Bpf_get_fsverity_digest: Pinning binaries from a BPF LSM hook

The elephant in the room is that we blindly trust the binary that is allowed to read our private keys and perform critical actions. The trust boundary should be at the bottom of the stack, at the kernel, and we need to verify that binaries (such as sshd) that have access to our private keys haven’t …

View Post on Scour ↗

More from bomfather.dev on Scour.

Discussed on Hacker News