BPF_LSM + fsverity for Binary Authorization
summary
Proposal implements binary authorization using fs-verity hashes signed by a secure signing service, signatures stored in xattrs, and enforcement by BPF_LSM with a user daemon to manage keyrings and programs. A PoC/patchset exists and requires two new kfuncs: bpf_fsverity_get_digest to read the fs‑verity root hash and bpf_vfs_getxattr to fetch the signature; verification sets a task-local allow list and LSM hooks block protected operations if no match. Overlay‑FS interactions need extra work; basic flow works in testing.
AI-written summary · about
chapters (5)
- 0:00Introduction to BPF LSM and fsverity
- 3:13Existing solutions and limitations
- 6:48Proposed framework overview
- 10:53Implementation details and BPF hooks
- 15:09Q&A and discussion
related talks
25mDiscussion: What's next for BPF Signing
27mBPF LSM - Updates and What next?
32mfs-verity: Native File-based Authenticity
24mBPF Signing and IMA integration
38mSecure the Linux Kernel with eBPF Linux Security Module
33mKernel Runtime Security Instrumentation
57mBPF and Security. Friends and Foes
26mHornet LSM