From: Song Liu <song@kernel.org>
To: Roberto Sassu <roberto.sassu@huaweicloud.com>
Cc: "Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"Yonghong Song" <yhs@fb.com>,
"John Fastabend" <john.fastabend@gmail.com>,
"KP Singh" <kpsingh@kernel.org>,
"Stanislav Fomichev" <sdf@google.com>,
"Hao Luo" <haoluo@google.com>, "Jiri Olsa" <jolsa@kernel.org>,
"Mykola Lysenko" <mykolal@fb.com>,
"David Howells" <dhowells@redhat.com>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Steven Rostedt" <rostedt@goodmis.org>,
"Ingo Molnar" <mingo@redhat.com>,
paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com,
"Shuah Khan" <shuah@kernel.org>, bpf <bpf@vger.kernel.org>,
keyrings@vger.kernel.org, linux-security-module@vger.kernel.org,
linux-kselftest@vger.kernel.org,
"open list" <linux-kernel@vger.kernel.org>,
"Daniel Müller" <deso@posteo.net>,
"Kumar Kartikeya Dwivedi" <memxor@gmail.com>,
"Roberto Sassu" <roberto.sassu@huawei.com>
Subject: Re: [PATCH v17 07/12] bpf: Add bpf_verify_pkcs7_signature() kfunc
Date: Fri, 9 Sep 2022 17:06:15 +0100 [thread overview]
Message-ID: <CAPhsuW6zhrUJBfht7RCiUGWWCaWwpcjzAq-R4W-YmpU+YZyMXg@mail.gmail.com> (raw)
In-Reply-To: <20220909120736.1027040-8-roberto.sassu@huaweicloud.com>
On Fri, Sep 9, 2022 at 1:09 PM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
>
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Add the bpf_verify_pkcs7_signature() kfunc, to give eBPF security modules
> the ability to check the validity of a signature against supplied data, by
> using user-provided or system-provided keys as trust anchor.
>
> The new kfunc makes it possible to enforce mandatory policies, as eBPF
> programs might be allowed to make security decisions only based on data
> sources the system administrator approves.
>
> The caller should provide the data to be verified and the signature as eBPF
> dynamic pointers (to minimize the number of parameters) and a bpf_key
> structure containing a reference to the keyring with keys trusted for
> signature verification, obtained from bpf_lookup_user_key() or
> bpf_lookup_system_key().
>
> For bpf_key structures obtained from the former lookup function,
> bpf_verify_pkcs7_signature() completes the permission check deferred by
> that function by calling key_validate(). key_task_permission() is already
> called by the PKCS#7 code.
>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> Acked-by: KP Singh <kpsingh@kernel.org>
Acked-by: Song Liu <song@kernel.org>
[...]
next prev parent reply other threads:[~2022-09-09 16:06 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-09 12:07 [PATCH v17 00/12] bpf: Add kfuncs for PKCS#7 signature verification Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 01/12] bpf: Allow kfuncs to be used in LSM programs Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 02/12] bpf: Move dynptr type check to is_dynptr_type_expected() Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 03/12] btf: Allow dynamic pointer parameters in kfuncs Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 04/12] bpf: Export bpf_dynptr_get_size() Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 05/12] KEYS: Move KEY_LOOKUP_ to include/linux/key.h and define KEY_LOOKUP_ALL Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 06/12] bpf: Add bpf_lookup_*_key() and bpf_key_put() kfuncs Roberto Sassu
2022-09-09 16:05 ` Song Liu
2022-09-09 12:07 ` [PATCH v17 07/12] bpf: Add bpf_verify_pkcs7_signature() kfunc Roberto Sassu
2022-09-09 16:06 ` Song Liu [this message]
2022-09-11 11:40 ` KP Singh
2022-09-11 21:08 ` Kumar Kartikeya Dwivedi
2022-09-09 12:07 ` [PATCH v17 08/12] selftests/bpf: Compile kernel with everything as built-in Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 09/12] selftests/bpf: Add verifier tests for bpf_lookup_*_key() and bpf_key_put() Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 10/12] selftests/bpf: Add additional tests for bpf_lookup_*_key() Roberto Sassu
2022-09-09 12:07 ` [PATCH v17 11/12] selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc Roberto Sassu
2022-09-15 16:11 ` KP Singh
2022-09-19 11:17 ` Roberto Sassu
2022-09-19 13:09 ` Roberto Sassu
2022-09-19 14:27 ` [PATCH v18 02/13] btf: Export bpf_dynptr definition Roberto Sassu
2022-09-20 5:30 ` Yonghong Song
2022-09-22 1:10 ` patchwork-bot+netdevbpf
2022-09-20 5:26 ` [PATCH v17 11/12] selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc Yonghong Song
2022-09-20 4:21 ` Yonghong Song
2022-09-09 12:07 ` [PATCH v17 12/12] selftests/bpf: Add tests for dynamic pointers parameters in kfuncs Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAPhsuW6zhrUJBfht7RCiUGWWCaWwpcjzAq-R4W-YmpU+YZyMXg@mail.gmail.com \
--to=song@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=deso@posteo.net \
--cc=dhowells@redhat.com \
--cc=haoluo@google.com \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=mingo@redhat.com \
--cc=mykolal@fb.com \
--cc=paul@paul-moore.com \
--cc=roberto.sassu@huawei.com \
--cc=roberto.sassu@huaweicloud.com \
--cc=rostedt@goodmis.org \
--cc=sdf@google.com \
--cc=serge@hallyn.com \
--cc=shuah@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).