Hornet LSM
summary
Hornet LSM verifies signed eBPF artifacts and emits machine-readable integrity verdicts to other LSMs, hooking BPF_PROG_LOAD and parsing PKCS7 attributes to validate PKCS7 signature and extract map indexes and SHA-256 hashes. It reads FDs, requires frozen maps, computes SHA-256, and on BPF_PROG_RUN performs a runtime TOCTOU check to detect map tampering. Integrates with IPE for five-line policy use, provides gen-sig/extract/write-sig tools, supports up to 64 verified maps, and does verification but not enforcement.
AI-written summary · about
chapters (20)
- 0:00Hornet LSM for eBPF integrity
- 1:05Hornet's threat model
- 2:49Verification vs enforcement in Hornet
- 3:51Threat models and limitations
- 4:37eBPF internals overview
- 6:47eBPF relocations explained
- 7:52Light skeletons and signing
- 9:18PKCS7 signed attributes
- 10:44Two-stage verification and LSM hooks
- 13:15Load-time verification deep dive
- 14:20LSM-to-LSM integrity with IPE
- 15:44Runtime tamper detection
- 16:26Known limitations and constraints
- 17:09Hornet practical tools
- 18:35IPE policy enforcement
- 19:42Q&A: Dynamic BPF and key management
- 21:13Q&A: LSM dependency management
- 22:14Q&A: Keyring and IMA integration
- 23:18Q&A: IMA and boot-time programs
- 24:26Q&A: Upstream patch compatibility
