Project Description

BPF verifier plays a crucial role in securing the system (though less so now that unprivileged BPF is disabled by default in both upstream and SLES), and bugs in the verifier has lead to privilege escalation vulnerabilities in the past (e.g. CVE-2021-3490).

One way to check whether the verifer has bugs to use model checking (a formal verification technique), in other words, build a abstract model of how the verifier operates, and then see if certain condition can occur (e.g. incorrect calculation during value tracking of registers) by giving both the model and condition to a solver.

For the solver I will be using the Z3 SMT solver to do the checking since it provide a Python binding that's relatively easy to use.

Goal for this Hackweek

Learn how to use the Z3 Python binding (i.e. Z3Py) to build a model of (part of) the BPF verifier, probably the part that's related to value tracking using tristate numbers (aka tnum), and then check that the algorithm work as intended.

Resources

Looking for hackers with the skills:

bpf ebpf formalverification modelchecking kernel security

This project is part of:

Hack Week 21

Activity

  • about 1 month ago: dsterba liked this project.
  • about 2 months ago: mbrugger liked this project.
  • about 2 months ago: jzerebecki left this project.
  • about 2 months ago: jzerebecki added keyword "security" to this project.
  • about 2 months ago: jzerebecki joined this project.
  • about 2 months ago: jzerebecki liked this project.
  • about 2 months ago: ailiopoulos liked this project.
  • about 2 months ago: shunghsiyu started this project.
  • about 2 months ago: shunghsiyu added keyword "kernel" to this project.
  • about 2 months ago: shunghsiyu added keyword "bpf" to this project.
  • about 2 months ago: shunghsiyu added keyword "ebpf" to this project.
  • about 2 months ago: shunghsiyu added keyword "formalverification" to this project.
  • about 2 months ago: shunghsiyu added keyword "modelchecking" to this project.
  • about 2 months ago: shunghsiyu originated this project.

  • Comments

    • shunghsiyu
      about 2 months ago by shunghsiyu | Reply

      I've uploaded the jupyter notebook on GitHub that contains a minimal model of tnum along with tnum_add(), as well as the prove that it works.

    • shunghsiyu
      about 1 month ago by shunghsiyu | Reply

      The slides used for lightning talk can be found here

      While I'd like to achieve much more, I think what I've done during hack week is suffice to be called a complete project, so I'm marking this as complete

    Similar Projects

    mac80211_hwsim tool by cfconrad

    Project Description

    Write a userland tool...


    Create a DRM driver for Matrox desktop cards by tdz

    (was: Create a DRM driver for Matrox G200)

    E...


    early stage kdump support by mbrugger

    [comment]: # (Please use the project descriptio...


    Poking technologies for enrolling customer key to kernel trusted keyring by joeyli

    [comment]: # (Please use the project descriptio...


    generic zswap dedup by ailiopoulos

    [comment]: # (Please use the project descriptio...


    Project Verifree : internal key server(s) by mcaj

    Project description

    The project Verifree...


    Learn more about Application Security (AppSec) Open Source Tools and Testing Techniques by heidi.bronson

    [comment]: # (Please use the project descriptio...


    rust security reviews and cargo-crev by jzerebecki

    [comment]: # (Please use the project descriptio...


    Poking technologies for enrolling customer key to kernel trusted keyring by joeyli

    [comment]: # (Please use the project descriptio...


    Kanidm - Modern Opensource Identity Management by firstyear

    Project Description

    Kanidm is a identity ma...