Message-ID: <86e70da74cb34b59c53b1e5e4d94375c1ef30aa1.camel@debian.org>
Subject: Re: [PATCH bpf-next 0/3] bpf: add signature
From:   Luca Boccassi <bluca@debian.org>
To:     Alexei Starovoitov <alexei.starovoitov@gmail.com>,
        Matteo Croce <mcroce@linux.microsoft.com>
Cc:     bpf <bpf@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        Martin KaFai Lau <kafai@fb.com>,
        Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Jakub Kicinski <kuba@kernel.org>,
        Jesper Dangaard Brouer <hawk@kernel.org>,
        keyrings@vger.kernel.org,
        Linux Crypto Mailing List <linux-crypto@vger.kernel.org>,
        Lorenzo Bianconi <lorenzo@kernel.org>
Date:   Fri, 03 Dec 2021 22:06:51 +0000
In-Reply-To: <CAADnVQ+DSGoF2YoTrp2kTLoFBNAgdU8KbcCupicrVGCWvdxZ7w@mail.gmail.com>
References: <20211203191844.69709-1-mcroce@linux.microsoft.com>
         <CAADnVQLDEPxOvGn8CxwcG7phy26BKuOqpSQ5j7yZhZeEVoCC4w@mail.gmail.com>
         <CAFnufp1_p8XCUf-RdHpByKnR9MfXQoDWw6Pvm_dtuH4nD6dZnQ@mail.gmail.com>
         <CAADnVQ+DSGoF2YoTrp2kTLoFBNAgdU8KbcCupicrVGCWvdxZ7w@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha512";
        protocol="application/pgp-signature"; boundary="=-9dGd7pIPTozUlvTxQ6OC"
User-Agent: Evolution 3.42.1-1 
MIME-Version: 1.0
Precedence: bulk


--=-9dGd7pIPTozUlvTxQ6OC
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 2021-12-03 at 11:37 -0800, Alexei Starovoitov wrote:
> On Fri, Dec 3, 2021 at 11:36 AM Matteo Croce
> <mcroce@linux.microsoft.com> wrote:
> >=20
> > On Fri, Dec 3, 2021 at 8:22 PM Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> > >=20
> > > On Fri, Dec 3, 2021 at 11:18 AM Matteo Croce
> > > <mcroce@linux.microsoft.com> wrote:
> > > >=20
> > > > From: Matteo Croce <mcroce@microsoft.com>
> > > >=20
> > > > This series add signature verification for BPF files.
> > > > The first patch implements the signature validation in the
> > > > kernel,
> > > > the second patch optionally makes the signature mandatory,
> > > > the third adds signature generation to bpftool.
> > >=20
> > > Matteo,
> > >=20
> > > I think I already mentioned that it's no-go as-is.
> > > We've agreed to go with John's suggestion.
> >=20
> > Hi,
> >=20
> > my previous attempt was loading a whole ELF file and parsing it in
> > kernel.
> > In this series I just validate the instructions against a
> > signature,
> > as with kernel CO-RE libbpf doesn't need to mangle it.
> >=20
> > Which suggestion? I think I missed this one..
>=20
> This talk and discussion:
> https://linuxplumbersconf.org/event/11/contributions/947/

Thanks for the link - but for those of us who don't have ~5 hours to
watch a video recording, would you mind sharing a one line summary,
please? Is there an alternative patch series implementing BPF signing
that you can link us so that we can look at it? Just a link or
googlable reference would be more than enough.

Thank you!

--=20
Kind regards,
Luca Boccassi

--=-9dGd7pIPTozUlvTxQ6OC
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEE6g0RLAGYhL9yp9G8SylmgFB4UWIFAmGqlPsACgkQSylmgFB4
UWJQnAgAq3GA8XzZRwGZwL34DIKH2I4aOB3vedcJgWDfrtQ/tRoaAxWVOB3J3z/V
MV3R5FgL3JleXVKowRnpIz1nf+EHU3RP2XH1Hf0QXFkNJKDp0fz8BOnO/CqcokrP
EcL3FJeK496YAKHs8idXPnGas4CIkjOZ7K8HdT1i3JCCt/6lxcZOvxuC4w48AQM2
osb5oqdr9r2Pd891rW2ZKiKnutYr4vzkYdq8DmCvagr93FAh+V1vDVk8SRslDhkM
K/3GJ9oGpBj0PJ0Unt+jYqqMZKsQYCm4k+Fkg3de1Rjldln4gTFNVlzVHcYuRtlr
PcgpliiyJ3ptRxVgp2ozdK8YebpQ5w==
=V9Ai
-----END PGP SIGNATURE-----

--=-9dGd7pIPTozUlvTxQ6OC--