NAME
veriexec – the veriexec device
SYNOPSIS
#include <dev/veriexec/veriexec_ioctl.h>
DESCRIPTION
The veriexec device is used by veriexec(8) to query and modify the state of mac_veriexec(4).
Once mac_veriexec(4) is active, only a process which is marked as ‘trusted’ (normally only veriexec(8)) is able to more than the VERIEXEC_GETSTATE ioctl.
IOCTLS
The supported ioctls are described below.
- VERIEXEC_SIGNED_LOAD struct verified_exec_params
-
Pass file information to mac_veriexec(4).
struct verified_exec_params { unsigned char flags; char fp_type[VERIEXEC_FPTYPELEN]; /* type of fingerprint */ char file[MAXPATHLEN]; unsigned char fingerprint[MAXFINGERPRINTLEN]; }; - VERIEXEC_LABEL_LOAD struct verified_exec_label_params
-
Pass file information and a label to mac_veriexec(4).
struct verified_exec_label_params { struct verified_exec_params params; char label[MAXLABELLEN]; }; - VERIEXEC_ACTIVE
- VERIEXEC_DEBUG_OFF
- VERIEXEC_DEBUG_ON int level
- VERIEXEC_ENFORCE
- VERIEXEC_GETSTATE
- VERIEXEC_GETVERSION
- VERIEXEC_LOCK
- VERIEXEC_VERIFIED_FILE int fd
-
Rarely needed. Tells mac_veriexec(4) that the file associated with fd is verified.
HISTORY
A veriexec device first appeared in NetBSD. It was added to FreeBSD 13.1.