BPF lockdown


Using eBPF in kernel lockdown mode


Arnaldo Carvalho de Melo
acme@redhat.com
Red Hat Inc.

What is this about?



  • kernel lockdown
  • Cryptographic signature of eBPF bytecode
  • Limiting access to confidential information
  • libbpf code patching

kernel lockdown mode



  • Integrity
  • Confidentiality

Integrity mode



  • kernel and modules signed
  • eBPF bytecode signed

Confidentiality mode



  • Integrity plus
  • Restrictions to accessing memory
  • Kernel or userspace

Signing BPF



  • Reuse module signing utility
  • Add signature to bpf_attr
  • Reuse module verification in kernel

bpftool



  • New 'sign' command
  • Sign the ELF file
  • Sign each ELF section

libbpf



  • Notices signature
  • Adds it to the PROG_LOAD bpf_attr

kernel



  • Notices signature
  • Checks it like with kernel modules
  • Norman codepath to the verifier

No problems?



  • No code patching
  • CO-RE not involved

BZZT: New class of failure!



  • Tainted signature
  • Code patching, CO-RE
  • BTF adjustments to struct fields
  • enumerator fixups
  • Fallback to bpf_probe_read

Mitigations



  • Code patching highlighted
  • libbpf logs changes made
  • Avoid dynamic generation
  • Use maps for parameters

Not possible?



  • Move parts of libbpf to kernel
  • Code patching
  • After signature verification
  • User mode helper/driver?

THE END

- Try the online editor
- Source code & documentation