Add examples to veriexec(8)

[sjg]

Summary

Add missing flags to veriexec(8) as well as some examples to
help explain usage.

Also add veriexec.4

Sponsored by: Juniper Networks, Inc.

[sjg]

Update history to avoid ambiguity

[sjg]

Add missing comma

[markj]

Thanks for writing this. I didn't get a chance to review yesterday, but I added some comments below.

sbin/veriexec/veriexec.8

198

205

Some documentation on how to configure a trust store would be useful too.

227

share/man/man4/veriexec.4

34

This is missing some description of how to compile veriexec support into the kernel. Currently there is only options MAC_VERIEXEC, which compiles both mac_veriexec and dev/veriexec into the kernel.

mac_veriexec.ko does not include dev/veriexec for some reason (i.e., sys/modules/mac_veriexec/Makefile is only lists sources files for the MAC component), so the kernel module is not useful. This seems unintentional.

49

Missing a word here.

[stevek]

share/man/man4/veriexec.4

34

There is sys/modules/veriexec for the device side.

The MAC module does not have a dependency on the veriexec device. One could have another implementation that just uses the MAC/veriexec functionality to populate the meta-data store.

Note that the veriexec.ko module has a dependency on mac_veriexec

[markj]

share/man/man4/veriexec.4

34

Ah, I see, I missed that. Unless I'm missing something though, it's not listed in sys/modules/Makefile so never gets built, even when compiling with WITH_VERIEXEC=.

When compiling into the kernel, dev/veriexec/verified_exec.c is dependent on options MAC_VERIEXEC, which seems incorrect.

[stevek]

share/man/man4/veriexec.4

34

Yes, that probably should be "optional mac_veriexec veriexec" for the "files" file.

The sys/modules/Makefile bit will need to be corrected.