---
name: "veriexec"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/veriexec"
---

# veriexec(4)

the veriexec device

## NAME

**veriexec** – the veriexec device

## SYNOPSIS

**#include \<dev/veriexec/veriexec\_ioctl.h\>**

## DESCRIPTION

The **veriexec** device is used by veriexec(8) to query and modify the state of mac\_veriexec(4).

Once mac\_veriexec(4) is active, only a process which is marked as ‘trusted’ (normally only veriexec(8)) is able to more than the VERIEXEC\_GETSTATE ioctl.

## IOCTLS

The supported ioctls are described below.

- VERIEXEC\_SIGNED\_LOAD *struct* *verified\_exec\_params*

  Pass file information to mac\_veriexec(4).

  ```
  struct verified_exec_params  {
  	unsigned char flags;
  	char fp_type[VERIEXEC_FPTYPELEN];	/* type of fingerprint */
  	char file[MAXPATHLEN];
  	unsigned char fingerprint[MAXFINGERPRINTLEN];
  };
  ```

- VERIEXEC\_LABEL\_LOAD *struct* *verified\_exec\_label\_params*

  Pass file information and a label to mac\_veriexec(4).

  ```
  struct verified_exec_label_params  {
  	struct verified_exec_params params;
  	char label[MAXLABELLEN];
  };
  ```

- VERIEXEC\_ACTIVE

  - VERIEXEC\_DEBUG\_OFF

  - VERIEXEC\_DEBUG\_ON *int* *level*

  - VERIEXEC\_ENFORCE

  - VERIEXEC\_GETSTATE

  - VERIEXEC\_GETVERSION

  - VERIEXEC\_LOCK

  - VERIEXEC\_VERIFIED\_FILE *int* *fd*

  Rarely needed. Tells mac\_veriexec(4) that the file associated with *fd* is verified.

## HISTORY

A **veriexec** device first appeared in NetBSD. It was added to FreeBSD 13.1.