BPF lockdown
Using eBPF in kernel lockdown mode
Arnaldo Carvalho de Melo
acme@redhat.com
Red Hat Inc.
What is this about?
- kernel lockdown
- Cryptographic signature of eBPF bytecode
- Limiting access to confidential information
- libbpf code patching
kernel lockdown mode
- Integrity
- Confidentiality
Integrity mode
- kernel and modules signed
- eBPF bytecode signed
Confidentiality mode
- Integrity plus
- Restrictions to accessing memory
- Kernel or userspace
Signing BPF
- Reuse module signing utility
- Add signature to bpf_attr
- Reuse module verification in kernel
bpftool
- New 'sign' command
- Sign the ELF file
- Sign each ELF section
libbpf
- Notices signature
- Adds it to the PROG_LOAD bpf_attr
kernel
- Notices signature
- Checks it like with kernel modules
- Norman codepath to the verifier
No problems?
- No code patching
- CO-RE not involved
BZZT: New class of failure!
- Tainted signature
- Code patching, CO-RE
- BTF adjustments to struct fields
- enumerator fixups
- Fallback to bpf_probe_read
Mitigations
- Code patching highlighted
- libbpf logs changes made
- Avoid dynamic generation
- Use maps for parameters
Not possible?
- Move parts of libbpf to kernel
- Code patching
- After signature verification
- User mode helper/driver?