Verified execution (veriexec) library interface to MAC/veriexec per-policy syscall

[stevek]

Summary

This library allows for user space applications to check file descriptors
or paths to see if they can be verified by MAC/veriexec.

Depends on D8554

Test Plan

Various versions of this code (with some differences) has been in use for a few years and has gone through in-house testing.

[wblock]

lib/libveriexec/veriexec.3

27 ↗

(On Diff #22311)

This needs to be bumped.

48 ↗

(On Diff #22311)

Maybe simplify this?

.Fn veriexec_check_fd
​function checks the signature of the file represented by the
.Fa fd
file descriptor.

54 ↗

(On Diff #22311)

Likewise, can't this just be:

(There's a typo on "specfied", which this avoids.)

function checks the signature of the file path
.Fa file .

63 ↗

(On Diff #22311)

Um... if not the first thing or the second thing?

functions return zero on a successful signature match or if veriexec is not enabled.
If the signature does not match,
.Va errno
is set.

(Although "set" is a little ambiguous. Set in the binary sense (non-zero) or set to a particular number?

[jtl]

I think this should be committed after addressing @wblock's comments.