stand: Add a call to verify_file from ficl.

[kd]

Summary

Without it those files are loaded bypassing verification when using forth interpreter.

Test Plan

Run loader with forth interpreter and veriexec enabled and make sure that all loaded files including *.conf are checked by verify_file.

[sjg]

stand/ficl/loader.c

506

Hmm this is in our internal tree, not sure how I missed it.
Note I have:

if (fd >= 0 && (mode & 0x3) == 0 &&
      verify_file(fd, name, 0, VE_GUESS) < 0) {
      close(fd);
      fd = -1;
}

[sjg]

Actually it would be better to call verify_file and THEN consider mode.
If the file is verified writing should not be allowed, if it is not verified reading should not be allowed.

[sjg]

Ok I never committed my changes to loader.c because I had some other junk in there so it would work with Junos - for testing.
See
https://reviews.freebsd.org/D20387

for what I described

[kd]

Ok, I'm abandoning this in favor of your patch.