@@ -5265,6 +5265,13 @@ union bpf_attr {
* Return
* A non-NULL pointer if *id* is valid and not 0, a NULL pointer
* otherwise.
+ *
+ * long bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr, struct bpf_dynptr *sig_ptr, struct key *trusted_keys)
+ * Description
+ * Verify the PKCS#7 signature *sig* against the supplied *data*
+ * with keys in *trusted_keys*.
+ * Return
+ * 0 on success, a negative value on error.
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -5472,6 +5479,7 @@ union bpf_attr {
FN(dynptr_write), \
FN(dynptr_data), \
FN(request_key_by_id), \
+ FN(verify_pkcs7_signature), \
/* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
@@ -156,6 +156,31 @@ static const struct bpf_func_proto bpf_request_key_by_id_proto = {
.ret_btf_id = &bpf_request_key_by_id_btf_ids[0],
.arg1_type = ARG_ANYTHING,
};
+
+#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
+BPF_CALL_3(bpf_verify_pkcs7_signature, struct bpf_dynptr_kern *, data_ptr,
+ struct bpf_dynptr_kern *, sig_ptr, struct key *, trusted_keys)
+{
+ return verify_pkcs7_signature(data_ptr->data,
+ bpf_dynptr_get_size(data_ptr),
+ sig_ptr->data,
+ bpf_dynptr_get_size(sig_ptr),
+ trusted_keys,
+ VERIFYING_UNSPECIFIED_SIGNATURE, NULL,
+ NULL);
+}
+
+static const struct bpf_func_proto bpf_verify_pkcs7_signature_proto = {
+ .func = bpf_verify_pkcs7_signature,
+ .gpl_only = false,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL,
+ .arg2_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL,
+ .arg3_type = ARG_PTR_TO_BTF_ID_OR_NULL,
+ .arg3_btf_id = &bpf_request_key_by_id_btf_ids[0],
+ .allowed = bpf_ima_inode_hash_allowed,
+};
+#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
#endif /* CONFIG_KEYS */
static const struct bpf_func_proto *
@@ -187,6 +212,11 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
#ifdef CONFIG_KEYS
case BPF_FUNC_request_key_by_id:
return &bpf_request_key_by_id_proto;
+#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
+ case BPF_FUNC_verify_pkcs7_signature:
+ return prog->aux->sleepable ?
+ &bpf_verify_pkcs7_signature_proto : NULL;
+#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
#endif /* CONFIG_KEYS */
default:
return tracing_prog_func_proto(func_id, prog);
@@ -5265,6 +5265,13 @@ union bpf_attr {
* Return
* A non-NULL pointer if *id* is valid and not 0, a NULL pointer
* otherwise.
+ *
+ * long bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr, struct bpf_dynptr *sig_ptr, struct key *trusted_keys)
+ * Description
+ * Verify the PKCS#7 signature *sig* against the supplied *data*
+ * with keys in *trusted_keys*.
+ * Return
+ * 0 on success, a negative value on error.
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -5472,6 +5479,7 @@ union bpf_attr {
FN(dynptr_write), \
FN(dynptr_data), \
FN(request_key_by_id), \
+ FN(verify_pkcs7_signature), \
/* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
Add the bpf_verify_pkcs7_signature() helper, to give eBPF security modules the ability to check the validity of a signature against supplied data, by using system-provided keys as trust anchor. The new helper makes it possible to enforce mandatory policies, as eBPF programs might be allowed to make security decisions only based on data sources the system administrator approves. The caller should provide both the data to be verified and the signature as eBPF dynamic pointers (to minimize the number of parameters). The caller should also provide a keyring pointer, that can be currently obtained with the bpf_request_key_by_id() helper. In the future, it will be possible to search a keyring by its description. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reported-by: kernel test robot <lkp@intel.com> (cast warning) --- include/uapi/linux/bpf.h | 8 ++++++++ kernel/bpf/bpf_lsm.c | 30 ++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 8 ++++++++ 3 files changed, 46 insertions(+)