Linux Plumbers Conference 2023

Currently Playing: BPF_LSM + fsverity for Binary Authorization - Song Liu, Boris Burkov

Binary authorization is a common security requirement for modern systems. Fundamentally, only securely authorized binaries are allowed to perform certain risky operations. For example, only an authenticated sshd binary is allowed to bind port 22, or only limited authorized binaries should write to raw block devices with critical data. Many proposals have sought to solve this problem, namely, fsverity, IMA, etc. However, existing solutions often fail to provide enough flexibility and fine granular control with reasonably low overhead. In this talk, we present a flexible and low overhead solution based on BPF_LSM and fsverity. Design In this solution, we use: fs-verity for file integrity checksums Secure binary signing service to compute and sign fs-verity hashes Xattrs to store fs-verity root hash signatures BPF_LSM to enforce access control User space daemon to manage keyrings and BPF_LSM programs Kernel Work We will need the following kfuncs to enable this work: bpf_fsverity_get_digest() to get fsverity root hash; bpf_vfs_getxattr() to get xattr, which contains the signature. Note: We will have a patchset and/or a PoC for review before LPC 2023.