2021-10-12 19:00:35

by Matteo Croce

Subject: [RFC bpf-next 1/2] bpf: add signature to eBPF instructions

From: Matteo Croce <[email protected]>

When loading a BPF program, pass a signature which is used to validate
the instructions.
The signature type is the same used to validate the kernel modules.

Signed-off-by: Matteo Croce <[email protected]>
---
include/uapi/linux/bpf.h | 2 ++
kernel/bpf/syscall.c | 33 ++++++++++++++++++++++++++++++++-
2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index c2b8857b8a1c..b9d259f26e92 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1336,6 +1336,8 @@ union bpf_attr {
};
__u32 :32; /* pad */
__aligned_u64 fd_array; /* array of FDs */
+ __aligned_u64 signature; /* instruction's signature */
+ __u32 sig_len; /* signature size */
};

struct { /* anonymous struct used by BPF_OBJ_* commands */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 3c349b244a28..5589f655033d 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -31,6 +31,8 @@
#include <linux/bpf-netns.h>
#include <linux/rcupdate_trace.h>
#include <linux/memcontrol.h>
+#include <linux/verification.h>
+#include <linux/module_signature.h>

#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
(map)->map_type == BPF_MAP_TYPE_CGROUP_ARRAY || \
@@ -2156,7 +2158,7 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type)
}

/* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD fd_array
+#define BPF_PROG_LOAD_LAST_FIELD sig_len

static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr)
{
@@ -2274,6 +2276,35 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr)
bpf_prog_insn_size(prog)) != 0)
goto free_prog_sec;

+ if (attr->sig_len) {
+ char *signature;
+
+ signature = kmalloc(attr->sig_len, GFP_USER);
+ if (!signature) {
+ err = -ENOMEM;
+ goto free_prog_sec;
+ }
+
+ if (copy_from_user(signature, (char *)attr->signature, attr->sig_len)) {
+ err = -EFAULT;
+ kfree(signature);
+ goto free_prog_sec;
+ }
+
+ err = verify_pkcs7_signature(prog->insns,
+ prog->len * sizeof(struct bpf_insn),
+ signature, attr->sig_len,
+ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_MODULE_SIGNATURE,
+ NULL, NULL);
+ kfree(signature);
+
+ if (err) {
+ printk("verify_pkcs7_signature(): %pe\n", (void*)(uintptr_t)err);
+ goto free_prog_sec;
+ }
+ }
+
prog->orig_prog = NULL;
prog->jited = 0;

--
2.33.0

2021-10-12 19:04:36

by Matteo Croce

Subject: Re: [RFC bpf-next 1/2] bpf: add signature to eBPF instructions

On Tue, Oct 12, 2021 at 8:59 PM Matteo Croce <[email protected]> wrote:
>
> From: Matteo Croce <[email protected]>
>
> When loading a BPF program, pass a signature which is used to validate
> the instructions.
> The signature type is the same used to validate the kernel modules.
>
> Signed-off-by: Matteo Croce <[email protected]>
> ---

Slipped out by mistake, duplicate of:

https://lore.kernel.org/bpf/[email protected]/T/#u

Sorry,
--
per aspera ad upstream