stevek
ccddba56e4
MAC/veriexec implements a verified execution environment using the MAC
...
framework.
The code is organized into a few distinct pieces:
* The meta-data store (in veriexec_metadata.c) which maps a file system
identifier, file identifier, and generation key tuple to veriexec
meta-data record.
* Fingerprint management (in veriexec_fingerprint.c) which deals with
calculating the cryptographic hash for a file and verifying it. It also
manages the loadable fingerprint modules.
* MAC policy implementation (in mac_veriexec.c) which implements the
following MAC methods:
mpo_init
Initializes the veriexec state, meta-data store, fingerprint modules,
and registers mount and unmount EVENTHANDLERs
mpo_syscall
Implements the following per-policy system calls:
MAC_VERIEXEC_CHECK_FD_SYSCALL
Check a file descriptor to see if the referenced file has a valid
fingerprint.
MAC_VERIEXEC_CHECK_PATH_SYSCALL
Check a path to see if the referenced file has a valid fingerprint.
mpo_kld_check_load
Check if loading a kld is allowed. This checks if the referenced vnode
has a valid fingerprint.
mpo_mount_destroy_label
Clears the veriexec slot data in a mount point label.
mpo_mount_init_label
Initializes the veriexec slot data in a mount point label.
The file system identifier is saved in the veriexec slot data.
mpo_priv_check
Check if a process is allowed to write to /dev/kmem and /dev/mem
devices.
If a process is flagged as trusted, it is allowed to write.
mpo_proc_check_debug
Check if a process is allowed to be debugged. If a process is not
flagged with VERIEXEC_NOTRACE, then debugging is allowed.
mpo_vnode_check_exec
Check is an exectuable is allowed to run. If veriexec is not enforcing
or the executable has a valid fingerprint, then it is allowed to run.
NOTE: veriexec will complain about mismatched fingerprints if it is
active, regardless of the state of the enforcement.
mpo_vnode_check_open
Check is a file is allowed to be opened. If verification was not
requested, veriexec is not enforcing, or the file has a valid
fingerprint, then veriexec will allow the file to be opened.
mpo_vnode_copy_label
Copies the veriexec slot data from one label to another.
mpo_vnode_destroy_label
Clears the veriexec slot data in a vnode label.
mpo_vnode_init_label
Initializes the veriexec slot data in a vnode label.
The fingerprint status for the file is stored in the veriexec slot data.
* Some sysctls, under security.mac.veriexec, for setting debug level,
fetching the current state in a human-readable form, and dumping the
fingerprint database are implemented.
* The MAC policy implementation source file also contains some utility
functions.
* A set of fingerprint modules for the following cryptographic hash
algorithms:
RIPEMD-160, SHA1, SHA2-256, SHA2-384, SHA2-512
* Loadable module builds for MAC/veriexec and fingerprint modules.
WARNING: Using veriexec with NFS (or other network-based) file systems is
not recommended as one cannot guarantee the integrity of the files
served, nor the uniqueness of file system identifiers which are
used as key in the meta-data store.
Reviewed by: ian, jtl
Obtained from: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D8554
2018-06-20 00:41:30 +00:00
..
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-03-23 15:35:19 +00:00
2017-03-04 10:10:17 +00:00
2017-09-26 23:12:32 +00:00
2017-03-04 10:10:17 +00:00
2017-07-09 22:53:24 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-11-29 23:41:49 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-05-17 10:25:01 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-09-05 15:13:41 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-08-19 17:15:40 +00:00
2018-05-24 17:06:00 +00:00
2017-03-04 10:10:17 +00:00
2017-05-25 04:18:46 +00:00
2017-03-04 10:10:17 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-05-25 04:18:46 +00:00
2017-03-04 10:10:17 +00:00
2017-05-25 04:18:46 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-01-22 08:33:59 +00:00
2018-01-21 21:27:41 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-01-12 12:14:14 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-05-19 00:04:01 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-02-12 22:21:11 +00:00
2018-05-19 04:46:34 +00:00
2017-03-04 10:10:17 +00:00
2018-04-07 19:29:19 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-01-18 22:01:30 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-30 04:56:27 +00:00
2017-03-04 10:10:17 +00:00
2018-02-22 19:12:32 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-11-24 14:02:32 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-05-19 00:04:01 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-30 04:56:27 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-09-13 17:49:23 +00:00
2018-05-31 21:31:08 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-11 03:01:18 +00:00
2018-05-19 04:46:34 +00:00
2018-05-03 19:45:48 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-11-21 17:23:16 +00:00
2017-10-10 19:14:40 +00:00
2017-05-22 14:46:13 +00:00
2017-12-30 11:42:49 +00:00
2017-03-04 10:10:17 +00:00
2018-05-10 17:55:24 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-06-20 14:28:51 +00:00
2017-04-07 16:14:25 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-06-13 14:07:13 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-01-26 06:21:24 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-01-07 20:28:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-05-31 22:41:07 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2018-04-01 18:22:24 +00:00
2017-06-15 12:47:48 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-03-16 02:46:08 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-05-19 00:04:01 +00:00
2018-02-07 18:59:54 +00:00
2017-03-04 10:10:17 +00:00
2018-05-09 11:59:24 +00:00
2017-03-04 10:10:17 +00:00
2017-04-03 03:07:48 +00:00
2017-03-04 10:10:17 +00:00
2017-06-15 12:47:48 +00:00
2017-03-04 10:10:17 +00:00
2017-05-18 06:13:29 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-03-17 17:18:46 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-06-04 21:05:58 +00:00
2018-03-28 07:59:16 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-12-20 18:15:06 +00:00
2018-06-18 20:12:54 +00:00
2018-06-18 20:12:54 +00:00
2017-12-20 18:15:06 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-24 12:50:21 +00:00
2018-06-12 13:32:42 +00:00
2018-04-06 17:35:35 +00:00
2017-06-26 21:14:33 +00:00
2017-09-12 23:36:58 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-06-20 00:41:30 +00:00
2018-06-20 00:41:30 +00:00
2018-06-20 00:41:30 +00:00
2018-06-20 00:41:30 +00:00
2018-06-20 00:41:30 +00:00
2018-06-20 00:41:30 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-11-21 09:08:27 +00:00
2017-03-04 10:10:17 +00:00
2017-11-13 10:49:18 +00:00
2018-05-29 14:04:57 +00:00
2018-05-29 14:04:57 +00:00
2018-05-29 14:04:57 +00:00
2017-03-04 10:10:17 +00:00
2017-03-16 22:23:04 +00:00
2017-07-09 17:02:47 +00:00
2017-05-08 20:58:32 +00:00
2018-04-06 17:35:35 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-06-09 12:06:22 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-02-13 17:04:34 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-03-17 17:18:37 +00:00
2018-04-12 07:20:50 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-08-30 21:16:32 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-11-14 05:05:21 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-30 07:24:31 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-17 16:46:08 +00:00
2017-08-11 17:43:25 +00:00
2017-03-04 10:10:17 +00:00
2017-08-21 20:27:45 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-06-15 12:47:48 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-06-14 06:40:59 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-06-09 07:08:58 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-07-10 03:38:07 +00:00
2018-01-12 12:14:14 +00:00
2018-01-12 12:14:14 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-08-16 10:38:06 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-28 17:43:51 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-01 18:22:24 +00:00
2018-04-07 19:09:57 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2018-06-07 20:57:12 +00:00
2017-05-09 05:22:51 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-06-12 13:26:31 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-05-25 17:29:29 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2018-04-06 17:35:35 +00:00
2017-12-05 17:23:33 +00:00
2018-04-08 01:32:56 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-03-04 10:10:17 +00:00
2017-10-01 16:11:07 +00:00
2017-03-04 10:10:17 +00:00
2018-06-20 00:41:30 +00:00
2017-01-28 02:22:15 +00:00