This patch series introduces the next iteration of the Hornet LSM.
Hornet’s goal is to provide a secure and extensible in-kernel
signature verification mechanism for eBPF programs.

Hornet addresses concerns from users who require strict audit trails and
verification guarantees for eBPF programs, especially in
security-sensitive environments. Many production systems need assurance
that only authorized, unmodified eBPF programs are loaded into the
kernel. Hornet provides this assurance through cryptographic signature
verification.

The currently accepted loader-plus-map signature verification scheme,
mandated by Alexei and KP, is simple to implement and generally
acceptable if users and administrators are satisfied with it. However,
verifying both the loader and the maps offers additional benefits
beyond verifying the loader alone:

1. Security and Audit Integrity

A key advantage is that the LSM hook for authorizing BPF program loads
can operate after signature verification. This ensures:

* Access control decisions are based on verified signature status.
* Accurate system state measurement and logging.
* Log entries claiming a verified signature are truthful, avoiding
  misleading records where only the loader was verified while the actual
  BPF program verification occurs later without logging.

2. TOCTOU Attack Prevention

The current map hash implementation may be vulnerable to a TOCTOU
attack because it allows unfrozen maps to cache a previously
calculated hash. The accepted “trusted loader” scheme cannot detect
this and may permit loading altered maps.

3. Supply Chain Integrity

Verify that eBPF programs and their associated map data have not been
modified since they were built and signed, in the kernel proper, may
aid in protecting against supply chain attacks.

This approach addresses concerns from users who require strict audit
trails and verification guarantees, especially in security-sensitive
environments. Map hashes for extended verification are passed via the
existing PKCS#7 UAPI and verified by the crypto subsystem. Hornet then
calculates the program’s verification state.  Hornet itself does not
enforce a policy on whether unsigned or partially signed programs
should be rejected. It delegates that decision to downstream LSMs
hook, making it a composable building block in a larger security
architecture.

Changes in V7:
- minor IPE fixes
- tooling fixes in gen_sig
- checkpatch fixes

Link to V6: https://lore.kernel.org/linux-security-module/20260429191431.2345448-1-bboscaccy@linux.microsoft.com/

Changes in V6:
- Doc cleanup
- Error handling improvements
- Support for shareable maps

Link to V5: https://lore.kernel.org/linux-security-module/20260420212653.438685-1-bboscaccy@linux.microsoft.com/

Changes in V5:
- Added IPE documentation

Link to V4: https://lore.kernel.org/linux-security-module/20260416173500.176716-1-bboscaccy@linux.microsoft.com/

Changes in V4:
- IPE integration
- Arbitrary keyring support

Link to V3: https://lore.kernel.org/linux-security-module/20260326060655.2550595-1-bboscaccy@linux.microsoft.com/

Changes in V3:
- Updated for signed attribute patch series changes
- Added some new result enum values
- Minor documentation clarification
- Misc style fixes
- Added missing signed-off-by tags

Link to V2: https://lore.kernel.org/linux-security-module/20260227233930.2418522-1-bboscaccy@linux.microsoft.com/

Changes in V2:
- Addressed possible TocTou races in hash verification
- Improved documentation and tooling
- Added Alexie's nack

Link to RFC: https://lore.kernel.org/linux-security-module/20251211021257.1208712-1-bboscaccy@linux.microsoft.com/

Blaise Boscaccy (6):
  lsm: security: Add additional enum values for bpf integrity checks
  security: Hornet LSM
  hornet: Introduce gen_sig
  hornet: Add a light skeleton data extractor scripts
  selftests/hornet: Add a selftest for the Hornet LSM
  ipe: Add BPF program load policy enforcement via Hornet integration

James Bottomley (3):
  crypto: pkcs7: add flag for validated trust on a signed info block
  crypto: pkcs7: add ability to extract signed attributes by OID
  crypto: pkcs7: add tests for pkcs7_get_authattr

Paul Moore (1):
  lsm: framework for BPF integrity verification

 Documentation/admin-guide/LSM/Hornet.rst     | 323 +++++++++++++++
 Documentation/admin-guide/LSM/index.rst      |   1 +
 Documentation/admin-guide/LSM/ipe.rst        | 162 +++++++-
 Documentation/security/ipe.rst               |  68 ++++
 MAINTAINERS                                  |   9 +
 certs/system_keyring.c                       |   1 +
 crypto/asymmetric_keys/Makefile              |   4 +-
 crypto/asymmetric_keys/pkcs7_aa.asn1         |  18 +
 crypto/asymmetric_keys/pkcs7_key_type.c      |  44 +-
 crypto/asymmetric_keys/pkcs7_parser.c        |  81 ++++
 crypto/asymmetric_keys/pkcs7_parser.h        |   1 +
 crypto/asymmetric_keys/pkcs7_trust.c         |   1 +
 include/crypto/pkcs7.h                       |   4 +
 include/linux/lsm_hook_defs.h                |   5 +
 include/linux/oid_registry.h                 |   3 +
 include/linux/security.h                     |  28 ++
 include/uapi/linux/lsm.h                     |   1 +
 scripts/Makefile                             |   1 +
 scripts/hornet/Makefile                      |   5 +
 scripts/hornet/extract-insn.sh               |  27 ++
 scripts/hornet/extract-map.sh                |  27 ++
 scripts/hornet/extract-skel.sh               |  27 ++
 scripts/hornet/gen_sig.c                     | 401 +++++++++++++++++++
 scripts/hornet/write-sig.sh                  |  27 ++
 security/Kconfig                             |   3 +-
 security/Makefile                            |   1 +
 security/hornet/Kconfig                      |  13 +
 security/hornet/Makefile                     |   7 +
 security/hornet/hornet.asn1                  |  12 +
 security/hornet/hornet_lsm.c                 | 352 ++++++++++++++++
 security/ipe/Kconfig                         |  15 +
 security/ipe/audit.c                         |  15 +
 security/ipe/eval.c                          |  93 ++++-
 security/ipe/eval.h                          |  11 +
 security/ipe/hooks.c                         |  63 +++
 security/ipe/hooks.h                         |  15 +
 security/ipe/ipe.c                           |  14 +
 security/ipe/ipe.h                           |   3 +
 security/ipe/policy.h                        |  14 +
 security/ipe/policy_parser.c                 |  27 ++
 security/security.c                          |  75 +++-
 tools/testing/selftests/Makefile             |   1 +
 tools/testing/selftests/hornet/Makefile      |  63 +++
 tools/testing/selftests/hornet/loader.c      |  21 +
 tools/testing/selftests/hornet/trivial.bpf.c |  33 ++
 45 files changed, 2112 insertions(+), 8 deletions(-)
 create mode 100644 Documentation/admin-guide/LSM/Hornet.rst
 create mode 100644 crypto/asymmetric_keys/pkcs7_aa.asn1
 create mode 100644 scripts/hornet/Makefile
 create mode 100755 scripts/hornet/extract-insn.sh
 create mode 100755 scripts/hornet/extract-map.sh
 create mode 100755 scripts/hornet/extract-skel.sh
 create mode 100644 scripts/hornet/gen_sig.c
 create mode 100755 scripts/hornet/write-sig.sh
 create mode 100644 security/hornet/Kconfig
 create mode 100644 security/hornet/Makefile
 create mode 100644 security/hornet/hornet.asn1
 create mode 100644 security/hornet/hornet_lsm.c
 create mode 100644 tools/testing/selftests/hornet/Makefile
 create mode 100644 tools/testing/selftests/hornet/loader.c
 create mode 100644 tools/testing/selftests/hornet/trivial.bpf.c

-- 
2.53.0

On Thu, May 7, 2026 at 3:14 PM Blaise Boscaccy
<bboscaccy@linux.microsoft.com> wrote:
>
> This patch series introduces the next iteration of the Hornet LSM.
> Hornet’s goal is to provide a secure and extensible in-kernel
> signature verification mechanism for eBPF programs.
>
> Hornet addresses concerns from users who require strict audit trails and
> verification guarantees for eBPF programs, especially in
> security-sensitive environments. Many production systems need assurance
> that only authorized, unmodified eBPF programs are loaded into the
> kernel. Hornet provides this assurance through cryptographic signature
> verification.
>
> The currently accepted loader-plus-map signature verification scheme,
> mandated by Alexei and KP, is simple to implement and generally
> acceptable if users and administrators are satisfied with it. However,
> verifying both the loader and the maps offers additional benefits
> beyond verifying the loader alone:
>
> 1. Security and Audit Integrity
>
> A key advantage is that the LSM hook for authorizing BPF program loads
> can operate after signature verification. This ensures:
>
> * Access control decisions are based on verified signature status.
> * Accurate system state measurement and logging.
> * Log entries claiming a verified signature are truthful, avoiding
>   misleading records where only the loader was verified while the actual
>   BPF program verification occurs later without logging.
>
> 2. TOCTOU Attack Prevention
>
> The current map hash implementation may be vulnerable to a TOCTOU
> attack because it allows unfrozen maps to cache a previously
> calculated hash. The accepted “trusted loader” scheme cannot detect
> this and may permit loading altered maps.
>
> 3. Supply Chain Integrity
>
> Verify that eBPF programs and their associated map data have not been
> modified since they were built and signed, in the kernel proper, may
> aid in protecting against supply chain attacks.
>
> This approach addresses concerns from users who require strict audit
> trails and verification guarantees, especially in security-sensitive
> environments. Map hashes for extended verification are passed via the
> existing PKCS#7 UAPI and verified by the crypto subsystem. Hornet then
> calculates the program’s verification state.  Hornet itself does not
> enforce a policy on whether unsigned or partially signed programs
> should be rejected. It delegates that decision to downstream LSMs
> hook, making it a composable building block in a larger security
> architecture.

[NOTE: trimmed changelog for brevity]

> Blaise Boscaccy (6):
>   lsm: security: Add additional enum values for bpf integrity checks
>   security: Hornet LSM
>   hornet: Introduce gen_sig
>   hornet: Add a light skeleton data extractor scripts
>   selftests/hornet: Add a selftest for the Hornet LSM
>   ipe: Add BPF program load policy enforcement via Hornet integration
>
> James Bottomley (3):
>   crypto: pkcs7: add flag for validated trust on a signed info block
>   crypto: pkcs7: add ability to extract signed attributes by OID
>   crypto: pkcs7: add tests for pkcs7_get_authattr
>
> Paul Moore (1):
>   lsm: framework for BPF integrity verification
>
>  Documentation/admin-guide/LSM/Hornet.rst     | 323 +++++++++++++++
>  Documentation/admin-guide/LSM/index.rst      |   1 +
>  Documentation/admin-guide/LSM/ipe.rst        | 162 +++++++-
>  Documentation/security/ipe.rst               |  68 ++++
>  MAINTAINERS                                  |   9 +
>  certs/system_keyring.c                       |   1 +
>  crypto/asymmetric_keys/Makefile              |   4 +-
>  crypto/asymmetric_keys/pkcs7_aa.asn1         |  18 +
>  crypto/asymmetric_keys/pkcs7_key_type.c      |  44 +-
>  crypto/asymmetric_keys/pkcs7_parser.c        |  81 ++++
>  crypto/asymmetric_keys/pkcs7_parser.h        |   1 +
>  crypto/asymmetric_keys/pkcs7_trust.c         |   1 +
>  include/crypto/pkcs7.h                       |   4 +
>  include/linux/lsm_hook_defs.h                |   5 +
>  include/linux/oid_registry.h                 |   3 +
>  include/linux/security.h                     |  28 ++
>  include/uapi/linux/lsm.h                     |   1 +
>  scripts/Makefile                             |   1 +
>  scripts/hornet/Makefile                      |   5 +
>  scripts/hornet/extract-insn.sh               |  27 ++
>  scripts/hornet/extract-map.sh                |  27 ++
>  scripts/hornet/extract-skel.sh               |  27 ++
>  scripts/hornet/gen_sig.c                     | 401 +++++++++++++++++++
>  scripts/hornet/write-sig.sh                  |  27 ++
>  security/Kconfig                             |   3 +-
>  security/Makefile                            |   1 +
>  security/hornet/Kconfig                      |  13 +
>  security/hornet/Makefile                     |   7 +
>  security/hornet/hornet.asn1                  |  12 +
>  security/hornet/hornet_lsm.c                 | 352 ++++++++++++++++
>  security/ipe/Kconfig                         |  15 +
>  security/ipe/audit.c                         |  15 +
>  security/ipe/eval.c                          |  93 ++++-
>  security/ipe/eval.h                          |  11 +
>  security/ipe/hooks.c                         |  63 +++
>  security/ipe/hooks.h                         |  15 +
>  security/ipe/ipe.c                           |  14 +
>  security/ipe/ipe.h                           |   3 +
>  security/ipe/policy.h                        |  14 +
>  security/ipe/policy_parser.c                 |  27 ++
>  security/security.c                          |  75 +++-
>  tools/testing/selftests/Makefile             |   1 +
>  tools/testing/selftests/hornet/Makefile      |  63 +++
>  tools/testing/selftests/hornet/loader.c      |  21 +
>  tools/testing/selftests/hornet/trivial.bpf.c |  33 ++
>  45 files changed, 2112 insertions(+), 8 deletions(-)
>  create mode 100644 Documentation/admin-guide/LSM/Hornet.rst
>  create mode 100644 crypto/asymmetric_keys/pkcs7_aa.asn1
>  create mode 100644 scripts/hornet/Makefile
>  create mode 100755 scripts/hornet/extract-insn.sh
>  create mode 100755 scripts/hornet/extract-map.sh
>  create mode 100755 scripts/hornet/extract-skel.sh
>  create mode 100644 scripts/hornet/gen_sig.c
>  create mode 100755 scripts/hornet/write-sig.sh
>  create mode 100644 security/hornet/Kconfig
>  create mode 100644 security/hornet/Makefile
>  create mode 100644 security/hornet/hornet.asn1
>  create mode 100644 security/hornet/hornet_lsm.c
>  create mode 100644 tools/testing/selftests/hornet/Makefile
>  create mode 100644 tools/testing/selftests/hornet/loader.c
>  create mode 100644 tools/testing/selftests/hornet/trivial.bpf.c

[NOTE: added the linux-crypto list to the To/CC lines]

Hi crypto folks,

You'll notice there are three patches from James Bottomley in this
patchset that touch crypto code and I'd appreciate it if you could
take a look and either ACK the patches or let James and Blaise know
what you would like changed.  James did send these patches to you for
review some time ago, so they aren't necessarily new, but I wanted to
make sure you saw them again.

Unfortunately, it doesn't look like the crypto list was CC'd on this
patchset, so here is a lore link to the patchset as a whole:

https://lore.kernel.org/linux-security-module/20260507191416.2984054-1-bboscaccy@linux.microsoft.com

... and here are lore links to the three crypto patches:

https://lore.kernel.org/linux-security-module/20260507191416.2984054-2-bboscaccy@linux.microsoft.com

https://lore.kernel.org/linux-security-module/20260507191416.2984054-3-bboscaccy@linux.microsoft.com

https://lore.kernel.org/linux-security-module/20260507191416.2984054-4-bboscaccy@linux.microsoft.com

Thanks.

-- 
paul-moore.com

On Thu, May 07, 2026 at 04:57:35PM -0400, Paul Moore wrote:
> On Thu, May 7, 2026 at 3:14 PM Blaise Boscaccy
> <bboscaccy@linux.microsoft.com> wrote:
> >
> > This patch series introduces the next iteration of the Hornet LSM.
> > Hornet’s goal is to provide a secure and extensible in-kernel
> > signature verification mechanism for eBPF programs.
> >
> > Hornet addresses concerns from users who require strict audit trails and
> > verification guarantees for eBPF programs, especially in
> > security-sensitive environments. Many production systems need assurance
> > that only authorized, unmodified eBPF programs are loaded into the
> > kernel. Hornet provides this assurance through cryptographic signature
> > verification.
> >
> > The currently accepted loader-plus-map signature verification scheme,
> > mandated by Alexei and KP, is simple to implement and generally
> > acceptable if users and administrators are satisfied with it. However,
> > verifying both the loader and the maps offers additional benefits
> > beyond verifying the loader alone:
> >
> > 1. Security and Audit Integrity
> >
> > A key advantage is that the LSM hook for authorizing BPF program loads
> > can operate after signature verification. This ensures:
> >
> > * Access control decisions are based on verified signature status.
> > * Accurate system state measurement and logging.
> > * Log entries claiming a verified signature are truthful, avoiding
> >   misleading records where only the loader was verified while the actual
> >   BPF program verification occurs later without logging.
> >
> > 2. TOCTOU Attack Prevention
> >
> > The current map hash implementation may be vulnerable to a TOCTOU
> > attack because it allows unfrozen maps to cache a previously
> > calculated hash. The accepted “trusted loader” scheme cannot detect
> > this and may permit loading altered maps.
> >
> > 3. Supply Chain Integrity
> >
> > Verify that eBPF programs and their associated map data have not been
> > modified since they were built and signed, in the kernel proper, may
> > aid in protecting against supply chain attacks.
> >
> > This approach addresses concerns from users who require strict audit
> > trails and verification guarantees, especially in security-sensitive
> > environments. Map hashes for extended verification are passed via the
> > existing PKCS#7 UAPI and verified by the crypto subsystem. Hornet then
> > calculates the program’s verification state.  Hornet itself does not
> > enforce a policy on whether unsigned or partially signed programs
> > should be rejected. It delegates that decision to downstream LSMs
> > hook, making it a composable building block in a larger security
> > architecture.
> 
> [NOTE: trimmed changelog for brevity]
> 
> > Blaise Boscaccy (6):
> >   lsm: security: Add additional enum values for bpf integrity checks
> >   security: Hornet LSM
> >   hornet: Introduce gen_sig
> >   hornet: Add a light skeleton data extractor scripts
> >   selftests/hornet: Add a selftest for the Hornet LSM
> >   ipe: Add BPF program load policy enforcement via Hornet integration
> >
> > James Bottomley (3):
> >   crypto: pkcs7: add flag for validated trust on a signed info block
> >   crypto: pkcs7: add ability to extract signed attributes by OID
> >   crypto: pkcs7: add tests for pkcs7_get_authattr
> >
> > Paul Moore (1):
> >   lsm: framework for BPF integrity verification
> >
> >  Documentation/admin-guide/LSM/Hornet.rst     | 323 +++++++++++++++
> >  Documentation/admin-guide/LSM/index.rst      |   1 +
> >  Documentation/admin-guide/LSM/ipe.rst        | 162 +++++++-
> >  Documentation/security/ipe.rst               |  68 ++++
> >  MAINTAINERS                                  |   9 +
> >  certs/system_keyring.c                       |   1 +
> >  crypto/asymmetric_keys/Makefile              |   4 +-
> >  crypto/asymmetric_keys/pkcs7_aa.asn1         |  18 +
> >  crypto/asymmetric_keys/pkcs7_key_type.c      |  44 +-
> >  crypto/asymmetric_keys/pkcs7_parser.c        |  81 ++++
> >  crypto/asymmetric_keys/pkcs7_parser.h        |   1 +
> >  crypto/asymmetric_keys/pkcs7_trust.c         |   1 +
> >  include/crypto/pkcs7.h                       |   4 +
> >  include/linux/lsm_hook_defs.h                |   5 +
> >  include/linux/oid_registry.h                 |   3 +
> >  include/linux/security.h                     |  28 ++
> >  include/uapi/linux/lsm.h                     |   1 +
> >  scripts/Makefile                             |   1 +
> >  scripts/hornet/Makefile                      |   5 +
> >  scripts/hornet/extract-insn.sh               |  27 ++
> >  scripts/hornet/extract-map.sh                |  27 ++
> >  scripts/hornet/extract-skel.sh               |  27 ++
> >  scripts/hornet/gen_sig.c                     | 401 +++++++++++++++++++
> >  scripts/hornet/write-sig.sh                  |  27 ++
> >  security/Kconfig                             |   3 +-
> >  security/Makefile                            |   1 +
> >  security/hornet/Kconfig                      |  13 +
> >  security/hornet/Makefile                     |   7 +
> >  security/hornet/hornet.asn1                  |  12 +
> >  security/hornet/hornet_lsm.c                 | 352 ++++++++++++++++
> >  security/ipe/Kconfig                         |  15 +
> >  security/ipe/audit.c                         |  15 +
> >  security/ipe/eval.c                          |  93 ++++-
> >  security/ipe/eval.h                          |  11 +
> >  security/ipe/hooks.c                         |  63 +++
> >  security/ipe/hooks.h                         |  15 +
> >  security/ipe/ipe.c                           |  14 +
> >  security/ipe/ipe.h                           |   3 +
> >  security/ipe/policy.h                        |  14 +
> >  security/ipe/policy_parser.c                 |  27 ++
> >  security/security.c                          |  75 +++-
> >  tools/testing/selftests/Makefile             |   1 +
> >  tools/testing/selftests/hornet/Makefile      |  63 +++
> >  tools/testing/selftests/hornet/loader.c      |  21 +
> >  tools/testing/selftests/hornet/trivial.bpf.c |  33 ++
> >  45 files changed, 2112 insertions(+), 8 deletions(-)
> >  create mode 100644 Documentation/admin-guide/LSM/Hornet.rst
> >  create mode 100644 crypto/asymmetric_keys/pkcs7_aa.asn1
> >  create mode 100644 scripts/hornet/Makefile
> >  create mode 100755 scripts/hornet/extract-insn.sh
> >  create mode 100755 scripts/hornet/extract-map.sh
> >  create mode 100755 scripts/hornet/extract-skel.sh
> >  create mode 100644 scripts/hornet/gen_sig.c
> >  create mode 100755 scripts/hornet/write-sig.sh
> >  create mode 100644 security/hornet/Kconfig
> >  create mode 100644 security/hornet/Makefile
> >  create mode 100644 security/hornet/hornet.asn1
> >  create mode 100644 security/hornet/hornet_lsm.c
> >  create mode 100644 tools/testing/selftests/hornet/Makefile
> >  create mode 100644 tools/testing/selftests/hornet/loader.c
> >  create mode 100644 tools/testing/selftests/hornet/trivial.bpf.c
> 
> [NOTE: added the linux-crypto list to the To/CC lines]
> 
> Hi crypto folks,
> 
> You'll notice there are three patches from James Bottomley in this
> patchset that touch crypto code and I'd appreciate it if you could
> take a look and either ACK the patches or let James and Blaise know
> what you would like changed.  James did send these patches to you for
> review some time ago, so they aren't necessarily new, but I wanted to
> make sure you saw them again.
> 
> Unfortunately, it doesn't look like the crypto list was CC'd on this
> patchset, so here is a lore link to the patchset as a whole:
> 
> https://lore.kernel.org/linux-security-module/20260507191416.2984054-1-bboscaccy@linux.microsoft.com
> 
> ... and here are lore links to the three crypto patches:

We discussed before how the actual signature check seemed to have been
overlooked in some cases, due to the complexities of PKCS#7
(https://lore.kernel.org/r/20260305185016.GC2796@quark/).  Looks like
that was fixed.  It is really hard to do any meaningful review of a
PKCS#7 based system, though.  And it sounds like this one is proceeding
anyway due to some requirement to be compatible with an existing PKCS#7
based system.  So I'm not sure what you're looking for.

- Eric

On Thu, May 7, 2026 at 5:58 PM Eric Biggers <ebiggers@kernel.org> wrote:
> On Thu, May 07, 2026 at 04:57:35PM -0400, Paul Moore wrote:
> > On Thu, May 7, 2026 at 3:14 PM Blaise Boscaccy
> > <bboscaccy@linux.microsoft.com> wrote:
> > >
> > > This patch series introduces the next iteration of the Hornet LSM.
> > > Hornet’s goal is to provide a secure and extensible in-kernel
> > > signature verification mechanism for eBPF programs.
> > >
> > > Hornet addresses concerns from users who require strict audit trails and
> > > verification guarantees for eBPF programs, especially in
> > > security-sensitive environments. Many production systems need assurance
> > > that only authorized, unmodified eBPF programs are loaded into the
> > > kernel. Hornet provides this assurance through cryptographic signature
> > > verification.
> > >
> > > The currently accepted loader-plus-map signature verification scheme,
> > > mandated by Alexei and KP, is simple to implement and generally
> > > acceptable if users and administrators are satisfied with it. However,
> > > verifying both the loader and the maps offers additional benefits
> > > beyond verifying the loader alone:
> > >
> > > 1. Security and Audit Integrity
> > >
> > > A key advantage is that the LSM hook for authorizing BPF program loads
> > > can operate after signature verification. This ensures:
> > >
> > > * Access control decisions are based on verified signature status.
> > > * Accurate system state measurement and logging.
> > > * Log entries claiming a verified signature are truthful, avoiding
> > >   misleading records where only the loader was verified while the actual
> > >   BPF program verification occurs later without logging.
> > >
> > > 2. TOCTOU Attack Prevention
> > >
> > > The current map hash implementation may be vulnerable to a TOCTOU
> > > attack because it allows unfrozen maps to cache a previously
> > > calculated hash. The accepted “trusted loader” scheme cannot detect
> > > this and may permit loading altered maps.
> > >
> > > 3. Supply Chain Integrity
> > >
> > > Verify that eBPF programs and their associated map data have not been
> > > modified since they were built and signed, in the kernel proper, may
> > > aid in protecting against supply chain attacks.
> > >
> > > This approach addresses concerns from users who require strict audit
> > > trails and verification guarantees, especially in security-sensitive
> > > environments. Map hashes for extended verification are passed via the
> > > existing PKCS#7 UAPI and verified by the crypto subsystem. Hornet then
> > > calculates the program’s verification state.  Hornet itself does not
> > > enforce a policy on whether unsigned or partially signed programs
> > > should be rejected. It delegates that decision to downstream LSMs
> > > hook, making it a composable building block in a larger security
> > > architecture.
> >
> > [NOTE: trimmed changelog for brevity]
> >
> > > Blaise Boscaccy (6):
> > >   lsm: security: Add additional enum values for bpf integrity checks
> > >   security: Hornet LSM
> > >   hornet: Introduce gen_sig
> > >   hornet: Add a light skeleton data extractor scripts
> > >   selftests/hornet: Add a selftest for the Hornet LSM
> > >   ipe: Add BPF program load policy enforcement via Hornet integration
> > >
> > > James Bottomley (3):
> > >   crypto: pkcs7: add flag for validated trust on a signed info block
> > >   crypto: pkcs7: add ability to extract signed attributes by OID
> > >   crypto: pkcs7: add tests for pkcs7_get_authattr
> > >
> > > Paul Moore (1):
> > >   lsm: framework for BPF integrity verification
> > >
> > >  Documentation/admin-guide/LSM/Hornet.rst     | 323 +++++++++++++++
> > >  Documentation/admin-guide/LSM/index.rst      |   1 +
> > >  Documentation/admin-guide/LSM/ipe.rst        | 162 +++++++-
> > >  Documentation/security/ipe.rst               |  68 ++++
> > >  MAINTAINERS                                  |   9 +
> > >  certs/system_keyring.c                       |   1 +
> > >  crypto/asymmetric_keys/Makefile              |   4 +-
> > >  crypto/asymmetric_keys/pkcs7_aa.asn1         |  18 +
> > >  crypto/asymmetric_keys/pkcs7_key_type.c      |  44 +-
> > >  crypto/asymmetric_keys/pkcs7_parser.c        |  81 ++++
> > >  crypto/asymmetric_keys/pkcs7_parser.h        |   1 +
> > >  crypto/asymmetric_keys/pkcs7_trust.c         |   1 +
> > >  include/crypto/pkcs7.h                       |   4 +
> > >  include/linux/lsm_hook_defs.h                |   5 +
> > >  include/linux/oid_registry.h                 |   3 +
> > >  include/linux/security.h                     |  28 ++
> > >  include/uapi/linux/lsm.h                     |   1 +
> > >  scripts/Makefile                             |   1 +
> > >  scripts/hornet/Makefile                      |   5 +
> > >  scripts/hornet/extract-insn.sh               |  27 ++
> > >  scripts/hornet/extract-map.sh                |  27 ++
> > >  scripts/hornet/extract-skel.sh               |  27 ++
> > >  scripts/hornet/gen_sig.c                     | 401 +++++++++++++++++++
> > >  scripts/hornet/write-sig.sh                  |  27 ++
> > >  security/Kconfig                             |   3 +-
> > >  security/Makefile                            |   1 +
> > >  security/hornet/Kconfig                      |  13 +
> > >  security/hornet/Makefile                     |   7 +
> > >  security/hornet/hornet.asn1                  |  12 +
> > >  security/hornet/hornet_lsm.c                 | 352 ++++++++++++++++
> > >  security/ipe/Kconfig                         |  15 +
> > >  security/ipe/audit.c                         |  15 +
> > >  security/ipe/eval.c                          |  93 ++++-
> > >  security/ipe/eval.h                          |  11 +
> > >  security/ipe/hooks.c                         |  63 +++
> > >  security/ipe/hooks.h                         |  15 +
> > >  security/ipe/ipe.c                           |  14 +
> > >  security/ipe/ipe.h                           |   3 +
> > >  security/ipe/policy.h                        |  14 +
> > >  security/ipe/policy_parser.c                 |  27 ++
> > >  security/security.c                          |  75 +++-
> > >  tools/testing/selftests/Makefile             |   1 +
> > >  tools/testing/selftests/hornet/Makefile      |  63 +++
> > >  tools/testing/selftests/hornet/loader.c      |  21 +
> > >  tools/testing/selftests/hornet/trivial.bpf.c |  33 ++
> > >  45 files changed, 2112 insertions(+), 8 deletions(-)
> > >  create mode 100644 Documentation/admin-guide/LSM/Hornet.rst
> > >  create mode 100644 crypto/asymmetric_keys/pkcs7_aa.asn1
> > >  create mode 100644 scripts/hornet/Makefile
> > >  create mode 100755 scripts/hornet/extract-insn.sh
> > >  create mode 100755 scripts/hornet/extract-map.sh
> > >  create mode 100755 scripts/hornet/extract-skel.sh
> > >  create mode 100644 scripts/hornet/gen_sig.c
> > >  create mode 100755 scripts/hornet/write-sig.sh
> > >  create mode 100644 security/hornet/Kconfig
> > >  create mode 100644 security/hornet/Makefile
> > >  create mode 100644 security/hornet/hornet.asn1
> > >  create mode 100644 security/hornet/hornet_lsm.c
> > >  create mode 100644 tools/testing/selftests/hornet/Makefile
> > >  create mode 100644 tools/testing/selftests/hornet/loader.c
> > >  create mode 100644 tools/testing/selftests/hornet/trivial.bpf.c
> >
> > [NOTE: added the linux-crypto list to the To/CC lines]
> >
> > Hi crypto folks,
> >
> > You'll notice there are three patches from James Bottomley in this
> > patchset that touch crypto code and I'd appreciate it if you could
> > take a look and either ACK the patches or let James and Blaise know
> > what you would like changed.  James did send these patches to you for
> > review some time ago, so they aren't necessarily new, but I wanted to
> > make sure you saw them again.
> >
> > Unfortunately, it doesn't look like the crypto list was CC'd on this
> > patchset, so here is a lore link to the patchset as a whole:
> >
> > https://lore.kernel.org/linux-security-module/20260507191416.2984054-1-bboscaccy@linux.microsoft.com
> >
> > ... and here are lore links to the three crypto patches:
>
> We discussed before how the actual signature check seemed to have been
> overlooked in some cases, due to the complexities of PKCS#7
> (https://lore.kernel.org/r/20260305185016.GC2796@quark/).  Looks like
> that was fixed.  It is really hard to do any meaningful review of a
> PKCS#7 based system, though.  And it sounds like this one is proceeding
> anyway due to some requirement to be compatible with an existing PKCS#7
> based system.  So I'm not sure what you're looking for.

Ideally an ACK that you approve of merging those three crypto patches
via the LSM tree, or a quick comment if you happen to see anything
that needs changing.

-- 
paul-moore.com