From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Paul Moore" <paul@paul-moore.com>,
"Daniel Borkmann" <daniel@iogearbox.net>
Cc: <ast@kernel.org>, <kpsingh@kernel.org>,
<James.Bottomley@hansenpartnership.com>,
<bboscaccy@linux.microsoft.com>, <memxor@gmail.com>,
<torvalds@linux-foundation.org>, <bpf@vger.kernel.org>,
<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH bpf-next v2 1/5] bpf: Verify signed loader metadata at load time
Date: Thu, 25 Jun 2026 18:16:19 -0700 [thread overview]
Message-ID: <DJIL18C2F40B.39U9WHD43SDBR@gmail.com> (raw)
In-Reply-To: <CAHC9VhRV9jW+dwNf7mW+1zTCsZ1xstBAugWL-TJ-DVNARdzC=Q@mail.gmail.com>
On Thu Jun 25, 2026 at 5:59 PM PDT, Paul Moore wrote:
>
> For all the reasons I gave previously, I can't support moving the
> existing security_bpf_prog_load() hook at this point in time.
Paul,
it's not up to you to approve or deny where security_bpf_prog_load()
is called within bpf subsystem as long as it doesn't affect behavior.
Daniel's patch doesn't change observable state from LSMs pov.
It merely moves the call from syscall.c to verifier.c.
So we're going to proceed.
> I'm guessing you still haven't looked at Blaise's patchset from last
> September.
Blaise approach was Nacked because you guys ignored TOCTOU issue.
I pointed it a year ago before AI was a thing. Then sashiko
pointed it again and the bot explained it in detail. It was again
ignored.
Daniel's v1 sadly had the same issue and sashiko spotted it too.
Hence v2 is moving the location of security_bpf_prog_load().
> on-list. As you can see from the lore archives, he has vehemently
> opposed the approach you are proposing for quite a while.
Exactly, because you kept ignoring TOCTOU issue.
Claiming support for signed bpf that can be easily defeated
is a shameless security scam.
next prev parent reply other threads:[~2026-06-26 1:16 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-24 14:02 [PATCH bpf-next v2 0/5] Verify BPF signed loader at load time Daniel Borkmann
2026-06-24 14:02 ` [PATCH bpf-next v2 1/5] bpf: Verify signed loader metadata " Daniel Borkmann
2026-06-24 15:12 ` Paul Moore
2026-06-24 15:37 ` Daniel Borkmann
2026-06-24 18:42 ` Paul Moore
2026-06-25 20:37 ` Daniel Borkmann
2026-06-26 0:59 ` Paul Moore
2026-06-26 1:16 ` Alexei Starovoitov [this message]
2026-06-26 1:38 ` Paul Moore
2026-06-26 1:44 ` Alexei Starovoitov
2026-06-26 2:01 ` Paul Moore
2026-06-24 15:17 ` bot+bpf-ci
2026-06-24 14:02 ` [PATCH bpf-next v2 2/5] libbpf: Drop in-loader metadata check for load-time verification Daniel Borkmann
2026-06-24 14:02 ` [PATCH bpf-next v2 3/5] bpftool: Cover loader metadata with the program signature Daniel Borkmann
2026-06-24 14:03 ` [PATCH bpf-next v2 4/5] selftests/bpf: Verify load-time signed loader metadata Daniel Borkmann
2026-06-24 14:03 ` [PATCH bpf-next v2 5/5] Documentation/bpf: Add BPF signing and enforcement doc Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DJIL18C2F40B.39U9WHD43SDBR@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=James.Bottomley@hansenpartnership.com \
--cc=ast@kernel.org \
--cc=bboscaccy@linux.microsoft.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kpsingh@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=paul@paul-moore.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox