freebsd-nq/tools
Marcin Wojtas b0fefb25c5 Create kernel module to parse Veriexec manifest based on envs
The current approach of injecting manifest into mac_veriexec is to
verify the integrity of it in userspace (veriexec (8)) and pass its
entries into kernel using a char device (/dev/veriexec).
This requires verifying root partition integrity in loader,
for example by using memory disk and checking its hash.
Otherwise if rootfs is compromised an attacker could inject their own data.

This patch introduces an option to parse manifest in kernel based on envs.
The loader sets manifest path and digest.
EVENTHANDLER is used to launch the module right after the rootfs is mounted.
It has to be done this way, since one might want to verify integrity of the init file.
This means that manifest is required to be present on the root partition.
Note that the envs have to be set right before boot to make sure that no one can spoof them.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D19281
2019-04-03 03:57:37 +00:00
..
boot Rework UEFI ESP generation 2018-12-20 19:39:37 +00:00
bsdbox Fix bsdbox build WITH_OFED 2018-08-27 19:34:50 +00:00
build Create kernel module to parse Veriexec manifest based on envs 2019-04-03 03:57:37 +00:00
bus_space
debugscripts
diag In preparation for adding inode check-hashes, clean up and 2018-11-13 21:40:56 +00:00
ifnet
kerneldoc remove the removed-from-source drm/drm2 parts 2019-03-05 15:23:28 +00:00
LibraryReport
regression Make timespecadd(3) and friends public 2018-07-30 15:46:40 +00:00
sched Add a dtrace script for collecting schedgraph data 2016-11-18 02:29:09 +00:00
test Remove apparently unused 0-byte files that cause grief on Windows 2018-11-03 01:53:26 +00:00
tools ioatcontrol(8) could exercise 8k-aligned copy with page-break, crc and 2019-04-02 19:06:25 +00:00
install.sh Fix handling -U. It does not take any arguments. 2017-11-27 02:28:40 +00:00
make_libdeps.sh Improve the library dependencies helper script in src/tools. 2017-11-16 15:26:39 +00:00
README
tinder.sh

$FreeBSD$

This directory tree contains tools used for the maintenance and
testing of FreeBSD.  There is no toplevel Makefile structure since
these tools are not meant to be built as part of the standard system,
though there may be individual Makefiles in some of the subdirs.

Please read the README files in the subdirs for further information.