Speaker
Description
eBPF programs enter the kernel as privileged extensions and, once admitted, become part of the system’s trusted computing base. Prior LPC discussions established BPF signing as a way to track the provenance of these programs, while deliberately separating signature verification from the policy that consumes it [1,2]. IMA was identified as one possible consumer through LSM integration, but its enforcement semantics were left open. Follow-up discussion highlighted unresolved issues involving dynamically generated programs, trusted loaders, and applications such as Cilium and bpftrace.
We developed IMA-BPF as a concrete continuation of this work. IMA-BPF connects BPF signatures to IMA policy, measurement, appraisal, and TPM-backed attestation. It preserves signer provenance for programs created by signed loaders, allowing resident programs to be re-evaluated after the original loader disappears. We also introduce reappraisal and purge mechanisms, allowing programs that no longer satisfy current policy or trust state to be detached and removed through BPF’s link and reference based lifetime mechanisms.
This talk will explain how IMA-BPF extends BPF signing into an integrity lifecycle, evaluated through Cilium vulnerability remediation. We hope to discuss three areas: the practicality of adopting signing across real BPF workloads; how the BPF ecosystem should standardize provenance for dynamically generated programs, such as providing common reference tooling in different languages; and how our initial reappraisal and revocation policies and mechanisms should be refined. Although our prototype demonstrates this lifecycle end to end, we hope to use the discussion to improve the design and identify a practical path toward upstream adoption.
References
- KP Singh, BPF Signing and IMA Integration, https://lpc.events/event/16/contributions/1357/
- KP Singh, Discussion: What’s Next for BPF Signing, https://lpc.events/event/19/contributions/2167/