linux-kernel - Re: [PATCH v6 07/15] digest_cache: Allow registration of digest list parsers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z0jVQ8Q7AT_9NodI@bombadil.infradead.org>
Date: Thu, 28 Nov 2024 12:40:35 -0800
From: Luis Chamberlain <mcgrof@...nel.org>
To: Roberto Sassu <roberto.sassu@...weicloud.com>, mmaurer@...gle.com,
	samitolvanen@...gle.com, KP Singh <kpsingh@...nel.org>
Cc: zohar@...ux.ibm.com, dmitry.kasatkin@...il.com,
	eric.snowberg@...cle.com, corbet@....net, petr.pavlu@...e.com,
	samitolvanen@...gle.com, da.gomez@...sung.com,
	akpm@...ux-foundation.org, paul@...l-moore.com, jmorris@...ei.org,
	serge@...lyn.com, shuah@...nel.org, mcoquelin.stm32@...il.com,
	alexandre.torgue@...s.st.com, linux-integrity@...r.kernel.org,
	linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-api@...r.kernel.org, linux-modules@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-kselftest@...r.kernel.org, wufan@...ux.microsoft.com,
	pbrobinson@...il.com, zbyszek@...waw.pl, hch@....de,
	mjg59@...f.ucam.org, pmatilai@...hat.com, jannh@...gle.com,
	dhowells@...hat.com, jikos@...nel.org, mkoutny@...e.com,
	ppavlu@...e.com, petr.vorel@...il.com, mzerqung@...inter.de,
	kgold@...ux.ibm.com, Roberto Sassu <roberto.sassu@...wei.com>
Subject: Re: [PATCH v6 07/15] digest_cache: Allow registration of digest list
 parsers

On Thu, Nov 28, 2024 at 09:23:57AM +0100, Roberto Sassu wrote:
> On Wed, 2024-11-27 at 11:53 -0800, Luis Chamberlain wrote:
> > On Wed, Nov 27, 2024 at 10:51:11AM +0100, Roberto Sassu wrote:
> > > For eBPF programs we are also in a need for a better way to
> > > measure/appraise them.
> > 
> > I am confused now, I was under the impression this "Integrity Digest
> > Cache" is just a special thing for LSMs, and so I was under the
> > impression that kernel_read_file() lsm hook already would take care
> > of eBPF programs.
> 
> Yes, the problem is that eBPF programs are transformed in user space
> before they are sent to the kernel:
> 
> https://lwn.net/Articles/977394/

That issue seems to be orthogonal to your eandeavor though, which just
supplements LSMS, right?

Anyway, in case this helps:

The Rust folks faced some slighty related challenges with our CRC
validations for symbols, our CRC are slapped on with genksyms but this
relies on the source code and with Rust the compiler may do final
touches to data. And so DWARF is being used [1].

Although I am not sure of the state of eBPF DWARF support, there is also
BTF support [0] and most distros are relying on it to make live introspection 
easier, and the output is much smaller. So could DWARF or BTF information
from eBPF programs be used by the verifier in similar way to verify eBPF
programs?

Note that to support BTF implicates DWARF and the leap of faith for Rust
modversions support is that most distros will support DWARF, and so BTF
can become the norm [2].

[0] https://www.kernel.org/doc/html/latest/bpf/btf.html
[1] https://lwn.net/Articles/986892/
[2] https://lwn.net/Articles/991719/

  Luis