Merge branch 'bpf-keyring-and-signed-loader-ml-dsa-support'
Daniel Borkmann says:
====================
BPF keyring and signed loader ML-DSA support
Add a dedicated BPF keyring which is integrated for BPF signing. It
is modelled after the dm-verity keyring which was added in commit
033724b ("dm-verity: add dm-verity keyring") and which can eventually
be used also via systemd through the same enrollment method as in
dm-verity's case. It is selected with a new well-known keyring_id
VERIFY_USE_BPF_KEYRING and gives an operator a place to enroll a
BPF-only signing key at boot, specifically scoped to signed BPF
program loading. Next, to demonstrate that BPF signing is algorithm
agnostic, we add a few small tooling changes to support ML-DSA and
integrate everything into BPF selftest for BPF CI to ensure nothing
breaks with future changes. For more details, see individual commits.
v3 -> v4:
- Refactor the keyring dispatch a bit better wrt if/else chaining (BPF CI)
- Improve selftest for bpf keyring in signed loader wrt skips (BPF CI)
- selftests/bpf/config sorting (BPF CI)
- Misc documentation improvement (BPF CI)
v2 -> v3:
- Added KEY_SPEC_BPF_KEYRING rather than VERIFY_USE_BPF_KEYRING
then it can also be looked up via lookup_user_key (Christian Brauner)
- Added CMS_NO_SIGNING_TIME to bpftool patch (Sashiko)
v1 -> v2:
- Mainly addressing LLM feedback in docs, commit message and
selftests (BPF CI, sashiko)
- Fix reasoning on BPF_PROG_MAX_SIGNATURE_SIZE
- Add reasoning about bpftool MAX_SIG_SIZE change and pinning
the CMS digest to SHA-512
- Fix misc signing.rst phrasing
- Fix a potential NULL deref in bpf_keyring_lookup selftest code
- Add CONFIG_CRYPTO_SHA512=y to BPF selftest config
- Clean up key material on ML-DSA signed loader test failure
- Refactor duplicated bpf_attr setup for bpf keyring tests
- Fix wording in kernel-parameters.txt
====================
Link: https://patch.msgid.link/20260828175227.1537793-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
