Adjust this to not need -Wno-pointer-sign.

Add HAVE_PCC tests for -Wno-pointer-sign.

branches: 1.12.18; 1.12.22;
Make Veriexec use proplib(3) for kernel-userland data passing.

Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.

This also removes the fingerprint type name limit, so relevant code
was adjusted.

Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.

sprinkle some -fno-strict-aliasing and -Wno-pointer-sign with GCC4.

Move WARNS=3 to the Makefile.inc, and add a little const to the remaining
programs that did not compile before.

Need -I. here as well so OBJDIR's work correctly in all cases

Remove veriexec(4) man page.

Minor cleanups, KNF, error handling consistency.

Make this compile again after the latest overhaul.
Use -I${.CURDIR} instead of -I. to support placement of objects elsewhere.
Make sure arguments to ctype functions are unsigned char by changing the
type of one function argument.
Fix "local declaration shadows global" warnings by renaming variables.
Fix printing of size_t variable to use %zu format instead of %u.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

branches: 1.4.2;
WARNS=2 is the default defined in sbin/Makefile.inc. (thanks wiz)

Kill __P(); WARNS=2

don't compile this -static, depend on MKDYNAMICROOT check in ../Makefile.inc
for that

Renamed verified exec fingerprint loader.

branches: 1.3.2;
Move veriexec(4) man page to correct place.

Grammar, wording, and punctuation improvements. Sort SEE ALSO. Remove some superfluous .Pp.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

Remove workaround for ancient HTML generation code.

Merge riastradh-drm2 to HEAD.

Use Mt for email addresses.

branches: 1.37.4; 1.37.10; 1.37.14;
Mark up file as argument.

security(7), not (8).

Document -v. PR 39441 from Stathis Kamperis. Bump date.

branches: 1.34.4; 1.34.8;
Following input from Matthew Mondor, some Veriexec documentation changes:

- Document the signatures file format in a veriexec(5) man-page,
- Document the strict levels and a general Veriexec intro in veriexec(8)
instead of security(8).

Okay blymn@.

Allow no signatures file to be specified for the "load" command, and use
the default one in such cases.

Update command usage and documentation to reflect the above.

Xref security(8) from veriexec(4), veriexec(9), veriexecctl(8), and
veriexecgen(8).

Suggested by Matthew Mondor.

Whitespace and HTML output fixes.

branches: 1.30.4; 1.30.6;
Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

branches: 1.29.2; 1.29.4; 1.29.6;
Support escaping characters in the path so that spaces etc. are allowed
in entries for Veriexec.

This has been requested for a long time, most recently by Brad Harder.

Thanks a lot to Michael van Elst for the patch, done during the latest
hackathon.

If Veriexec enforces access type, don't allow mmap() to use PROT_EXEC on
files that don't have the "indirect" flag. Also change the "library" alias
in veriexecctl(8) to mean "file, indirect".

okay blymn@

.Sh -> .Ss

mmm mdoclint. :)

Reference veriexecgen(8) instead of the old scripts. Bump date.

Scripts don't have to be *shell* scripts.

no VERIFIED_EXEC anymore, just a pseudo-device.

misc cleanup: remove #if 0 code, unused var, and make pretty.

Grammar improvement.

Add and document a "query" keyword to veriexecctl. Usage:

/sbin/veriexecctl query /path/to/file

will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.

Add and document a VERIEXEC_DELETE operation for Veriexec.

We can now delete an entry from the tables using

veriexecctl delete /path/to/file

or remove an entire table using

veriexecctl delete /mount_point

(any directory will work for the mount point it's on)

Make sentence more readable.

Introduce per-page fingerprints in Veriexec.

This closes a hole pointed out by Thor Lancelot Simon on tech-kern ~3
years ago.

The problem was with running binaries from remote storage, where our
kernel (and Veriexec) has no control over any changes to files.

An attacker could, after the fingerprint has been verified and
program loaded to memory, inject malicious code into the backing
store on the remote storage, followed by a forced flush, causing
a page-in of the malicious data from backing store, bypassing
integrity checks.

Initial implementation by Brett Lymn.

Bump date for previous; use more markup.

Add and document some convenience aliases for commonly required option
combinations.

Sync with reality.

- Verified Exec -> Veriexec
- pseudo-device is `veriexec'
- veriexec.conf -> signatures, and mention /etc/signatures as the default
location
- We use veriexec's strict level, not the system securelevel
- Mention the `direct' option
- Mention that the signatures file can have multiple options in a single
entry, comma-separated
- Mention that both `direct' and `indirect' access modes are implied
if no access modes are explicitly mention in the options
- Bump date

Bump date for previous.

Remove bits about deprecated 'fingerprints' command.

Remove common code for returning supported fingerprints. This is done now
via sysctl(8) using kern.veriexec.algorithms.

Also add an entry for the 'algorithms' variable in sysctl.8 forgotten in
the last commit.

Add bugs sub-heading to warn about whitespace in filenames.

Add Xr to veriexec.4.

Mention command names in SYNOPSIS; add gen_rmd160 to SEE ALSO;
improve formatting; bump date.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

branches: 1.7.2;
Remove unnecessary dot, and bump date for new SEE ALSO section.

Add SEE ALSO section pointing at the scripts to create signatures

XXX they should be installed as veriexec_gen_* IMHO,
XXX not dwell in /usr/share/examples

Bump date for previous.

Fix error in description of signature file syntax (thanks to Chrisian
Biere)
Fix wording to match changed syntax line
Add some clarifications to the wording
Improve vertical spacing of some sections.

The next release will be 2.0, not 1.7.

Remove traces of old names (verifiedexec_load and /dev/verifiedexec).

Renamed verified exec fingerprint loader.

need <sys/stat.h> ... for stat()

branches: 1.39.2;
fix error messages containing \n

Be a bit more verbose if the kernel rejects a file

branches: 1.37.2;
Fix snprintf usage and, while here, don't trundle off the end of an
array. Part of PR 47976 from Henning Petersen.

branches: 1.36.2;
Fix error message; argv[1] could be NULL

branches: 1.35.2; 1.35.8;
Use __dead

fix sign-compare issues

branches: 1.33.4;
Remove trailing whitespace. Noted in PR 39440 by Stathis Kamperis.

Don't dump core if given no arguments. Fixes PR 39440 from Stathis Kamperis
(but with a different patch).

branches: 1.31.4; 1.31.8;
Allow no signatures file to be specified for the "load" command, and use
the default one in such cases.

Update command usage and documentation to reflect the above.

branches: 1.30.2;
CID 4498: print_entry() returning without freeing 'fp'.

Ok by rmind@.

branches: 1.29.2;
Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.

From Tom Spindler (dogcow@).

Add missing #include <sys/ioctl.h> to make this build without warnings.

Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

Type changed from size_t to uint64_t, adjust format string.
Pointed out by Tom Spindler, thanks!

Make Veriexec use proplib(3) for kernel-userland data passing.

Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.

This also removes the fingerprint type name limit, so relevant code
was adjusted.

Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.

Update my email address.

misc cleanup: remove #if 0 code, unused var, and make pretty.

oops, forgot to handle new abi for "query", noted by he@, thanks!

okay, since there was no way to divide this to two commits, here it goes..

introduce fileassoc(9), a kernel interface for associating meta-data with
files using in-kernel memory. this is very similar to what we had in
veriexec till now, only abstracted so it can be used more easily by more
consumers.

this also prompted the redesign of the interface, making it work on vnodes
and mounts and not directly on devices and inodes. internally, we still
use file-id but that's gonna change soon... the interface will remain
consistent.

as a result, veriexec went under some heavy changes to conform to the new
interface. since we no longer use device numbers to identify file-systems,
the veriexec sysctl stuff changed too: kern.veriexec.count.dev_N is now
kern.veriexec.tableN.* where 'N' is NOT the device number but rather a
way to distinguish several mounts.

also worth noting is the plugging of unmount/delete operations
wrt/fileassoc and veriexec.

tons of input from yamt@, wrstuden@, martin@, and christos@.

Use PRIu64 to print ino_t (maybe there should be a PRIino_t somewhere....)

Add and document a "query" keyword to veriexecctl. Usage:

/sbin/veriexecctl query /path/to/file

will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.

Add and document a VERIEXEC_DELETE operation for Veriexec.

We can now delete an entry from the tables using

veriexecctl delete /path/to/file

or remove an entire table using

veriexecctl delete /mount_point

(any directory will work for the mount point it's on)

Introduce per-page fingerprints in Veriexec.

This closes a hole pointed out by Thor Lancelot Simon on tech-kern ~3
years ago.

The problem was with running binaries from remote storage, where our
kernel (and Veriexec) has no control over any changes to files.

An attacker could, after the fingerprint has been verified and
program loaded to memory, inject malicious code into the backing
store on the remote storage, followed by a forced flush, causing
a page-in of the malicious data from backing store, bypassing
integrity checks.

Initial implementation by Brett Lymn.

Some refactoring and bugfixes:

- Report line numbers correctly.
- Don't perform a 2nd pass when there are were errors during 1st.
- Support multiple, comma-separated flags. This is mostly a reworking of
some parser internals preparing for planned features.

No need for this one, apparently. Reported by Hisashi T Fujinaka.

Don't create duplicate tables for the same device.

Newline in end of usage.

Warn when failing to load an entry; don't fail the whole process.

Remove unused variables.

Remove leftovers from Vexec.

Remove common code for returning supported fingerprints. This is done now
via sysctl(8) using kern.veriexec.algorithms.

Also add an entry for the 'algorithms' variable in sysctl.8 forgotten in
the last commit.

Minor cleanups, KNF, error handling consistency.

Make this compile again after the latest overhaul.
Use -I${.CURDIR} instead of -I. to support placement of objects elsewhere.
Make sure arguments to ctype functions are unsigned char by changing the
type of one function argument.
Fix "local declaration shadows global" warnings by renaming variables.
Fix printing of size_t variable to use %zu format instead of %u.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

branches: 1.5.6;
Made error messages more descriptive.

Homogenize usage messages: make the 'usage' word all lowercase, as this seems
to be the most common practice in our tree.

Remove traces of old names (verifiedexec_load and /dev/verifiedexec).

Need <stdlib.h> for exit() prototype.

Renamed verified exec fingerprint loader.

Update for proplib(3) API changes.

Remove trailing whitespace. Noted in PR 39440 by Stathis Kamperis.

branches: 1.10.12; 1.10.16;
Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

Make Veriexec use proplib(3) for kernel-userland data passing.

Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.

This also removes the fingerprint type name limit, so relevant code
was adjusted.

Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.

Update my email address.

misc cleanup: remove #if 0 code, unused var, and make pretty.

okay, since there was no way to divide this to two commits, here it goes..

introduce fileassoc(9), a kernel interface for associating meta-data with
files using in-kernel memory. this is very similar to what we had in
veriexec till now, only abstracted so it can be used more easily by more
consumers.

this also prompted the redesign of the interface, making it work on vnodes
and mounts and not directly on devices and inodes. internally, we still
use file-id but that's gonna change soon... the interface will remain
consistent.

as a result, veriexec went under some heavy changes to conform to the new
interface. since we no longer use device numbers to identify file-systems,
the veriexec sysctl stuff changed too: kern.veriexec.count.dev_N is now
kern.veriexec.tableN.* where 'N' is NOT the device number but rather a
way to distinguish several mounts.

also worth noting is the plugging of unmount/delete operations
wrt/fileassoc and veriexec.

tons of input from yamt@, wrstuden@, martin@, and christos@.

Add and document a "query" keyword to veriexecctl. Usage:

/sbin/veriexecctl query /path/to/file

will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.

branches: 1.4.2;
Remove leftovers from Vexec.

Minor cleanups, KNF, error handling consistency.

Make this compile again after the latest overhaul.
Use -I${.CURDIR} instead of -I. to support placement of objects elsewhere.
Make sure arguments to ctype functions are unsigned char by changing the
type of one function argument.
Fix "local declaration shadows global" warnings by renaming variables.
Fix printing of size_t variable to use %zu format instead of %u.

Add missing header file.

input is unused.

use %option instead of #define YY_NO_...

we don't need unput

Remove trailing whitespace. Noted in PR 39440 by Stathis Kamperis.

branches: 1.11.12; 1.11.16;
Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

Support escaping characters in the path so that spaces etc. are allowed
in entries for Veriexec.

This has been requested for a long time, most recently by Brad Harder.

Thanks a lot to Michael van Elst for the patch, done during the latest
hackathon.

Make Veriexec use proplib(3) for kernel-userland data passing.

Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.

This also removes the fingerprint type name limit, so relevant code
was adjusted.

Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.

Update my email address.

Allow multiple lines entries using '\' at the end of the line.
Simplified by martin@, thanks. :)

Some refactoring and bugfixes:

- Report line numbers correctly.
- Don't perform a 2nd pass when there are were errors during 1st.
- Support multiple, comma-separated flags. This is mostly a reworking of
some parser internals preparing for planned features.

Fix format type error in yyerror printf.

Minor cleanups, KNF, error handling consistency.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

branches: 1.2.2;
Kill __P(); WARNS=2

Renamed verified exec fingerprint loader.

fix sign-compare issues

branches: 1.25.4;
Remove trailing whitespace. Noted in PR 39440 by Stathis Kamperis.

Adjust this to not need -Wno-pointer-sign.

branches: 1.23.8; 1.23.12;
Remove intval from %union, it's unused... ok christos@.

branches: 1.22.2;
Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.

From Tom Spindler (dogcow@).

Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

Don't reset entry-type for every flag_spec.

branches: 1.19.2;
Make Veriexec use proplib(3) for kernel-userland data passing.

Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.

This also removes the fingerprint type name limit, so relevant code
was adjusted.

Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.

Update my email address.

If Veriexec enforces access type, don't allow mmap() to use PROT_EXEC on
files that don't have the "indirect" flag. Also change the "library" alias
in veriexecctl(8) to mean "file, indirect".

okay blymn@

Fix two horrible bugs found during a routine audit session with Brett Lymn.

First one was incorrectly loading entries -- we were treating each file as
a mount, which resulted in huge mess. I have no excuse for how I didn't
catch this earlier.

Second, use the table name we create for the Veriexec sysctl node and not
the fixed "table0".

Both are fileassoc(9) integration fallout.

branches: 1.15.2;
misc cleanup: remove #if 0 code, unused var, and make pretty.

okay, since there was no way to divide this to two commits, here it goes..

introduce fileassoc(9), a kernel interface for associating meta-data with
files using in-kernel memory. this is very similar to what we had in
veriexec till now, only abstracted so it can be used more easily by more
consumers.

this also prompted the redesign of the interface, making it work on vnodes
and mounts and not directly on devices and inodes. internally, we still
use file-id but that's gonna change soon... the interface will remain
consistent.

as a result, veriexec went under some heavy changes to conform to the new
interface. since we no longer use device numbers to identify file-systems,
the veriexec sysctl stuff changed too: kern.veriexec.count.dev_N is now
kern.veriexec.tableN.* where 'N' is NOT the device number but rather a
way to distinguish several mounts.

also worth noting is the plugging of unmount/delete operations
wrt/fileassoc and veriexec.

tons of input from yamt@, wrstuden@, martin@, and christos@.

Introduce per-page fingerprints in Veriexec.

This closes a hole pointed out by Thor Lancelot Simon on tech-kern ~3
years ago.

The problem was with running binaries from remote storage, where our
kernel (and Veriexec) has no control over any changes to files.

An attacker could, after the fingerprint has been verified and
program loaded to memory, inject malicious code into the backing
store on the remote storage, followed by a forced flush, causing
a page-in of the malicious data from backing store, bypassing
integrity checks.

Initial implementation by Brett Lymn.

Add and document some convenience aliases for commonly required option
combinations.

Support multiple entry types. Direct, indirect, and file can now be
combined in the signatures file using commas.

Some refactoring and bugfixes:

- Report line numbers correctly.
- Don't perform a 2nd pass when there are were errors during 1st.
- Support multiple, comma-separated flags. This is mostly a reworking of
some parser internals preparing for planned features.

Don't access a NULL pointer.

Remove leftovers from Vexec.

Minor cleanups, KNF, error handling consistency.

Make this compile again after the latest overhaul.
Use -I${.CURDIR} instead of -I. to support placement of objects elsewhere.
Make sure arguments to ctype functions are unsigned char by changing the
type of one function argument.
Fix "local declaration shadows global" warnings by renaming variables.
Fix printing of size_t variable to use %zu format instead of %u.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

branches: 1.4.2;
Kill __P(); WARNS=2

Removed arbitrary 255 character limit on file field
Verify that the path in the file field is not > MAXPATHLEN, if it is
too long then skip that entry in the signature file.

Remove traces of old names (verifiedexec_load and /dev/verifiedexec).

Renamed verified exec fingerprint loader.