BPF Signing and IMA integration
summary
Proposal signs BPF by embedding a signature into the loader/skeleton artifact (instruction buffer plus relocations) and verifies it at the BPF prog_alloc LSM hook, supporting either IMA policy format or custom maps, with a reference implementation using PKCS7 and bpf2/bpf-tool integration. Stable instruction buffer comes from light skeletons that record loader syscalls; verification runs in-kernel before relocations, tests run under config MODSIGN and exercise the self-test, and a few issues remain around dynamic pointers and API exposure.
AI-written summary · about
chapters (7)
- 0:00Introduction and goals
- 2:09Why sign BPF programs
- 6:50IMA and BPF integration challenges
- 10:01Light skeletons and stable buffers
- 14:33Implementation details and verification
- 19:19Trusted code generator use case
- 23:53Q&A and wrap-up
related talks
25mDiscussion: What's next for BPF Signing
27mBPF LSM - Updates and What next?
22mBPF_LSM + fsverity for Binary Authorization
29meBPF on the Rise - Getting Started
33meBPF: exploring use case of BPF kernel infrastructure
33mKernel Runtime Security Instrumentation
26mHornet LSM
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel