On Mon, Mar 7, 2022 at 3:57 AM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > > On Thu, 2022-03-03 at 14:39 -0800, Alexei Starovoitov wrote: > > > . There is no such thing as "eBPF modules". There are BPF programs. > > They cannot be signed the same way as kernel modules. > > We've been working on providing a way to sign them for more > > than a year now. That work is still ongoing. > > > > . IMA cannot be used for integrity check of BPF programs for the same > > reasons why kernel module like signing cannot be used. > > I assume the issue isn't where the signature is stored (e.g. appended, > xattr), but of calculating the hash. Where is the discussion taking This has the relevant background: https://lwn.net/Articles/853489/ We had some more discussions in one of our BSC meeting: https://github.com/ebpf-io/bsc/blob/master/minutes.md and we expect the discussions to continue over conferences this year (e.g. LSF/MM/BPF, Linux Plumbers). As I mentioned on another thread we don't have to wait for conferences and we can discuss this in the BPF office hours. Please feel free to add an agenda at: https://docs.google.com/spreadsheets/d/1LfrDXZ9-fdhvPEp_LHkxAMYyxxpwBXjywWa0AejEveU/edit#gid=0 (best is to give some notice so that interested folks can join). > place? Are there any summaries of what has been discussed? > > FYI, IMA isn't limited to measuring files. Support was added for > buffer measurements (e.g kexec boot command line, certificates) and > measuring kernel critical data (e.g. SELinux in memory policy & state, > device mapper). Nice. I need to look at how this is implemented. - KP > > thanks, > > Mimi >
