Reintroduce Hornet LSM

This adds the Hornet Linux Security Module which provides enhanced signature verification and data validation for eBPF programs. This allows users to continue to maintain an invariant that all code running inside of the kernel has actually been signed and verified, by the kernel.

This effort builds upon the currently excepted upstream solution. It further hardens it by providing deterministic, in-kernel checking of map hashes to solidify auditing along with preventing TOCTOU attacks against lskel map hashes.

Target map hashes are passed in via PKCS#7 signed attributes. Hornet determines the extent which the eBFP program is signed and defers to other LSMs for policy decisions.

Signed-off-by Blaise Boscaccy <[email protected]>

Nacked-by Alexei Starovoitov <[email protected]>

security/hornet/Kconfig new file +7 -0

+       default n
+       help
+         This selects Hornet.
+         Further information can be found in
+         Documentation/admin-guide/LSM/Hornet.rst.
+
+         If you are unsure how to answer this question, answer N.

security/hornet/Makefile new file +7 -0

new file mode 100644
index 0000000000000..26b6f954f762e
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+obj-$(CONFIG_SECURITY_HORNET) := hornet.o
+
+hornet-y := hornet.asn1.o \
+       hornet_lsm.o \
+
+$(obj)/hornet.asn1.o: $(obj)/hornet.asn1.c $(obj)/hornet.asn1.h

security/hornet/hornet.asn1 new file +0 -0

new file mode 100644
index 0000000000000..c8d47b16b65d7

security/hornet/hornet.asn1 new file +9 -0

+--
+-- https://www.rfc-editor.org/rfc/rfc5652#section-3
+
+HornetData ::= SET OF Map
+
+Map ::= SEQUENCE {
+       index                   INTEGER ({ hornet_map_index }),
+       sha                     OCTET STRING ({ hornet_map_hash })
+} ({ hornet_next_map })

security/hornet/hornet_lsm.c new file +37 -0

new file mode 100644
index 0000000000000..f7d62fe6229c9
@@ -0,0 +1,346 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Hornet Linux Security Module
+ *
+ * Author: Blaise Boscaccy <[email protected]>
+ *
+ * Copyright (C) 2026 Microsoft Corporation
+ */
+
+#include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
+#include <linux/bpf.h>
+#include <linux/verification.h>
+#include <crypto/public_key.h>
+#include <linux/module_signature.h>
+#include <crypto/pkcs7.h>
+#include <linux/sort.h>
+#include <linux/asn1_decoder.h>
+#include <linux/oid_registry.h>
+#include "hornet.asn1.h"
+
+#define MAX_USED_MAPS 64
+
+struct hornet_maps {
+       bpfptr_t fd_array;
+};
+
+/* The only hashing algorithm available is SHA256 due to it be hardcoded
+   in the bpf subsystem. */
+
+struct hornet_parse_context {
+       int indexes[MAX_USED_MAPS];
+       bool skips[MAX_USED_MAPS];
+       unsigned char hashes[SHA256_DIGEST_SIZE * MAX_USED_MAPS];
+       int hash_count;
+};
+

security/hornet/hornet_lsm.c new file +142 -0

+struct lsm_blob_sizes hornet_blob_sizes __ro_after_init = {
+       .lbs_bpf_map = sizeof(struct hornet_map_security_struct),
+       .lbs_bpf_prog = sizeof(struct hornet_prog_security_struct),
+};
+
+static inline struct hornet_prog_security_struct *
+hornet_bpf_prog_security(struct bpf_prog *prog)
+{
+       return prog->aux->security + hornet_blob_sizes.lbs_bpf_prog;
+}
+
+static inline struct hornet_map_security_struct *
+hornet_bpf_map_security(struct bpf_map *map)
+{
+       return map->security + hornet_blob_sizes.lbs_bpf_map;
+}
+
+static int hornet_verify_hashes(struct hornet_maps *maps,
+                               struct hornet_parse_context *ctx,
+                               struct bpf_prog *prog)
+{
+       int map_fd;
+       u32 i;
+       struct bpf_map *map;
+       int err = 0;
+       unsigned char hash[SHA256_DIGEST_SIZE];
+       struct hornet_prog_security_struct *security = hornet_bpf_prog_security(prog);
+       struct hornet_map_security_struct *map_security;
+
+       for (i = 0; i < ctx->hash_count; i++) {
+               if (ctx->skips[i])
+                       continue;
+
+               err = copy_from_bpfptr_offset(&map_fd, maps->fd_array,
+                                             ctx->indexes[i] * sizeof(map_fd),
+                                             sizeof(map_fd));
+               if (err < 0)
+                       return LSM_INT_VERDICT_FAULT;
+
+               CLASS(fd, f)(map_fd);
+               if (fd_empty(f))
+                       return LSM_INT_VERDICT_FAULT;
+               if (unlikely(fd_file(f)->f_op != &bpf_map_fops))
+                       return LSM_INT_VERDICT_FAULT;
+
+               map = fd_file(f)->private_data;
+               if (!map->frozen)
+                       return LSM_INT_VERDICT_FAULT;
+
+               map->ops->map_get_hash(map, SHA256_DIGEST_SIZE, hash);
+
+               err = memcmp(hash, &ctx->hashes[i * SHA256_DIGEST_SIZE],
+                             SHA256_DIGEST_SIZE);
+               if (err)
+                       return LSM_INT_VERDICT_UNEXPECTED;
+
+               security->checked[i] = true;
+               memcpy(&security->hashes[i * SHA256_DIGEST_SIZE], hash, SHA256_DIGEST_SIZE);
+               map_security = hornet_bpf_map_security(map);
+               map_security->checked = true;
+               map_security->index = i;
+       }
+       return LSM_INT_VERDICT_OK;
+}
+
+int hornet_next_map(void *context, size_t hdrlen,
+                    unsigned char tag,
+                    const void *value, size_t vlen)
+{
+       struct hornet_parse_context *ctx = (struct hornet_parse_context *)context;
+
+       if (++ctx->hash_count >= MAX_USED_MAPS)
+               return -EINVAL;
+       return 0;
+}
+
+int hornet_map_index(void *context, size_t hdrlen,
+                    unsigned char tag,
+                    const void *value, size_t vlen)
+{
+       struct hornet_parse_context *ctx = (struct hornet_parse_context *)context;
+
+       if (vlen > 1)
+               return -EINVAL;
+
+       ctx->indexes[ctx->hash_count] = *(u8 *)value;
+       return 0;
+}
+
+int hornet_map_hash(void *context, size_t hdrlen,
+                   unsigned char tag,
+                   const void *value, size_t vlen)
+
+{
+       struct hornet_parse_context *ctx = (struct hornet_parse_context *)context;
+
+       if (vlen != SHA256_DIGEST_SIZE && vlen != 0)
+               return -EINVAL;
+
+       if (vlen) {
+               ctx->skips[ctx->hash_count] = false;
+               memcpy(&ctx->hashes[ctx->hash_count * SHA256_DIGEST_SIZE], value, vlen);
+       } else
+               ctx->skips[ctx->hash_count] = true;
+
+       return 0;
+}
+
+static int hornet_check_program(struct bpf_prog *prog, union bpf_attr *attr,
+                               struct bpf_token *token, bool is_kernel,
+                               enum lsm_integrity_verdict *verdict)
+{
+       struct hornet_maps maps = {0};
+       bpfptr_t usig = make_bpfptr(attr->signature, is_kernel);
+       struct pkcs7_message *msg;
+       struct hornet_parse_context *ctx;
+       void *sig;
+       int err;
+       const void *authattrs;
+       size_t authattrs_len;
+       struct key *key;
+
+       if (!attr->signature) {
+               *verdict = LSM_INT_VERDICT_UNSIGNED;
+               return 0;
+       }
+
+       ctx = kzalloc(sizeof(struct hornet_parse_context), GFP_KERNEL);
+       if (!ctx)
+               return -ENOMEM;
+
+       maps.fd_array = make_bpfptr(attr->fd_array, is_kernel);
+       sig = kzalloc(attr->signature_size, GFP_KERNEL);
+       if (!sig) {
+               err = -ENOMEM;
+               goto out;
+       }
+       err = copy_from_bpfptr(sig, usig, attr->signature_size);
+       if (err != 0)
+               goto cleanup_sig;
+
+       msg = pkcs7_parse_message(sig, attr->signature_size);

security/hornet/hornet_lsm.c new file +99 -0

+
+       if (verify_pkcs7_message_sig(prog->insnsi, prog->len * sizeof(struct bpf_insn), msg,
+                                    key,
+                                    VERIFYING_BPF_SIGNATURE,
+                                    NULL, NULL)) {
+               *verdict = LSM_INT_VERDICT_UNKNOWNKEY;
+               err = 0;
+               goto cleanup_msg;
+       }
+
+       if (pkcs7_get_authattr(msg, OID_hornet_data,
+                              &authattrs, &authattrs_len) == -ENODATA) {
+               *verdict = LSM_INT_VERDICT_PARTIALSIG;
+               err = 0;
+               goto cleanup_msg;
+       }
+
+       err = asn1_ber_decoder(&hornet_decoder, ctx, authattrs, authattrs_len);
+       if (err < 0 || authattrs == NULL) {
+               *verdict = LSM_INT_VERDICT_BADSIG;
+               err = 0;
+               goto cleanup_msg;
+       }
+
+       err = hornet_verify_hashes(&maps, ctx, prog);
+       if (err == 0)
+               *verdict = LSM_INT_VERDICT_OK;
+       else
+               *verdict = err;
+
+cleanup_msg:
+       pkcs7_free_message(msg);
+cleanup_sig:
+       kfree(sig);
+out:
+       kfree(ctx);
+       return err;
+}
+
+static const struct lsm_id hornet_lsmid = {
+       .name = "hornet",
+       .id = LSM_ID_HORNET,
+};
+
+static int hornet_bpf_prog_load_integrity(struct bpf_prog *prog, union bpf_attr *attr,
+                                         struct bpf_token *token, bool is_kernel)
+{
+       enum lsm_integrity_verdict verdict;
+       int result = hornet_check_program(prog, attr, token, is_kernel, &verdict);
+
+       if (result < 0)
+               return result;
+
+       return security_bpf_prog_load_post_integrity(prog, attr, token, is_kernel,
+                                                    &hornet_lsmid, verdict);
+}
+
+static int hornet_verify_map(struct bpf_prog *prog, int index)
+{
+       unsigned char hash[SHA256_DIGEST_SIZE];
+       int i;
+       struct bpf_map *map;
+       struct hornet_prog_security_struct *security = hornet_bpf_prog_security(prog);
+       struct hornet_map_security_struct *map_security;
+
+       if (!security->checked[index])
+               return 0;
+
+       for (i = 0; i < prog->aux->used_map_cnt; i++) {
+               map = prog->aux->used_maps[i];
+               map_security = hornet_bpf_map_security(map);
+               if (map_security->index != index)
+                       continue;
+
+               if (!map->frozen)
+                       return -EPERM;
+
+               map->ops->map_get_hash(map, SHA256_DIGEST_SIZE, hash);
+               if (memcmp(hash, &security->hashes[index * SHA256_DIGEST_SIZE],
+                          SHA256_DIGEST_SIZE) != 0)
+                       return -EPERM;
+               else
+                       return 0;
+       }
+       return -EINVAL;
+}
+
+static int hornet_check_prog_maps(u32 ufd)
+{
+       CLASS(fd, f)(ufd);
+       struct bpf_prog *prog;
+       int i, result = 0;
+
+       if (fd_empty(f))
+               return -EBADF;
+       if (fd_file(f)->f_op != &bpf_prog_fops)
+               return -EINVAL;
+
+       prog = fd_file(f)->private_data;

security/hornet/hornet_lsm.c new file +38 -1

+out:
+       mutex_unlock(&prog->aux->used_maps_mutex);
+       return result;
+}
+
+static int hornet_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
+{
+       /* in horent_bpf(), anything that had originated from kernel space we assume
+          has already been checked, in some form or another, so we don't bother
+          checking the intergity of any maps. In hornet_bpf_prog_load_integrity(),
+          hornet doesn't make any opinion on that and delegates that to the downstream
+          policy enforcement. */
+
+       if (cmd != BPF_PROG_RUN)
+               return 0;
+       if (kernel)
+               return 0;
+
+       return hornet_check_prog_maps(attr->test.prog_fd);
+}
+
+static struct security_hook_list hornet_hooks[] __ro_after_init = {
+       LSM_HOOK_INIT(bpf_prog_load_integrity, hornet_bpf_prog_load_integrity),
+       LSM_HOOK_INIT(bpf, hornet_bpf),
+};
+
+static int __init hornet_init(void)
+{
+       pr_info("Hornet: eBPF signature verification enabled\n");
+       security_add_hooks(hornet_hooks, ARRAY_SIZE(hornet_hooks), &hornet_lsmid);
+       return 0;
+}
+
+DEFINE_LSM(hornet) = {
+       .id = &hornet_lsmid,
+       .blobs = &hornet_blob_sizes,
+       .init = hornet_init,
+};
--

2.53.0

Quoted 18 lines · Blaise Boscaccy

This adds the Hornet Linux Security Module which provides enhanced signature verification and data validation for eBPF programs. This allows users to continue to maintain an invariant that all code running inside of the kernel has actually been signed and verified, by the kernel.

This effort builds upon the currently excepted upstream solution. It further hardens it by providing deterministic, in-kernel checking of map hashes to solidify auditing along with preventing TOCTOU attacks against lskel map hashes.

Target map hashes are passed in via PKCS#7 signed attributes. Hornet determines the extent which the eBFP program is signed and defers to other LSMs for policy decisions.

Signed-off-by Blaise Boscaccy <[email protected]>

Nacked-by Alexei Starovoitov <[email protected]>

...

security/hornet/Kconfig line 4

Quoted 10 lines

security/hornet/Kconfig new file +4 -0

new file mode 100644
index 0000000000000..19406aa237ac6
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0-only
+config SECURITY_HORNET
+       bool "Hornet support"
+       depends on SECURITY

The dependency doesn't seem to be complete, for example, PKCS7_MESSAGE_PARSER is not selected.

Quoted 25 lines

security/hornet/Kconfig new file +7 -0

+       default n
+       help
+         This selects Hornet.
+         Further information can be found in
+         Documentation/admin-guide/LSM/Hornet.rst.
+
+         If you are unsure how to answer this question, answer N.

security/hornet/Makefile new file +7 -0

new file mode 100644
index 0000000000000..26b6f954f762e
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+obj-$(CONFIG_SECURITY_HORNET) := hornet.o
+
+hornet-y := hornet.asn1.o \
+       hornet_lsm.o \
+
+$(obj)/hornet.asn1.o: $(obj)/hornet.asn1.c $(obj)/hornet.asn1.h

security/hornet/hornet.asn1 new file +0 -0

new file mode 100644
index 0000000000000..c8d47b16b65d7

security/hornet/hornet.asn1 line 4

Quoted 5 lines

security/hornet/hornet.asn1 new file +4 -0

@@ -0,0 +1,13 @@
+-- SPDX-License-Identifier: BSD-3-Clause
+--
+-- Copyright (C) 2009 IETF Trust and the persons identified as authors
+-- of the code

I'm not a lawyer, but since this is a new AA which is not in the RFC, should the copyright belong to IETF?

Quoted 59 lines

security/hornet/hornet.asn1 new file +9 -0

+--
+-- https://www.rfc-editor.org/rfc/rfc5652#section-3
+
+HornetData ::= SET OF Map
+
+Map ::= SEQUENCE {
+       index                   INTEGER ({ hornet_map_index }),
+       sha                     OCTET STRING ({ hornet_map_hash })
+} ({ hornet_next_map })

security/hornet/hornet_lsm.c new file +44 -0

new file mode 100644
index 0000000000000..f7d62fe6229c9
@@ -0,0 +1,346 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Hornet Linux Security Module
+ *
+ * Author: Blaise Boscaccy <[email protected]>
+ *
+ * Copyright (C) 2026 Microsoft Corporation
+ */
+
+#include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
+#include <linux/bpf.h>
+#include <linux/verification.h>
+#include <crypto/public_key.h>
+#include <linux/module_signature.h>
+#include <crypto/pkcs7.h>
+#include <linux/sort.h>
+#include <linux/asn1_decoder.h>
+#include <linux/oid_registry.h>
+#include "hornet.asn1.h"
+
+#define MAX_USED_MAPS 64
+
+struct hornet_maps {
+       bpfptr_t fd_array;
+};
+
+/* The only hashing algorithm available is SHA256 due to it be hardcoded
+   in the bpf subsystem. */
+
+struct hornet_parse_context {
+       int indexes[MAX_USED_MAPS];
+       bool skips[MAX_USED_MAPS];
+       unsigned char hashes[SHA256_DIGEST_SIZE * MAX_USED_MAPS];
+       int hash_count;
+};
+
+struct hornet_prog_security_struct {
+       bool checked[MAX_USED_MAPS];
+       unsigned char hashes[SHA256_DIGEST_SIZE * MAX_USED_MAPS];
+};
+
+struct hornet_map_security_struct {
+       bool checked;

security/hornet/hornet_lsm.c line 47

Quoted 3 lines

security/hornet/hornet_lsm.c new file +3 -0

+       int index;
+};
+

Can maps be shared between programs? If so, since the LSM blob is per-map, a second program's load will overwrite map_security->index set by the first. A later run of the first program would then fail to find its own map.

Quoted 142 lines

security/hornet/hornet_lsm.c new file +142 -0

+struct lsm_blob_sizes hornet_blob_sizes __ro_after_init = {
+       .lbs_bpf_map = sizeof(struct hornet_map_security_struct),
+       .lbs_bpf_prog = sizeof(struct hornet_prog_security_struct),
+};
+
+static inline struct hornet_prog_security_struct *
+hornet_bpf_prog_security(struct bpf_prog *prog)
+{
+       return prog->aux->security + hornet_blob_sizes.lbs_bpf_prog;
+}
+
+static inline struct hornet_map_security_struct *
+hornet_bpf_map_security(struct bpf_map *map)
+{
+       return map->security + hornet_blob_sizes.lbs_bpf_map;
+}
+
+static int hornet_verify_hashes(struct hornet_maps *maps,
+                               struct hornet_parse_context *ctx,
+                               struct bpf_prog *prog)
+{
+       int map_fd;
+       u32 i;
+       struct bpf_map *map;
+       int err = 0;
+       unsigned char hash[SHA256_DIGEST_SIZE];
+       struct hornet_prog_security_struct *security = hornet_bpf_prog_security(prog);
+       struct hornet_map_security_struct *map_security;
+
+       for (i = 0; i < ctx->hash_count; i++) {
+               if (ctx->skips[i])
+                       continue;
+
+               err = copy_from_bpfptr_offset(&map_fd, maps->fd_array,
+                                             ctx->indexes[i] * sizeof(map_fd),
+                                             sizeof(map_fd));
+               if (err < 0)
+                       return LSM_INT_VERDICT_FAULT;
+
+               CLASS(fd, f)(map_fd);
+               if (fd_empty(f))
+                       return LSM_INT_VERDICT_FAULT;
+               if (unlikely(fd_file(f)->f_op != &bpf_map_fops))
+                       return LSM_INT_VERDICT_FAULT;
+
+               map = fd_file(f)->private_data;
+               if (!map->frozen)
+                       return LSM_INT_VERDICT_FAULT;
+
+               map->ops->map_get_hash(map, SHA256_DIGEST_SIZE, hash);
+
+               err = memcmp(hash, &ctx->hashes[i * SHA256_DIGEST_SIZE],
+                             SHA256_DIGEST_SIZE);
+               if (err)
+                       return LSM_INT_VERDICT_UNEXPECTED;
+
+               security->checked[i] = true;
+               memcpy(&security->hashes[i * SHA256_DIGEST_SIZE], hash, SHA256_DIGEST_SIZE);
+               map_security = hornet_bpf_map_security(map);
+               map_security->checked = true;
+               map_security->index = i;
+       }
+       return LSM_INT_VERDICT_OK;
+}
+
+int hornet_next_map(void *context, size_t hdrlen,
+                    unsigned char tag,
+                    const void *value, size_t vlen)
+{
+       struct hornet_parse_context *ctx = (struct hornet_parse_context *)context;
+
+       if (++ctx->hash_count >= MAX_USED_MAPS)
+               return -EINVAL;
+       return 0;
+}
+
+int hornet_map_index(void *context, size_t hdrlen,
+                    unsigned char tag,
+                    const void *value, size_t vlen)
+{
+       struct hornet_parse_context *ctx = (struct hornet_parse_context *)context;
+
+       if (vlen > 1)
+               return -EINVAL;
+
+       ctx->indexes[ctx->hash_count] = *(u8 *)value;
+       return 0;
+}
+
+int hornet_map_hash(void *context, size_t hdrlen,
+                   unsigned char tag,
+                   const void *value, size_t vlen)
+
+{
+       struct hornet_parse_context *ctx = (struct hornet_parse_context *)context;
+
+       if (vlen != SHA256_DIGEST_SIZE && vlen != 0)
+               return -EINVAL;
+
+       if (vlen) {
+               ctx->skips[ctx->hash_count] = false;
+               memcpy(&ctx->hashes[ctx->hash_count * SHA256_DIGEST_SIZE], value, vlen);
+       } else
+               ctx->skips[ctx->hash_count] = true;
+
+       return 0;
+}
+
+static int hornet_check_program(struct bpf_prog *prog, union bpf_attr *attr,
+                               struct bpf_token *token, bool is_kernel,
+                               enum lsm_integrity_verdict *verdict)
+{
+       struct hornet_maps maps = {0};
+       bpfptr_t usig = make_bpfptr(attr->signature, is_kernel);
+       struct pkcs7_message *msg;
+       struct hornet_parse_context *ctx;
+       void *sig;
+       int err;
+       const void *authattrs;
+       size_t authattrs_len;
+       struct key *key;
+
+       if (!attr->signature) {
+               *verdict = LSM_INT_VERDICT_UNSIGNED;
+               return 0;
+       }
+
+       ctx = kzalloc(sizeof(struct hornet_parse_context), GFP_KERNEL);
+       if (!ctx)
+               return -ENOMEM;
+
+       maps.fd_array = make_bpfptr(attr->fd_array, is_kernel);
+       sig = kzalloc(attr->signature_size, GFP_KERNEL);
+       if (!sig) {
+               err = -ENOMEM;
+               goto out;
+       }
+       err = copy_from_bpfptr(sig, usig, attr->signature_size);
+       if (err != 0)
+               goto cleanup_sig;
+
+       msg = pkcs7_parse_message(sig, attr->signature_size);

security/hornet/hornet_lsm.c line 199

Quoted 10 lines

security/hornet/hornet_lsm.c new file +10 -0

+       if (IS_ERR(msg)) {
+               *verdict = LSM_INT_VERDICT_BADSIG;
+               err = 0;
+               goto cleanup_sig;
+       }
+
+       if (system_keyring_id_check(attr->keyring_id) == 0)
+               key = (struct key*)(unsigned long)attr->keyring_id;
+       else
+               key = key_ref_to_ptr(lookup_user_key(attr->keyring_id, 0, KEY_DEFER_PERM_CHECK));

You might need to key_put the user key.

Quoted 106 lines

security/hornet/hornet_lsm.c new file +106 -0

+
+       if (verify_pkcs7_message_sig(prog->insnsi, prog->len * sizeof(struct bpf_insn), msg,
+                                    key,
+                                    VERIFYING_BPF_SIGNATURE,
+                                    NULL, NULL)) {
+               *verdict = LSM_INT_VERDICT_UNKNOWNKEY;
+               err = 0;
+               goto cleanup_msg;
+       }
+
+       if (pkcs7_get_authattr(msg, OID_hornet_data,
+                              &authattrs, &authattrs_len) == -ENODATA) {
+               *verdict = LSM_INT_VERDICT_PARTIALSIG;
+               err = 0;
+               goto cleanup_msg;
+       }
+
+       err = asn1_ber_decoder(&hornet_decoder, ctx, authattrs, authattrs_len);
+       if (err < 0 || authattrs == NULL) {
+               *verdict = LSM_INT_VERDICT_BADSIG;
+               err = 0;
+               goto cleanup_msg;
+       }
+
+       err = hornet_verify_hashes(&maps, ctx, prog);
+       if (err == 0)
+               *verdict = LSM_INT_VERDICT_OK;
+       else
+               *verdict = err;
+
+cleanup_msg:
+       pkcs7_free_message(msg);
+cleanup_sig:
+       kfree(sig);
+out:
+       kfree(ctx);
+       return err;
+}
+
+static const struct lsm_id hornet_lsmid = {
+       .name = "hornet",
+       .id = LSM_ID_HORNET,
+};
+
+static int hornet_bpf_prog_load_integrity(struct bpf_prog *prog, union bpf_attr *attr,
+                                         struct bpf_token *token, bool is_kernel)
+{
+       enum lsm_integrity_verdict verdict;
+       int result = hornet_check_program(prog, attr, token, is_kernel, &verdict);
+
+       if (result < 0)
+               return result;
+
+       return security_bpf_prog_load_post_integrity(prog, attr, token, is_kernel,
+                                                    &hornet_lsmid, verdict);
+}
+
+static int hornet_verify_map(struct bpf_prog *prog, int index)
+{
+       unsigned char hash[SHA256_DIGEST_SIZE];
+       int i;
+       struct bpf_map *map;
+       struct hornet_prog_security_struct *security = hornet_bpf_prog_security(prog);
+       struct hornet_map_security_struct *map_security;
+
+       if (!security->checked[index])
+               return 0;
+
+       for (i = 0; i < prog->aux->used_map_cnt; i++) {
+               map = prog->aux->used_maps[i];
+               map_security = hornet_bpf_map_security(map);
+               if (map_security->index != index)
+                       continue;
+
+               if (!map->frozen)
+                       return -EPERM;
+
+               map->ops->map_get_hash(map, SHA256_DIGEST_SIZE, hash);
+               if (memcmp(hash, &security->hashes[index * SHA256_DIGEST_SIZE],
+                          SHA256_DIGEST_SIZE) != 0)
+                       return -EPERM;
+               else
+                       return 0;
+       }
+       return -EINVAL;
+}
+
+static int hornet_check_prog_maps(u32 ufd)
+{
+       CLASS(fd, f)(ufd);
+       struct bpf_prog *prog;
+       int i, result = 0;
+
+       if (fd_empty(f))
+               return -EBADF;
+       if (fd_file(f)->f_op != &bpf_prog_fops)
+               return -EINVAL;
+
+       prog = fd_file(f)->private_data;
+
+       mutex_lock(&prog->aux->used_maps_mutex);
+       if (!prog->aux->used_map_cnt)
+               goto out;
+
+       for (i = 0; i < prog->aux->used_map_cnt; i++) {
+               result = hornet_verify_map(prog, i);

security/hornet/hornet_lsm.c line 308

Quoted 3 lines

security/hornet/hornet_lsm.c new file +3 -0

+               if (result)
+                       goto out;
+       }

This loop is kind of confusing for me, I guess it's just iterating through the maps the program currently in use. I feel the nested loop is unnecessary and the hash could be saved into the map's blob instead. Please correct me if I'm wrong here.

-Fan

Quoted 41 lines

security/hornet/hornet_lsm.c new file +38 -1

+out:
+       mutex_unlock(&prog->aux->used_maps_mutex);
+       return result;
+}
+
+static int hornet_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
+{
+       /* in horent_bpf(), anything that had originated from kernel space we assume
+          has already been checked, in some form or another, so we don't bother
+          checking the intergity of any maps. In hornet_bpf_prog_load_integrity(),
+          hornet doesn't make any opinion on that and delegates that to the downstream
+          policy enforcement. */
+
+       if (cmd != BPF_PROG_RUN)
+               return 0;
+       if (kernel)
+               return 0;
+
+       return hornet_check_prog_maps(attr->test.prog_fd);
+}
+
+static struct security_hook_list hornet_hooks[] __ro_after_init = {
+       LSM_HOOK_INIT(bpf_prog_load_integrity, hornet_bpf_prog_load_integrity),
+       LSM_HOOK_INIT(bpf, hornet_bpf),
+};
+
+static int __init hornet_init(void)
+{
+       pr_info("Hornet: eBPF signature verification enabled\n");
+       security_add_hooks(hornet_hooks, ARRAY_SIZE(hornet_hooks), &hornet_lsmid);
+       return 0;
+}
+
+DEFINE_LSM(hornet) = {
+       .id = &hornet_lsmid,
+       .blobs = &hornet_blob_sizes,
+       .init = hornet_init,
+};
--

2.53.0

This adds the Hornet Linux Security Module which provides enhanced signature verification and data validation for eBPF programs. This allows users to continue to maintain an invariant that all code running inside of the kernel has actually been signed and verified, by the kernel.

This effort builds upon the currently excepted upstream solution. It further hardens it by providing deterministic, in-kernel checking of map hashes to solidify auditing along with preventing TOCTOU attacks against lskel map hashes.

Target map hashes are passed in via PKCS#7 signed attributes. Hornet determines the extent which the eBFP program is signed and defers to other LSMs for policy decisions.

Signed-off-by Blaise Boscaccy <[email protected]>

Nacked-by Alexei Starovoitov <[email protected]>

---
 Documentation/admin-guide/LSM/Hornet.rst | 321 +++++++++++++++++++++
 Documentation/admin-guide/LSM/index.rst  |   1 +
 MAINTAINERS                              |   9 +
 include/linux/oid_registry.h             |   3 +
 include/uapi/linux/lsm.h                 |   1 +
 security/Kconfig                         |   3 +-
 security/Makefile                        |   1 +
 security/hornet/Kconfig                  |  11 +
 security/hornet/Makefile                 |   7 +

 security/hornet/hornet.asn1              |  13 +
 security/hornet/hornet_lsm.c             | 346 +++++++++++++++++++++++
 11 files changed, 715 insertions(+), 1 deletion(-)
 create mode 100644 Documentation/admin-guide/LSM/Hornet.rst
 create mode 100644 security/hornet/Kconfig
 create mode 100644 security/hornet/Makefile
 create mode 100644 security/hornet/hornet.asn1
 create mode 100644 security/hornet/hornet_lsm.c

Documentation/admin-guide/LSM/Hornet.rst new file +13 -0

new file mode 100644
index 0000000000000..af5e9cd9d83a8
@@ -0,0 +1,321 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+======
+Hornet
+======
+
+Hornet is a Linux Security Module that provides extensible signature
+verification for eBPF programs. This is selectable at build-time with
+``CONFIG_SECURITY_HORNET``.
+
+Overview
+========
+

Documentation/admin-guide/LSM/Hornet.rst new file +12 -0

+existing kernel cryptographic infrastructure. In addition to signing the
+program bytecode, Hornet supports signing SHA-256 hashes of associated
+BPF maps, enabling integrity verification of map contents at load time
+and at runtime.
+
+After verification, Hornet classifies the program into one of the
+following integrity states and passes the result to a downstream LSM hook
+(``bpf_prog_load_post_integrity``), allowing other security modules to
+make policy decisions based on the verification outcome:
+
+``LSM_INT_VERDICT_OK``
+  The program signature and all map hashes verified successfully.

Documentation/admin-guide/LSM/Hornet.rst new file +7 -0

+Known Limitations
+=================
+
+- Hornet requires programs to use :doc:`light skeletons
+  </bpf/libbpf/libbpf_naming_convention>` (lskels) for the signing
+  workflow, as the tooling operates on lskel-generated headers.
+

Documentation/admin-guide/LSM/Hornet.rst new file +2 -0

+- The only hashing algorithm available is SHA256 due to it be hardcoded
+  in the bpf subsystem.

Documentation/admin-guide/LSM/Hornet.rst new file +4 -0

+Signature Verification Flow
+---------------------------
+
+The following describes what happens when a userspace program calls

+4. The PKCS#7 message is parsed and its trust chain is validated via

Documentation/admin-guide/LSM/Hornet.rst new file +4 -0

+   ``validate_pkcs7_trust()``.
+
+5. Hornet extracts the authenticated attribute identified by
+   ``OID_hornet_data`` (OID ``2.25.316487325684022475439036912669789383960``)

This introduces the gen_sig tool. It creates a pkcs#7 signature of a data payload. Additionally it appends a signed attribute containing a set of hashes.

Typical usage is to provide a payload containing the light skeleton ebpf syscall program binary and it's associated maps, which can be extracted from the auto-generated skeleton header.

Signed-off-by Blaise Boscaccy <[email protected]>

---
 scripts/Makefile            |   1 +
 scripts/hornet/Makefile     |   5 +
 scripts/hornet/gen_sig.c    | 392 ++++++++++++++++++++++++++++++++++++
 scripts/hornet/write-sig.sh |  27 +++
 4 files changed, 425 insertions(+)
 create mode 100644 scripts/hornet/Makefile
 create mode 100644 scripts/hornet/gen_sig.c
 create mode 100755 scripts/hornet/write-sig.sh

scripts/Makefile +1 -0

index 0941e5ce7b575..dea8ab91bbe4e 100644
@@ -63,6 +63,7 @@ subdir-$(CONFIG_GENKSYMS) += genksyms
 subdir-$(CONFIG_GENDWARFKSYMS) += gendwarfksyms
 subdir-$(CONFIG_SECURITY_SELINUX) += selinux
 subdir-$(CONFIG_SECURITY_IPE) += ipe
+subdir-$(CONFIG_SECURITY_HORNET) += hornet
 
 # Let clean descend into subdirs
 subdir-        += basic dtc gdb kconfig mod

scripts/hornet/Makefile new file +5 -0

new file mode 100644
index 0000000000000..3ee41e5e9a9ff
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0
+hostprogs-always-y     := gen_sig
+
+HOSTCFLAGS_gen_sig.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null)
+HOSTLDLIBS_gen_sig = $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto)

scripts/hornet/gen_sig.c new file +315 -0

new file mode 100644
index 0000000000000..f966516ebc99b
@@ -0,0 +1,392 @@
+/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ *
+ * Generate a signature for an eBPF program along with appending
+ * map hashes as signed attributes
+ *
+ * Copyright © 2025      Microsoft Corporation.
+ *
+ * Authors: Blaise Boscaccy <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1
+ * of the licence, or (at your option) any later version.
+ */
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <err.h>
+#include <getopt.h>
+
+#include <openssl/cms.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pkcs7.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/objects.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/opensslv.h>
+#include <openssl/bio.h>
+#include <openssl/stack.h>
+
+#if OPENSSL_VERSION_MAJOR >= 3
+# define USE_PKCS11_PROVIDER
+# include <openssl/provider.h>
+# include <openssl/store.h>
+#else
+# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
+#  define USE_PKCS11_ENGINE
+#  include <openssl/engine.h>
+# endif
+#endif
+#include "../ssl-common.h"
+
+#define SHA256_LEN 32
+#define BUF_SIZE   (1 << 15) // 32 KiB
+#define MAX_HASHES 64
+
+struct hash_spec {
+       char *file;
+       int index;
+};
+
+typedef struct {
+       ASN1_INTEGER *index;
+       ASN1_OCTET_STRING *hash;
+
+} HORNET_MAP;
+
+DECLARE_ASN1_FUNCTIONS(HORNET_MAP)
+ASN1_SEQUENCE(HORNET_MAP) = {
+       ASN1_SIMPLE(HORNET_MAP, index, ASN1_INTEGER),
+       ASN1_SIMPLE(HORNET_MAP, hash, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(HORNET_MAP);
+
+IMPLEMENT_ASN1_FUNCTIONS(HORNET_MAP)
+
+DEFINE_STACK_OF(HORNET_MAP)
+
+typedef struct {
+       STACK_OF(HORNET_MAP) * maps;
+} MAP_SET;
+
+DECLARE_ASN1_FUNCTIONS(MAP_SET)
+ASN1_SEQUENCE(MAP_SET) = {
+       ASN1_SET_OF(MAP_SET, maps, HORNET_MAP)
+} ASN1_SEQUENCE_END(MAP_SET);
+
+IMPLEMENT_ASN1_FUNCTIONS(MAP_SET)
+
+#define DIE(...) do { fprintf(stderr, __VA_ARGS__); fputc('\n', stderr); \
+               exit(EXIT_FAILURE); } while (0)
+
+static BIO *bio_open_wr(const char *path)
+{
+       BIO *b = BIO_new_file(path, "wb");
+
+       if (!b) {
+               perror(path);
+               ERR_print_errors_fp(stderr);
+               exit(EXIT_FAILURE);
+       }
+       return b;
+}
+
+static void usage(const char *prog)
+{
+       fprintf(stderr,
+               "Usage:\n"
+               "  %s --data content.bin --cert signer.crt --key signer.key [-pass pass]\n"
+               "     --out newsig.p7b \n"
+               "     --add FILE:index [--add FILE:index ...]\n",
+               prog);
+}
+
+static const char *key_pass;
+
+static int pem_pw_cb(char *buf, int len, int w, void *v)
+{
+       int pwlen;
+
+       if (!key_pass)
+               return -1;
+
+       pwlen = strlen(key_pass);
+       if (pwlen >= len)
+               return -1;
+
+       strcpy(buf, key_pass);
+
+       key_pass = NULL;
+
+       return pwlen;
+}
+
+static EVP_PKEY *read_private_key(const char *private_key_name)
+{
+       EVP_PKEY *private_key;
+       BIO *b;
+
+       b = BIO_new_file(private_key_name, "rb");
+       ERR(!b, "%s", private_key_name);
+       private_key = PEM_read_bio_PrivateKey(b, NULL, pem_pw_cb,
+                                             NULL);
+       ERR(!private_key, "%s", private_key_name);
+       BIO_free(b);
+
+       return private_key;
+}
+
+static X509 *read_x509(const char *x509_name)
+{
+       unsigned char buf[2];
+       X509 *x509;
+       BIO *b;
+       int n;
+
+       b = BIO_new_file(x509_name, "rb");
+       ERR(!b, "%s", x509_name);
+
+       /* Look at the first two bytes of the file to determine the encoding */
+       n = BIO_read(b, buf, 2);
+       if (n != 2) {
+               if (BIO_should_retry(b)) {
+                       fprintf(stderr, "%s: Read wanted retry\n", x509_name);
+                       exit(1);
+               }
+               if (n >= 0) {
+                       fprintf(stderr, "%s: Short read\n", x509_name);
+                       exit(1);
+               }
+               ERR(1, "%s", x509_name);
+       }
+
+       ERR(BIO_reset(b) != 0, "%s", x509_name);
+
+       if (buf[0] == 0x30 && buf[1] >= 0x81 && buf[1] <= 0x84)
+               /* Assume raw DER encoded X.509 */
+               x509 = d2i_X509_bio(b, NULL);
+       else
+               /* Assume PEM encoded X.509 */
+               x509 = PEM_read_bio_X509(b, NULL, NULL, NULL);
+
+       BIO_free(b);
+       ERR(!x509, "%s", x509_name);
+
+       return x509;
+}
+
+static int sha256(const char *path, unsigned char out[SHA256_LEN], unsigned int *out_len)
+{
+       FILE *f;
+       int rc;
+       EVP_MD_CTX *ctx;
+       unsigned char buf[BUF_SIZE];
+       size_t n;
+       unsigned int mdlen = 0;
+
+       if (!path || !out)
+               return -1;
+
+       f = fopen(path, "rb");
+       if (!f) {
+               perror("fopen");
+               return -2;
+       }
+
+       ERR_load_crypto_strings();
+
+       rc = -3;
+       ctx = EVP_MD_CTX_new();
+       if (!ctx) {
+               rc = -4;
+               goto done;
+       }
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+       if (EVP_DigestInit_ex2(ctx, EVP_sha256(), NULL) != 1) {
+               rc = -5;
+               goto done;
+       }
+#else
+       if (EVP_DigestInit_ex(ctx, EVP_sha256(), NULL) != 1) {
+               rc = -5;
+               goto done;
+       }
+#endif
+       while ((n = fread(buf, 1, sizeof(buf), f)) > 0) {
+               if (EVP_DigestUpdate(ctx, buf, n) != 1) {
+                       rc = -6;
+                       goto done;
+               }
+       }
+       if (ferror(f)) {
+               rc = -7;
+               goto done;
+       }
+
+       if (EVP_DigestFinal_ex(ctx, out, &mdlen) != 1) {
+               rc = -8;
+               goto done;
+       }
+       if (mdlen != SHA256_LEN) {
+               rc = -9;
+               goto done;
+       }
+
+       if (out_len)
+               *out_len = mdlen;
+       rc = 0;
+
+done:
+       EVP_MD_CTX_free(ctx);
+       fclose(f);
+       ERR_free_strings();
+       return rc;
+}
+
+static void add_hash(MAP_SET *set, unsigned char *buffer, int buffer_len, int index)
+{
+       HORNET_MAP *map = NULL;
+
+       map = HORNET_MAP_new();
+       ASN1_INTEGER_set(map->index, index);
+       ASN1_OCTET_STRING_set(map->hash, buffer, buffer_len);
+       sk_HORNET_MAP_push(set->maps, map);
+}
+
+int main(int argc, char **argv)
+{
+       const char *cert_path = NULL;
+       const char *key_path = NULL;
+       const char *data_path = NULL;
+       const char *out_path = NULL;
+
+       X509 *signer;
+       EVP_PKEY *pkey;
+       BIO *data_in;
+       CMS_ContentInfo *cms_out;
+       struct hash_spec hashes[MAX_HASHES];
+       int hash_count = 0;
+       int flags;
+       CMS_SignerInfo *si;
+       MAP_SET *set;
+       unsigned char hash_buffer[SHA256_LEN];
+       unsigned int hash_len;
+       ASN1_OBJECT *oid;
+       unsigned char *der = NULL;
+       int der_len;
+       int err;
+       BIO *b_out;
+       int i;
+       char opt;
+
+       const char *short_opts = "C:K:P:O:A:Sh";
+
+       static const struct option long_opts[] = {
+               {"cert", required_argument, 0, 'C'},
+               {"key",  required_argument, 0, 'K'},
+               {"pass",  required_argument, 0, 'P'},
+               {"out",  required_argument, 0, 'O'},
+               {"data",  required_argument, 0, 'D'},
+               {"add",  required_argument, 0, 'A'},
+               {"help",    no_argument,       0, 'h'},
+               {0, 0, 0, 0}
+       };
+
+       while ((opt = getopt_long_only(argc, argv, short_opts, long_opts, NULL)) != -1) {
+               switch (opt) {
+               case 'C':
+                       cert_path = optarg;
+                       break;
+               case 'K':
+                       key_path = optarg;
+                       break;
+               case 'P':
+                       key_pass = optarg;
+                       break;
+               case 'O':

scripts/hornet/gen_sig.c new file +28 -0

+                       } else {
+                               usage(argv[0]);
+                               return EXIT_FAILURE;
+                       }
+               }
+       }
+
+       if (!cert_path || !key_path || !out_path || !data_path) {
+               usage(argv[0]);
+               return EXIT_FAILURE;
+       }
+
+       OpenSSL_add_all_algorithms();
+       ERR_load_crypto_strings();
+
+       signer = read_x509(cert_path);
+       ERR(!signer, "Load cert failed");
+
+       pkey = read_private_key(key_path);
+       ERR(!pkey, "Load key failed");
+
+       data_in = BIO_new_file(data_path, "rb");
+       ERR(!data_in, "Load data failed");
+
+       cms_out = CMS_sign(NULL, NULL, NULL, NULL,
+                          CMS_NOCERTS | CMS_PARTIAL | CMS_BINARY | CMS_DETACHED);
+       ERR(!cms_out, "create cms failed");
+

scripts/hornet/gen_sig.c new file +29 -0

+               add_hash(set, hash_buffer, hash_len, hashes[i].index);
+       }
+
+       oid = OBJ_txt2obj("2.25.316487325684022475439036912669789383960", 1);
+       if (!oid) {
+               ERR_print_errors_fp(stderr);
+               DIE("create oid failed");
+       }
+
+       der_len = ASN1_item_i2d((ASN1_VALUE *)set, &der, ASN1_ITEM_rptr(MAP_SET));
+       CMS_signed_add1_attr_by_OBJ(si, oid, V_ASN1_SEQUENCE, der, der_len);
+
+       err = CMS_final(cms_out, data_in, NULL, CMS_NOCERTS | CMS_BINARY);
+       ERR(!err, "cms final failed");
+
+       OPENSSL_free(der);
+       MAP_SET_free(set);
+
+       b_out = bio_open_wr(out_path);
+       ERR(!b_out, "opening output path failed");
+
+       i2d_CMS_bio_stream(b_out, cms_out, NULL, 0);
+
+       BIO_free(data_in);
+       BIO_free(b_out);
+       EVP_cleanup();
+       ERR_free_strings();
+       return 0;
+}

scripts/hornet/write-sig.sh new file +27 -1

new file mode 100755
index 0000000000000..7eaabe3bab9aa
@@ -0,0 +1,27 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (c) 2025 Microsoft Corporation
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of version 2 of the GNU General Public
+# License as published by the Free Software Foundation.
+
+function usage() {
+    echo "Sample for rewriting an autogenerated eBPF lskel headers"
+    echo "with a new signature"
+    echo ""
+    echo "USAGE: header_file sig"
+    exit
+}
+
+ARGC=$#
+
+EXPECTED_ARGS=2
+
+if [ $ARGC -ne $EXPECTED_ARGS ] ; then
+    usage
+else
+    SIG=$(xxd -p $2 | tr -d '\n' | sed 's/\(..\)/\\\\x\1/g')
+    sed '/const char opts_sig/,/;/c\\tstatic const char opts_sig[] __attribute__((__aligned__(8))) = "\\\n'"$(printf '%s\n' "$SIG")"'\";' $1
+fi
--

2.53.0