Remove workaround for ancient HTML generation code.

Merge riastradh-drm2 to HEAD.

Use Mt for email addresses.

branches: 1.37.4; 1.37.10; 1.37.14;
Mark up file as argument.

security(7), not (8).

Document -v. PR 39441 from Stathis Kamperis. Bump date.

branches: 1.34.4; 1.34.8;
Following input from Matthew Mondor, some Veriexec documentation changes:

- Document the signatures file format in a veriexec(5) man-page,
- Document the strict levels and a general Veriexec intro in veriexec(8)
instead of security(8).

Okay blymn@.

Allow no signatures file to be specified for the "load" command, and use
the default one in such cases.

Update command usage and documentation to reflect the above.

Xref security(8) from veriexec(4), veriexec(9), veriexecctl(8), and
veriexecgen(8).

Suggested by Matthew Mondor.

Whitespace and HTML output fixes.

branches: 1.30.4; 1.30.6;
Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

branches: 1.29.2; 1.29.4; 1.29.6;
Support escaping characters in the path so that spaces etc. are allowed
in entries for Veriexec.

This has been requested for a long time, most recently by Brad Harder.

Thanks a lot to Michael van Elst for the patch, done during the latest
hackathon.

If Veriexec enforces access type, don't allow mmap() to use PROT_EXEC on
files that don't have the "indirect" flag. Also change the "library" alias
in veriexecctl(8) to mean "file, indirect".

okay blymn@

.Sh -> .Ss

mmm mdoclint. :)

Reference veriexecgen(8) instead of the old scripts. Bump date.

Scripts don't have to be *shell* scripts.

no VERIFIED_EXEC anymore, just a pseudo-device.

misc cleanup: remove #if 0 code, unused var, and make pretty.

Grammar improvement.

Add and document a "query" keyword to veriexecctl. Usage:

/sbin/veriexecctl query /path/to/file

will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.

Add and document a VERIEXEC_DELETE operation for Veriexec.

We can now delete an entry from the tables using

veriexecctl delete /path/to/file

or remove an entire table using

veriexecctl delete /mount_point

(any directory will work for the mount point it's on)

Make sentence more readable.

Introduce per-page fingerprints in Veriexec.

This closes a hole pointed out by Thor Lancelot Simon on tech-kern ~3
years ago.

The problem was with running binaries from remote storage, where our
kernel (and Veriexec) has no control over any changes to files.

An attacker could, after the fingerprint has been verified and
program loaded to memory, inject malicious code into the backing
store on the remote storage, followed by a forced flush, causing
a page-in of the malicious data from backing store, bypassing
integrity checks.

Initial implementation by Brett Lymn.

Bump date for previous; use more markup.

Add and document some convenience aliases for commonly required option
combinations.

Sync with reality.

- Verified Exec -> Veriexec
- pseudo-device is `veriexec'
- veriexec.conf -> signatures, and mention /etc/signatures as the default
location
- We use veriexec's strict level, not the system securelevel
- Mention the `direct' option
- Mention that the signatures file can have multiple options in a single
entry, comma-separated
- Mention that both `direct' and `indirect' access modes are implied
if no access modes are explicitly mention in the options
- Bump date

Bump date for previous.

Remove bits about deprecated 'fingerprints' command.

Remove common code for returning supported fingerprints. This is done now
via sysctl(8) using kern.veriexec.algorithms.

Also add an entry for the 'algorithms' variable in sysctl.8 forgotten in
the last commit.

Add bugs sub-heading to warn about whitespace in filenames.

Add Xr to veriexec.4.

Mention command names in SYNOPSIS; add gen_rmd160 to SEE ALSO;
improve formatting; bump date.

Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.

branches: 1.7.2;
Remove unnecessary dot, and bump date for new SEE ALSO section.

Add SEE ALSO section pointing at the scripts to create signatures

XXX they should be installed as veriexec_gen_* IMHO,
XXX not dwell in /usr/share/examples

Bump date for previous.

Fix error in description of signature file syntax (thanks to Chrisian
Biere)
Fix wording to match changed syntax line
Add some clarifications to the wording
Improve vertical spacing of some sections.

The next release will be 2.0, not 1.7.

Remove traces of old names (verifiedexec_load and /dev/verifiedexec).

Renamed verified exec fingerprint loader.