freebsd-dev/sbin
Sebastien Bini f3dba162bd init: allow to start script executions with sh -o verify
On systems where mac_veriexec is enforced, init should run its scripts in verified mode.
This relies on the verify shell option introduced by D30464. init will detect if the shell
is /bin/sh, and in which case, add the verify option to the argument vector.
The verify option propagates to all files sourced by the shell, ensuring a better
protection than if the script was tested against an open(O_VERIFY) before running it.
This security can be bypassed with the kenv which overloads the shell to use.
However we feel confident that on systems running with mac_veriexec, this kenv will be blocked somehow.
Also, the verify option has no effect on systems where mac_veriexec is not loaded nor enforced.

Differential revision:  https://reviews.freebsd.org/D34622
Reviewed by:		sjg, wma
2022-10-11 09:48:04 +02:00
..
adjkerntz adjkerntz(8): revert "detect extra jailed invokation to keep logs clean" 2022-06-23 21:46:08 +07:00
bectl bectl: push space-in-name check down into libbe 2022-04-02 21:04:31 -05:00
bsdlabel *: Do not use the no-op -r flag for bsdlabel(8) 2022-03-17 17:28:07 +01:00
camcontrol camcontrol(8): Fix typo in a source code comment 2022-03-28 19:36:01 +02:00
ccdconfig *: Do not use the no-op -r flag for bsdlabel(8) 2022-03-17 17:28:07 +01:00
clri
comcontrol
conscontrol
ddb mac: add new mac_ddb(4) policy 2022-07-18 22:06:15 +00:00
decryptcore Indicate that kgdb.1 is from ports/devel/gdb. 2022-08-14 15:17:29 +02:00
devd Track removal of Tokenring and FDDI media types from devd.cc. 2022-09-23 10:32:49 +02:00
devfs devfs.rules: Do not expose "log" in the default devfs rules. 2022-05-24 09:54:38 -04:00
devmatch devmatch: Properly ignore commented fields 2022-06-27 14:44:23 -06:00
dhclient dhclient-script: cope with /32 address leases 2022-10-05 12:24:31 +02:00
dmesg dmesg: Better wording from review 2022-05-07 09:55:40 -06:00
dump Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. 2022-07-30 22:51:38 -07:00
dumpfs Move the ability to search for alternate UFS superblocks from fsck_ffs(8) 2022-08-13 12:43:40 -07:00
dumpon Indicate which port gdb.1 and kgdb.1 come from. 2022-08-17 19:13:22 +02:00
etherswitchcfg etherswitch: Add a new striptagingress port flag 2021-08-03 12:07:48 +02:00
fdisk
ffsinfo Move the ability to search for alternate UFS superblocks from fsck_ffs(8) 2022-08-13 12:43:40 -07:00
fsck fsck(8): Fix typo 2022-01-12 13:52:23 +08:00
fsck_ffs Fix for f4fc389. 2022-09-06 16:22:03 -07:00
fsck_msdosfs fsck_msdosfs: truncate directory entry when the head pointer is invalid. 2021-11-03 22:09:32 -07:00
fsdb Move the ability to search for alternate UFS superblocks from fsck_ffs(8) 2022-08-13 12:43:40 -07:00
fsirand Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. 2022-07-30 22:51:38 -07:00
gbde
geom Fix for 90e2971 that caused some geli commands to return the wrong exit status. 2022-07-29 11:11:46 -07:00
ggate ggatec: Use ANSI C definition for init_initial_buffer_size. 2022-01-31 17:12:04 -08:00
growfs Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. 2022-07-30 22:51:38 -07:00
gvinum Fix wrong capitalization in man page references. 2022-08-13 20:46:59 +02:00
hastctl
hastd Remove PAGE_SIZE from hastd 2022-06-17 10:36:17 +01:00
ifconfig ifconfig: print interface name on SIOCIFCREATE2 error 2022-09-06 13:09:39 +00:00
init init: allow to start script executions with sh -o verify 2022-10-11 09:48:04 +02:00
ipf ipfilter: Removed unused ioctl typedef 2022-10-08 17:28:04 -07:00
ipfw ipfw: make it possible to specify MTU for "unreach needfrag" action 2022-08-17 08:24:11 -07:00
kldconfig kldconfig(8): Add EXAMPLES to the man page 2020-09-29 17:52:15 +00:00
kldload kldload: Bring functionality in line with manual page 2022-06-17 16:53:28 +02:00
kldstat kldstat(8): style(9) fixes. 2021-12-07 11:40:22 +01:00
kldunload
ldconfig ldconfig: remove two symbols 2022-01-08 12:45:46 +02:00
md5 sbin/md5.c: fix -q -c for BSD style versions 2022-07-26 23:04:57 +02:00
mdconfig md: Add MD_MUSTDEALLOC support 2021-09-11 20:04:52 +08:00
mdmfs mdmfs(8): Fix an issue reported by mandoc 2020-10-03 18:47:50 +00:00
mknod
mksnap_ffs Remove #define _KERNEL hacks from libprocstat 2021-02-21 11:38:21 +02:00
mount Delete xref to suidperl(1) which has long since been removed in perl5.12. 2022-08-14 15:43:27 +02:00
mount_cd9660
mount_fusefs In man page cross refs to sudo, indicate it comes from ports/security/sudo. 2022-08-14 11:44:43 +02:00
mount_msdosfs Fix a few mandoc issues 2020-10-09 14:03:45 +00:00
mount_nfs mount_nfs.8: Fix the RFC number now that it exists 2022-09-24 15:05:21 -07:00
mount_nullfs Improve description of the nocache option. 2022-05-06 13:03:30 +02:00
mount_udf
mount_unionfs
natd natd: use PF_DIVERT/SOCK_RAW instead of PF_INET/SOCK_RAW/IPPROTO_DIVERT 2022-08-30 16:24:37 -07:00
newfs The fdformat man page is in section 8 (not 1). 2022-08-14 18:14:52 +02:00
newfs_msdos newfs_msdos: Fix warnings that arise when compiled for makefs 2022-05-10 17:26:50 -04:00
nfsiod pkgbase: Add nfsiod to the FreeBSD-nfs package 2021-08-06 14:37:35 +02:00
nos-tun
nvmecontrol nvmecontrol: use uintmax_t for a size 2022-10-07 21:44:23 -06:00
pfctl pf: use time_to for timestamps 2022-10-05 17:52:27 +02:00
pfilctl pfilctl: improve formatting of "hooks" and "heads" command output. 2021-03-19 11:18:05 -07:00
pflogd
ping ping(8): Correct a typo in source code comment 2022-09-04 13:26:34 +02:00
ping6 Merge ping6 to ping 2020-11-26 04:29:30 +00:00
quotacheck Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. 2022-07-30 22:51:38 -07:00
rcorder [rcorder] [crunch] Fix C function declarations to include void 2020-09-21 17:59:45 +00:00
reboot Cross-reference nextboot(8) and freebsd-update(8) 2022-03-29 15:15:35 +02:00
recoverdisk Register the bad read before bailing on terminal errors. 2021-02-02 12:01:38 +00:00
resolvconf
restore
route route: remove write-only struct hostent from getaddr() 2022-01-06 10:45:44 -05:00
routed Bump .Dd for recently modified manual pages 2022-06-27 18:20:03 +02:00
rtsol
savecore savecore: add an option to save a live minidump 2022-04-18 12:56:16 -03:00
sconfig pkgbase: Put sconfig in FreeBSD-utilities 2021-12-21 10:16:08 +01:00
setkey setkey.8: Improve direction descriptions 2022-09-13 13:16:48 +02:00
shutdown boottrace: annotate init and shutdown utilities 2022-02-21 20:16:07 -04:00
swapon swapon(8): adapt to the new swapoff(2) interface 2021-12-09 02:48:59 +02:00
sysctl sysctl.8: Reference sysctl(9) 2022-06-30 16:22:01 +02:00
tests
tunefs Update date in tunefs(8) manual page. 2022-08-16 16:46:59 -07:00
umount umount(8): Remove a double word in a source code comment 2022-04-09 10:13:45 +02:00
veriexec Add -S option to veriexec 2022-07-19 08:59:53 -07:00
zfsbootcfg loader: zfs should support bootonce an nextboot 2020-09-21 09:01:10 +00:00
Makefile sbin: build ping if at least one of INET & INET6 is enabled 2021-11-28 13:05:39 -05:00
Makefile.amd64 Revert "amd64: Do not build sconfig" 2021-12-21 10:14:45 +01:00
Makefile.arm
Makefile.i386
Makefile.inc build: provide a default WARNS for all in-tree builds 2020-09-18 17:17:46 +00:00
Makefile.powerpc64