mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2025-01-11 00:08:50 +00:00
1030e91542
This selftests shows a proof of concept method to use BPF LSM to enforce file signature. This test is added to verify_pkcs7_sig, so that some existing logic can be reused. This file signature method uses fsverity, which provides reliable and efficient hash (known as digest) of the file. The file digest is signed with asymmetic key, and the signature is stored in xattr. At the run time, BPF LSM reads file digest and the signature, and then checks them against the public key. Note that this solution does NOT require FS_VERITY_BUILTIN_SIGNATURES. fsverity is only used to provide file digest. The signature verification and access control is all implemented in BPF LSM. Signed-off-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/r/20231129234417.856536-7-song@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
69 lines
2.5 KiB
C
69 lines
2.5 KiB
C
#ifndef __BPF_KFUNCS__
|
|
#define __BPF_KFUNCS__
|
|
|
|
struct bpf_sock_addr_kern;
|
|
|
|
/* Description
|
|
* Initializes an skb-type dynptr
|
|
* Returns
|
|
* Error code
|
|
*/
|
|
extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags,
|
|
struct bpf_dynptr *ptr__uninit) __ksym;
|
|
|
|
/* Description
|
|
* Initializes an xdp-type dynptr
|
|
* Returns
|
|
* Error code
|
|
*/
|
|
extern int bpf_dynptr_from_xdp(struct xdp_md *xdp, __u64 flags,
|
|
struct bpf_dynptr *ptr__uninit) __ksym;
|
|
|
|
/* Description
|
|
* Obtain a read-only pointer to the dynptr's data
|
|
* Returns
|
|
* Either a direct pointer to the dynptr data or a pointer to the user-provided
|
|
* buffer if unable to obtain a direct pointer
|
|
*/
|
|
extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, __u32 offset,
|
|
void *buffer, __u32 buffer__szk) __ksym;
|
|
|
|
/* Description
|
|
* Obtain a read-write pointer to the dynptr's data
|
|
* Returns
|
|
* Either a direct pointer to the dynptr data or a pointer to the user-provided
|
|
* buffer if unable to obtain a direct pointer
|
|
*/
|
|
extern void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *ptr, __u32 offset,
|
|
void *buffer, __u32 buffer__szk) __ksym;
|
|
|
|
extern int bpf_dynptr_adjust(const struct bpf_dynptr *ptr, __u32 start, __u32 end) __ksym;
|
|
extern bool bpf_dynptr_is_null(const struct bpf_dynptr *ptr) __ksym;
|
|
extern bool bpf_dynptr_is_rdonly(const struct bpf_dynptr *ptr) __ksym;
|
|
extern __u32 bpf_dynptr_size(const struct bpf_dynptr *ptr) __ksym;
|
|
extern int bpf_dynptr_clone(const struct bpf_dynptr *ptr, struct bpf_dynptr *clone__init) __ksym;
|
|
|
|
/* Description
|
|
* Modify the address of a AF_UNIX sockaddr.
|
|
* Returns__bpf_kfunc
|
|
* -EINVAL if the address size is too big or, 0 if the sockaddr was successfully modified.
|
|
*/
|
|
extern int bpf_sock_addr_set_sun_path(struct bpf_sock_addr_kern *sa_kern,
|
|
const __u8 *sun_path, __u32 sun_path__sz) __ksym;
|
|
|
|
void *bpf_cast_to_kern_ctx(void *) __ksym;
|
|
|
|
void *bpf_rdonly_cast(void *obj, __u32 btf_id) __ksym;
|
|
|
|
extern int bpf_get_file_xattr(struct file *file, const char *name,
|
|
struct bpf_dynptr *value_ptr) __ksym;
|
|
extern int bpf_get_fsverity_digest(struct file *file, struct bpf_dynptr *digest_ptr) __ksym;
|
|
|
|
extern struct bpf_key *bpf_lookup_user_key(__u32 serial, __u64 flags) __ksym;
|
|
extern struct bpf_key *bpf_lookup_system_key(__u64 id) __ksym;
|
|
extern void bpf_key_put(struct bpf_key *key) __ksym;
|
|
extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr,
|
|
struct bpf_dynptr *sig_ptr,
|
|
struct bpf_key *trusted_keyring) __ksym;
|
|
#endif
|