Enable veriexec(4) support by default on the macppc port and update the manual to mention it.

Closes PR port-powerpc/52908

Make all headers bold.

Document the keep-filename entry in the dictionary passed to VERIEXEC_LOAD.

Clean up English grammar in description of VERIEXEC_DUMP (relating to the
retention of filenames).

XXX There are several tables in this man page with column headers defined
XXX using .It Sy Col1 Col2 Col3 This causes the first header to appear
XXX as "Bold" but the remaining column headers are "Normal". I don't know
XXX how to fix it to make all the headers "Bold". :(

Merge riastradh-drm2 to HEAD.

Use Mt for email addresses.

branches: 1.21.4; 1.21.10; 1.21.14;
Fix xref; security(8) -> security(7).

Fix markup

branches: 1.19.12;
Xref security(8) from veriexec(4), veriexec(9), veriexecctl(8), and
veriexecgen(8).

Suggested by Matthew Mondor.

branches: 1.18.4;
Some Veriexec stuff that's been rotting in my tree for months.

Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.

- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.

- Fix memory leak in rename handling when overwriting a monitored
file.

- Fix table deletion logic.

- Don't prevent query requests if not in learning mode.


KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.

- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.

- veriexec_report() was removed, it is now internal.

- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.

- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.

- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:

# veriexecctl dump > /etc/signatures

Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.

Idea from Brett Lymn.

- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:

# veriexecctl flush

- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.

- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.

- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.

- Some of the messages Veriexec prints were improved.

- Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.

Use Dv for defined values, even in lists (some more).

Use Dv for defined values, even in lists.

Make Veriexec use proplib(3) for kernel-userland data passing.

Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.

This also removes the fingerprint type name limit, so relevant code
was adjusted.

Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.

Remove note about how a malicious root user can cause kernel crashes.

Sync with reality.

Answer "what is veriexec", inspired heavily by
http://www.users.on.net/~blymn/veriexec/

Don't need an RCS "Id" keyword, already have the "NetBSD" keyword at the
top.

Add and document a "query" keyword to veriexecctl. Usage:

/sbin/veriexecctl query /path/to/file

will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.

Add and document a VERIEXEC_DELETE operation for Veriexec.

We can now delete an entry from the tables using

veriexecctl delete /path/to/file

or remove an entire table using

veriexecctl delete /mount_point

(any directory will work for the mount point it's on)

Introduce per-page fingerprints in Veriexec.

This closes a hole pointed out by Thor Lancelot Simon on tech-kern ~3
years ago.

The problem was with running binaries from remote storage, where our
kernel (and Veriexec) has no control over any changes to files.

An attacker could, after the fingerprint has been verified and
program loaded to memory, inject malicious code into the backing
store on the remote storage, followed by a forced flush, causing
a page-in of the malicious data from backing store, bypassing
integrity checks.

Initial implementation by Brett Lymn.

Sync with reality.

- We now support multiple entry types and not just one
- We care for kern.veriexec.strict, not securelevel
- Add sysctl(3) to SEE ALSO

branches: 1.6.2;
Remove common code for returning supported fingerprints. This is done now
via sysctl(8) using kern.veriexec.algorithms.

Also add an entry for the 'algorithms' variable in sysctl.8 forgotten in
the last commit.

Put back the changes made by Wiz

Shift veriexec(4) man page to correct place.

Add more (skeleton) missing man pages.

Markup fixes.

Added man page for verified exec pseudo-device