Add missing flags to veriexec(8) as well as some examples to
help explain usage.
Also add veriexec.4
Sponsored by: Juniper Networks, Inc.
Details
Details
- Reviewers
markj imp stevek - Group Reviewers
Restricted Owners Package (Owns No Changed Paths) - Commits
- rGb77f618568f2: Add examples to veriexec(8)
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Skipped - Unit
Tests Skipped - Build Status
Buildable 58917 Build 55804: arc lint + arc unit
Event Timeline
Comment Actions
Thanks for writing this. I didn't get a chance to review yesterday, but I added some comments below.
| sbin/veriexec/veriexec.8 | ||
|---|---|---|
| 198 | ||
| 205 | Some documentation on how to configure a trust store would be useful too. | |
| 227 | ||
| share/man/man4/veriexec.4 | ||
| 35 | This is missing some description of how to compile veriexec support into the kernel. Currently there is only options MAC_VERIEXEC, which compiles both mac_veriexec and dev/veriexec into the kernel. mac_veriexec.ko does not include dev/veriexec for some reason (i.e., sys/modules/mac_veriexec/Makefile is only lists sources files for the MAC component), so the kernel module is not useful. This seems unintentional. | |
| 50 | Missing a word here. | |
| share/man/man4/veriexec.4 | ||
|---|---|---|
| 35 | There is sys/modules/veriexec for the device side. The MAC module does not have a dependency on the veriexec device. One could have another implementation that just uses the MAC/veriexec functionality to populate the meta-data store. Note that the veriexec.ko module has a dependency on mac_veriexec | |
| share/man/man4/veriexec.4 | ||
|---|---|---|
| 35 | Ah, I see, I missed that. Unless I'm missing something though, it's not listed in sys/modules/Makefile so never gets built, even when compiling with WITH_VERIEXEC=. When compiling into the kernel, dev/veriexec/verified_exec.c is dependent on options MAC_VERIEXEC, which seems incorrect. | |
| share/man/man4/veriexec.4 | ||
|---|---|---|
| 35 | Yes, that probably should be "optional mac_veriexec veriexec" for the "files" file. The sys/modules/Makefile bit will need to be corrected. | |