From: Mimi Zohar <zohar@linux.ibm.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>,
Roberto Sassu <roberto.sassu@huawei.com>,
Shuah Khan <shuah@kernel.org>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>, Yonghong Song <yhs@fb.com>,
Florent Revest <revest@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-integrity <linux-integrity@vger.kernel.org>,
LSM List <linux-security-module@vger.kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>, bpf <bpf@vger.kernel.org>,
Network Development <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Florent Revest <revest@google.com>,
Kees Cook <keescook@chromium.org>
Subject: Re: [PATCH v3 0/9] bpf-lsm: Extend interoperability with IMA
Date: Sun, 06 Mar 2022 21:56:29 -0500 [thread overview]
Message-ID: <40db9f74fd3c9c7b660e3a203c5a6eda08736d5b.camel@linux.ibm.com> (raw)
In-Reply-To: <CAADnVQKfh3Z1DXJ3PEjFheQWEDFOKQjuyx+pkvqe6MXEmo7YHQ@mail.gmail.com>
On Thu, 2022-03-03 at 14:39 -0800, Alexei Starovoitov wrote:
> . There is no such thing as "eBPF modules". There are BPF programs.
> They cannot be signed the same way as kernel modules.
> We've been working on providing a way to sign them for more
> than a year now. That work is still ongoing.
>
> . IMA cannot be used for integrity check of BPF programs for the same
> reasons why kernel module like signing cannot be used.
I assume the issue isn't where the signature is stored (e.g. appended,
xattr), but of calculating the hash. Where is the discussion taking
place? Are there any summaries of what has been discussed?
FYI, IMA isn't limited to measuring files. Support was added for
buffer measurements (e.g kexec boot command line, certificates) and
measuring kernel critical data (e.g. SELinux in memory policy & state,
device mapper).
thanks,
Mimi
next prev parent reply other threads:[~2022-03-07 2:57 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-02 11:13 [PATCH v3 0/9] bpf-lsm: Extend interoperability with IMA Roberto Sassu
2022-03-02 11:13 ` [PATCH v3 1/9] ima: Fix documentation-related warnings in ima_main.c Roberto Sassu
2022-03-06 19:24 ` Mimi Zohar
2022-03-02 11:13 ` [PATCH v3 2/9] ima: Always return a file measurement in ima_file_hash() Roberto Sassu
2022-03-06 19:31 ` Mimi Zohar
2022-03-02 11:13 ` [PATCH v3 3/9] bpf-lsm: Introduce new helper bpf_ima_file_hash() Roberto Sassu
2022-03-02 11:13 ` [PATCH v3 4/9] selftests/bpf: Move sample generation code to ima_test_common() Roberto Sassu
2022-03-02 11:14 ` [PATCH v3 5/9] selftests/bpf: Add test for bpf_ima_file_hash() Roberto Sassu
2022-03-02 11:14 ` [PATCH v3 6/9] selftests/bpf: Check if the digest is refreshed after a file write Roberto Sassu
2022-03-02 11:14 ` [PATCH v3 7/9] bpf-lsm: Make bpf_lsm_kernel_read_file() as sleepable Roberto Sassu
2022-03-02 11:14 ` [PATCH v3 8/9] selftests/bpf: Add test for bpf_lsm_kernel_read_file() Roberto Sassu
2022-03-02 11:14 ` [PATCH v3 9/9] selftests/bpf: Check that bpf_kernel_read_file() denies reading IMA policy Roberto Sassu
2022-03-02 22:20 ` [PATCH v3 0/9] bpf-lsm: Extend interoperability with IMA Alexei Starovoitov
2022-03-03 10:07 ` Roberto Sassu
2022-03-03 16:05 ` Mimi Zohar
2022-03-03 16:17 ` KP Singh
2022-03-03 16:29 ` Mimi Zohar
2022-03-03 18:14 ` KP Singh
2022-03-03 19:13 ` Mimi Zohar
2022-03-03 22:39 ` Alexei Starovoitov
2022-03-07 2:56 ` Mimi Zohar [this message]
2022-03-07 13:17 ` KP Singh
2022-03-07 20:44 ` Mimi Zohar
2022-03-06 19:23 ` Mimi Zohar
2022-03-07 10:31 ` Roberto Sassu
2022-03-11 3:20 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=40db9f74fd3c9c7b660e3a203c5a6eda08736d5b.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=kpsingh@kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=revest@chromium.org \
--cc=revest@google.com \
--cc=roberto.sassu@huawei.com \
--cc=shuah@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).