Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <40db9f74fd3c9c7b660e3a203c5a6eda08736d5b.camel@linux.ibm.com>
Subject: Re: [PATCH v3 0/9] bpf-lsm: Extend interoperability with IMA
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc:     KP Singh <kpsingh@kernel.org>,
        Roberto Sassu <roberto.sassu@huawei.com>,
        Shuah Khan <shuah@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Yonghong Song <yhs@fb.com>,
        Florent Revest <revest@chromium.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-integrity <linux-integrity@vger.kernel.org>,
        LSM List <linux-security-module@vger.kernel.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@vger.kernel.org>, bpf <bpf@vger.kernel.org>,
        Network Development <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Florent Revest <revest@google.com>,
        Kees Cook <keescook@chromium.org>
Date:   Sun, 06 Mar 2022 21:56:29 -0500
In-Reply-To: <CAADnVQKfh3Z1DXJ3PEjFheQWEDFOKQjuyx+pkvqe6MXEmo7YHQ@mail.gmail.com>
References: <20220302111404.193900-1-roberto.sassu@huawei.com>
         <20220302222056.73dzw5lnapvfurxg@ast-mbp.dhcp.thefacebook.com>
         <fe1d17e7e7d4b5e4cdeb9f96f5771ded23b7c8f0.camel@linux.ibm.com>
         <CACYkzJ4fmJ4XtC6gx6k_Gjq0n5vjSJyq=L--H-Eho072HJoywA@mail.gmail.com>
         <04d878d4b2441bb8a579a4191d8edc936c5a794a.camel@linux.ibm.com>
         <CACYkzJ5RNDV582yt1xCZ8AQUW6v_o0Dtoc_XAQN1GXnoOmze6Q@mail.gmail.com>
         <b6bf8463c1b370a5b5c9987ae1312fd930d36785.camel@linux.ibm.com>
         <CAADnVQKfh3Z1DXJ3PEjFheQWEDFOKQjuyx+pkvqe6MXEmo7YHQ@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Thu, 2022-03-03 at 14:39 -0800, Alexei Starovoitov wrote:

> . There is no such thing as "eBPF modules". There are BPF programs.
> They cannot be signed the same way as kernel modules.
> We've been working on providing a way to sign them for more
> than a year now. That work is still ongoing.
> 
> . IMA cannot be used for integrity check of BPF programs for the same
> reasons why kernel module like signing cannot be used.

I assume the issue isn't where the signature is stored (e.g. appended,
xattr), but of calculating the hash.  Where is the discussion taking
place?   Are there any summaries of what has been discussed?

FYI, IMA isn't limited to measuring files.  Support was added for
buffer measurements (e.g kexec boot command line, certificates) and
measuring kernel critical data (e.g. SELinux in memory policy & state,
device mapper).

thanks,

Mimi