On Mon, 2022-03-07 at 14:17 +0100, KP Singh wrote: > On Mon, Mar 7, 2022 at 3:57 AM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > > > > On Thu, 2022-03-03 at 14:39 -0800, Alexei Starovoitov wrote: > > > > > . There is no such thing as "eBPF modules". There are BPF programs. > > > They cannot be signed the same way as kernel modules. > > > We've been working on providing a way to sign them for more > > > than a year now. That work is still ongoing. > > > > > > . IMA cannot be used for integrity check of BPF programs for the same > > > reasons why kernel module like signing cannot be used. > > > > I assume the issue isn't where the signature is stored (e.g. appended, > > xattr), but of calculating the hash. Where is the discussion taking > > This has the relevant background: https://lwn.net/Articles/853489/ Thanks, Jon! > > We had some more discussions in one of our BSC meeting: > > https://github.com/ebpf-io/bsc/blob/master/minutes.md > > and we expect the discussions to continue over conferences this year > (e.g. LSF/MM/BPF, Linux Plumbers). As I mentioned on another thread > we don't have to wait for conferences and we can discuss this in the BPF > office hours. Please feel free to add an agenda at: > > https://docs.google.com/spreadsheets/d/1LfrDXZ9-fdhvPEp_LHkxAMYyxxpwBXjywWa0AejEveU/edit#gid=0 > > (best is to give some notice so that interested folks can join). Right, but probably a good idea to understand the issues at least at a high level, before a meeting. > > > place? Are there any summaries of what has been discussed? > > > > FYI, IMA isn't limited to measuring files. Support was added for > > buffer measurements (e.g kexec boot command line, certificates) and > > measuring kernel critical data (e.g. SELinux in memory policy & state, > > device mapper). > > Nice. I need to look at how this is implemented. ima_measure_critical_data() is of kernel state info, so signature verification is currently not needed or supported, only measurement. thanks, Mimi
