src/sys/security/mac_veriexec_parser, branch stable/14

sys: Remove $FreeBSD$: one-line .c pattern

2023-08-16T17:54:36+00:00

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

mac_veriexec_parser: fix build after 7e1d3eefd410.

2022-09-09T12:09:08+00:00

Sponsored by:	Klara, Inc.

vfs: NDFREE(&nd, NDF_ONLY_PNBUF) -> NDFREE_PNBUF(&nd)

2022-03-24T10:20:51+00:00

security: clean up empty lines in .c and .h files

2020-09-01T21:26:00+00:00

vfs: drop the mostly unused flags argument from VOP_UNLOCK

2020-01-03T22:29:58+00:00

Filesystems which want to use it in limited capacity can employ the
VOP_UNLOCK_FLAGS macro.

Reviewed by:	kib (previous version)
Differential Revision:	https://reviews.freebsd.org/D21427

Fix mac_veriexec_parser build after r347938

2019-08-08T16:51:49+00:00

In r347938 the definition of mac_veriexec_metadata_add_file
so adjust the argument list accordingly.

Submitted by: Kornel Duleba

Create kernel module to parse Veriexec manifest based on envs

2019-04-03T03:57:37+00:00

The current approach of injecting manifest into mac_veriexec is to
verify the integrity of it in userspace (veriexec (8)) and pass its
entries into kernel using a char device (/dev/veriexec).
This requires verifying root partition integrity in loader,
for example by using memory disk and checking its hash.
Otherwise if rootfs is compromised an attacker could inject their own data.

This patch introduces an option to parse manifest in kernel based on envs.
The loader sets manifest path and digest.
EVENTHANDLER is used to launch the module right after the rootfs is mounted.
It has to be done this way, since one might want to verify integrity of the init file.
This means that manifest is required to be present on the root partition.
Note that the envs have to be set right before boot to make sure that no one can spoof them.

Submitted by: Kornel Duleba 
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D19281