52 		attr.signature = ptr_to_u64(sig);  in load_loader()
99 		attr.signature = ptr_to_u64(sig);  in run_gen_loader()
318 		 * A present-but-invalid signature (the cert bytes are not a  in signature_enforced()
319 		 * PKCS#7 signature) must be rejected at load: the signature  in signature_enforced()
324 		 * would trip even if the signature were silently ignored.  in signature_enforced()
328 		ASSERT_EQ(fd, -EBADMSG, "invalid signature rejected at load");  in signature_enforced()
344 		 * (their contents are folded into the signature). Binding a  in signed_nonexcl_fd_array_rejected()
345 		 * non-exclusive map is rejected, before the signature is even  in signed_nonexcl_fd_array_rejected()
414 		 * signature. An exclusive map of any other type is rejected  in signed_nonarray_fd_array_rejected()
470 	 * folded into the signature. Build an otherwise genuinely signed load -  in signed_btf_fd_array_rejected()
474 	 * __add_used_btf(), before the signature is even verified).  in signed_btf_fd_array_rejected()
505 	attr.signature = ptr_to_u64(sig);  in signed_btf_fd_array_rejected()
537 		 * Signature verification now runs inside bpf_check(), so a  in signature_failure_logs()
539 		 * invalid signature is rejected and the log says why.  in signature_failure_logs()
547 		attr.signature = ptr_to_u64(junk);  in signature_failure_logs()
557 		ASSERT_LT(fd, 0, "invalid signature rejected at load");  in signature_failure_logs()
560 		ASSERT_HAS_SUBSTR(log_buf, "signature verification failed",  in signature_failure_logs()
561 				  "verifier logs signature failure");  in signature_failure_logs()
579 		ASSERT_EQ(fd, -EINVAL, "oversized signature rejected");  in signature_too_large()
594 		 * A present signature with signature_size == 0 is rejected  in signature_zero_size()
595 		 * up front, before the keyring is resolved or the signature  in signature_zero_size()
600 		ASSERT_EQ(fd, -EINVAL, "zero-size signature rejected");  in signature_zero_size()
615 		 * A present signature with a keyring_id that resolves to no key is  in signature_bad_keyring()
617 		 * lookup (-EINVAL) before it ever looks at the signature bytes. A  in signature_bad_keyring()
622 		ASSERT_EQ(fd, -EINVAL, "signature with bad keyring_id rejected");  in signature_bad_keyring()
808  * The load-time signature must authenticate the loader instructions: a valid
809  * signature loads, and the very same signature over one-byte-tampered insns is
812  * to. (signature_enforced/_too_large only cover a malformed signature.)
882 	ASSERT_TRUE(ran, "valid signature: loader loaded and ran");  in signature_authenticates_insns()
883 	ASSERT_EQ(r, 0, "valid signature accepted");  in signature_authenticates_insns()
891 	 * and the signature - verified after the maps are resolved - is what  in signature_authenticates_insns()
893 	 * re-binding the exclusive map to their tampered loader, the signature  in signature_authenticates_insns()
903 	ASSERT_EQ(r, -EKEYREJECTED, "signature is bound to the instructions");  in signature_authenticates_insns()
980 	ASSERT_TRUE(ran, "valid signature: loader loaded and ran");  in signature_authenticates_metadata()
981 	ASSERT_EQ(r, 0, "valid signature accepted");  in signature_authenticates_metadata()
988 	 * load reaches signature verification, which folds the live frozen  in signature_authenticates_metadata()
999 	ASSERT_EQ(r, -EKEYREJECTED, "signature is bound to the metadata");  in signature_authenticates_metadata()
1296 		  "admission saw a valid signature");  in lsm_signature_verdict()
1343  * into the signature (insns || metadata) and checks it at BPF_PROG_LOAD via
1398 	attr.signature = ptr_to_u64(sig);  in loadtime_drive()
1530  * verifies the signature, folds no metadata, and the program loads. Exercise
1531  * the fd_array == NULL / fd_array_cnt == 0 path, and confirm the signature
1567 	attr.signature = ptr_to_u64(sig);  in signed_no_fd_array()
1582 	/* The signature covers the instructions, so tampering must be rejected. */  in signed_no_fd_array()
1638 	attr.signature = ptr_to_u64(sig);  in signed_map_by_fd_rejected()
1660  * the signature never covered; the verifier rejects it up front with -EACCES.
1702 	attr.signature = ptr_to_u64(sig);  in signed_sparse_fd_array_rejected()
1762 	attr.signature = ptr_to_u64(sig);  in signed_module_kfunc_rejected()