIFYING_KEY_SELF_SIGNATURE, VERIFYING_UNSPECIFIED_SIGNATURE, + VERIFYING_BPF_SIGNATURE, NR__KEY_BEING_USED_FOR }; #ifdef CONFIG_SYSTEM_DATA_VERIFICATION diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index fd3b895ebebf..b42c3740e053 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1607,6 +1607,16 @@ union bpf_attr { * continuous. */ __u32 fd_array_cnt; + /* Pointer to a buffer containing the signature of the BPF + * program. + */ + __aligned_u64 signature; + /* Size of the signature buffer in bytes. */ + __u32 signature_size; + /* ID of the kernel keyring to be used for signature + * verification. + */ + __u32 keyring_id; }; struct { /* anonymous struct used by BPF_OBJ_* commands */ diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index a052bbbcbfc5..e883c91b3633 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -3853,7 +3853,7 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p, return verify_pkcs7_signature(data, data_len, sig, sig_len, trusted_keyring->key, - VERIFYING_UNSPECIFIED_SIGNATURE, NULL, + VERIFYING_BPF_SIGNATURE, NULL, NULL); #else return -EOPNOTSUPP; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 22fda92ab7ce..111f91a99166 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2779,8 +2779,41 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type) } } +static noinline int bpf_prog_verify_signature(struct bpf_prog *prog, + union bpf_attr *attr, + bool is_kernel) +{ + bpfptr_t usig = make_bpfptr(attr->signature, is_kernel); + struct bpf_dynptr_kern sig_ptr, insns_ptr; + struct bpf_key *key = NULL; + void *sig; + int err = 0; + + key = bpf_lookup_user_key(attr->keyring_id, 0); + if (!key) + return -ENOKEY; + + sig = kvmemdup_bpfptr(usig, attr->signature_size); + if (!sig) { + bpf_key_put(key); + return -ENOMEM; + } + + bpf_dynptr_init(&sig_ptr, sig, BPF_DYNPTR_TYPE_LOCAL, 0, + attr->signature_size); + bpf_dynptr_init(&insns_ptr, prog->insnsi, BPF_DYNPTR_TYPE_LOCAL, 0, + prog->len * sizeof(struct bpf_insn)); + + err = bpf_verify_pkcs7_signature((struct bpf_dynptr *)&insns_ptr, + (struct bpf_dynptr *)&sig_ptr, key); + + bpf_key_put(key); + kvfree(sig); + return err; +} + /* last field in 'union bpf_attr' used by this command */ -#define BPF_PROG_LOAD_LAST_FIELD fd_array_cnt +#define BPF_PROG_LOAD_LAST_FIELD keyring_id static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) { @@ -2944,6 +2977,12 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) /* eBPF programs must be GPL compatible to use GPL-ed functions */ prog->gpl_compatible = license_is_gpl_compatible(license) ? 1 : 0; + if (attr->signature) { + err = bpf_prog_verify_signature(prog, attr, uattr.is_kernel); + if (err) + goto free_prog; + } + prog->orig_prog = NULL; prog->jited = 0; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index fd3b895ebebf..b42c3740e053 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -1607,6 +1607,16 @@ union bpf_attr { * continuous. */ __u32 fd_array_cnt; + /* Pointer to a buffer containing the signature of the BPF + * program. + */ + __aligned_u64 signature; + /* Size of the signature buffer in bytes. */ + __u32 signature_size; + /* ID of the kernel keyring to be used for signature + * verification. + */ + __u32 keyring_id; }; struct { /* anonymous struct used by BPF_OBJ_* commands */ diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c index 6a08a1559237..9c7815ddd829 100644 --- a/tools/lib/bpf/bpf.c +++ b/tools/lib/bpf/bpf.c @@ -240,7 +240,7 @@ int bpf_prog_load(enum bpf_prog_type prog_type, const struct bpf_insn *insns, size_t insn_cnt, struct bpf_prog_load_opts *opts) { - const size_t attr_sz = offsetofend(union bpf_attr, fd_array_cnt); + const size_t attr_sz = offsetofend(union bpf_attr, keyring_id); void *finfo = NULL, *linfo = NULL; const char *func_info, *line_info; __u32 log_size, log_level, attach_prog_fd, attach_btf_obj_fd; -- 2.43.0