Page MenuHomeFreeBSD

Add verifying loader for mac_veriexec
ClosedPublic

Authored by sjg on Aug 2 2018, 11:40 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Mar 16, 11:44 PM
Unknown Object (File)
Mon, Mar 11, 8:27 AM
Unknown Object (File)
Jan 27 2024, 4:56 PM
Unknown Object (File)
Jan 6 2024, 12:50 PM
Unknown Object (File)
Dec 28 2023, 2:56 AM
Unknown Object (File)
Dec 25 2023, 12:16 PM
Unknown Object (File)
Dec 20 2023, 1:40 AM
Unknown Object (File)
Dec 11 2023, 1:08 AM
Subscribers

Details

Summary

If manifest signature can be verified, its content
is fed to mac_veriexec.

Options for querying and setting state as well
as testing files for verification status.

Right now this tool supports a couple of mac_veriexec features
which are not yet in FreeBSD.
It also allows for version skew between kernel and
userland.

Some of the resulting ifdef's can hopefully be removed before
commit.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This depends on D16335
which depends on D16334
and D16337

Adding xrefs to related reviews

D16337 for build options etc
D16335 for libve
D16334 for libbearssl

Renamed libve to libsecureboot

sbin/veriexec/manifest_parser.y
32 ↗(On Diff #52863)

Since libve was renamed to libsecureboot this should be libsecureboot.h

sbin/veriexec/veriexec.c
34 ↗(On Diff #52863)

Since libve was renamed to libsecureboot this should be libsecureboot.h

This revision was not accepted when it landed; it landed in state Needs Review.Feb 26 2019, 6:17 AM
This revision was automatically updated to reflect the committed changes.