From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 80BAD1B652E; Thu, 26 Mar 2026 06:07:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774505226; cv=none; b=avTiYjEmytga8zbG7DOl8he+8AHAaZR6Rgp6lNe0xCmk/E/EGUyr89cJpYfQdWEpP+55JD9COi3spVRrRf/5TZFlD44cN7CL5fNze6s/PzNL8Q+XDd1Wt7DKaYck1u5JjIGMQOcaBiqRV1D6dFcJh4E6zLQVfHEpHRspK47iMwc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774505226; c=relaxed/simple; bh=dsRKlQ6StyNYi0NsZiZx01VLNjQffu9uPWWLTvauzUQ=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=nGp0ZCJz3GM9jlJ7jIuBNROP3y//KO3RpC/uPYlvQW6xlBjAIwr7wKjhPuaks7EnEIiUkzBHpuZ94FmdAPGtywXxiinwcUGOq4N4AM8fYpA3krmc1P2xTUJePR/YumNfMFajjuMA5lwHzrxgca9uom7iybIgyuTX7AvjoPnud1w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=JWnNu4El; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="JWnNu4El" Received: from narnia.corp.microsoft.com (unknown [40.78.13.173]) by linux.microsoft.com (Postfix) with ESMTPSA id 4EFBD20B710C; Wed, 25 Mar 2026 23:07:02 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 4EFBD20B710C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1774505224; bh=BaLuYb9PTVO3oIP+w1se3osljrg8I7DZ52eU1PadejA=; h=From:To:Subject:Date:From; b=JWnNu4Elpa7SnqQ1ZlRJTJohEIqyoWTp8I+hZJ768LIDSZQbjAp/+9Ny6Agp2vIlj 2Ab0jhL4VQYsrR7f0CY+WjF9ePUTXz8MSSn8EAtqCY4jc9f2x9xc0xN2F5F0mP6PgE ngP/MyZPOhNRyOSFMEO/V485f6WyQK5bGaTVaNJ4= From: Blaise Boscaccy To: Blaise Boscaccy , Jonathan Corbet , Paul Moore , James Morris , "Serge E. Hallyn" , =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , =?UTF-8?q?G=C3=BCnther=20Noack?= , "Dr. David Alan Gilbert" , Andrew Morton , James.Bottomley@HansenPartnership.com, dhowells@redhat.com, Fan Wu , Ryan Foster , Randy Dunlap , linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v3 0/9] Reintrodce Hornet LSM Date: Wed, 25 Mar 2026 23:06:29 -0700 Message-ID: <20260326060655.2550595-1-bboscaccy@linux.microsoft.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This patch series introduces the next iteration of the Hornet LSM. Hornet’s goal is to provide a secure and extensible in-kernel signature verification mechanism for eBPF programs. Hornet addresses concerns from users who require strict audit trails and verification guarantees for eBPF programs, especially in security-sensitive environments. Many production systems need assurance that only authorized, unmodified eBPF programs are loaded into the kernel. Hornet provides this assurance through cryptographic signature verification. The currently accepted loader-plus-map signature verification scheme, mandated by Alexei and KP, is simple to implement and generally acceptable if users and administrators are satisfied with it. However, verifying both the loader and the maps offers additional benefits beyond verifying the loader alone: 1. Security and Audit Integrity A key advantage is that the LSM hook for authorizing BPF program loads can operate after signature verification. This ensures: * Access control decisions are based on verified signature status. * Accurate system state measurement and logging. * Log entries claiming a verified signature are truthful, avoiding misleading records where only the loader was verified while the actual BPF program verification occurs later without logging. 2. TOCTOU Attack Prevention The current map hash implementation may be vulnerable to a TOCTOU attack because it allows unfrozen maps to cache a previously calculated hash. The accepted “trusted loader” scheme cannot detect this and may permit loading altered maps. 3. Supply Chain Integrity Verify that eBPF programs and their associated map data have not been modified since they were built and signed, in the kernel proper, may aid in protecting against supply chain attacks. This approach addresses concerns from users who require strict audit trails and verification guarantees, especially in security-sensitive environments. Map hashes for extended verification are passed via the existing PKCS#7 UAPI and verified by the crypto subsystem. Hornet then calculates the program’s verification state. Hornet itself does not enforce a policy on whether unsigned or partially signed programs should be rejected. It delegates that decision to downstream LSMs hook, making it a composable building block in a larger security architecture. Changes in V3: - Updated for signed attribute patch series changes - Added some new result enum values - Minor documentation clarification - Misc style fixes - Added missing signed-off-by tags Link to V2: https://lore.kernel.org/linux-security-module/20260227233930.2418522-1-bboscaccy@linux.microsoft.com/ Changes in V2: - Addressed possible TocTou races in hash verification - Improved documentation and tooling - Added Alexie's nack Link to RFC: https://lore.kernel.org/linux-security-module/20251211021257.1208712-1-bboscaccy@linux.microsoft.com/ Blaise Boscaccy (5): lsm: security: Add additional enum values for bpf integrity checks security: Hornet LSM hornet: Introduce gen_sig hornet: Add a light skeleton data extractor scripts selftests/hornet: Add a selftest for the Hornet LSM James Bottomley (3): crypto: pkcs7: add flag for validated trust on a signed info block crypto: pkcs7: add ability to extract signed attributes by OID crypto: pkcs7: add tests for pkcs7_get_authattr Paul Moore (1): lsm: framework for BPF integrity verification Documentation/admin-guide/LSM/Hornet.rst | 321 +++++++++++++++ Documentation/admin-guide/LSM/index.rst | 1 + MAINTAINERS | 9 + certs/system_keyring.c | 1 + crypto/asymmetric_keys/Makefile | 4 +- crypto/asymmetric_keys/pkcs7_aa.asn1 | 18 + crypto/asymmetric_keys/pkcs7_key_type.c | 44 ++- crypto/asymmetric_keys/pkcs7_parser.c | 81 ++++ crypto/asymmetric_keys/pkcs7_parser.h | 1 + crypto/asymmetric_keys/pkcs7_trust.c | 1 + include/crypto/pkcs7.h | 4 + include/linux/lsm_hook_defs.h | 5 + include/linux/oid_registry.h | 3 + include/linux/security.h | 28 ++ include/uapi/linux/lsm.h | 1 + scripts/Makefile | 1 + scripts/hornet/Makefile | 5 + scripts/hornet/extract-insn.sh | 27 ++ scripts/hornet/extract-map.sh | 27 ++ scripts/hornet/extract-skel.sh | 27 ++ scripts/hornet/gen_sig.c | 392 +++++++++++++++++++ scripts/hornet/write-sig.sh | 27 ++ security/Kconfig | 3 +- security/Makefile | 1 + security/hornet/Kconfig | 11 + security/hornet/Makefile | 7 + security/hornet/hornet.asn1 | 13 + security/hornet/hornet_lsm.c | 333 ++++++++++++++++ security/security.c | 75 +++- tools/testing/selftests/Makefile | 1 + tools/testing/selftests/hornet/Makefile | 63 +++ tools/testing/selftests/hornet/loader.c | 21 + tools/testing/selftests/hornet/trivial.bpf.c | 33 ++ 33 files changed, 1583 insertions(+), 6 deletions(-) create mode 100644 Documentation/admin-guide/LSM/Hornet.rst create mode 100644 crypto/asymmetric_keys/pkcs7_aa.asn1 create mode 100644 scripts/hornet/Makefile create mode 100755 scripts/hornet/extract-insn.sh create mode 100755 scripts/hornet/extract-map.sh create mode 100755 scripts/hornet/extract-skel.sh create mode 100644 scripts/hornet/gen_sig.c create mode 100755 scripts/hornet/write-sig.sh create mode 100644 security/hornet/Kconfig create mode 100644 security/hornet/Makefile create mode 100644 security/hornet/hornet.asn1 create mode 100644 security/hornet/hornet_lsm.c create mode 100644 tools/testing/selftests/hornet/Makefile create mode 100644 tools/testing/selftests/hornet/loader.c create mode 100644 tools/testing/selftests/hornet/trivial.bpf.c -- 2.53.0