Index: head/etc/mtree/BSD.include.dist =================================================================== --- head/etc/mtree/BSD.include.dist (revision 344566) +++ head/etc/mtree/BSD.include.dist (revision 344567) @@ -1,376 +1,380 @@ # $FreeBSD$ # # Please see the file src/etc/mtree/README before making changes to this file. # /set type=dir uname=root gname=wheel mode=0755 . arpa .. atf-c .. atf-c++ .. bsm .. bsnmp .. c++ 4.2 backward .. bits .. debug .. ext pb_ds detail basic_tree_policy .. bin_search_tree_ .. binary_heap_ .. binomial_heap_ .. binomial_heap_base_ .. cc_hash_table_map_ .. eq_fn .. gp_hash_table_map_ .. hash_fn .. left_child_next_sibling_heap_ .. list_update_map_ .. list_update_policy .. ov_tree_map_ .. pairing_heap_ .. pat_trie_ .. rb_tree_map_ .. rc_binomial_heap_ .. resize_policy .. splay_tree_ .. thin_heap_ .. tree_policy .. trie_policy .. unordered_iterator .. .. .. .. tr1 .. .. v1 experimental .. ext .. tr1 .. .. .. cam ata .. mmc .. nvme .. scsi .. .. casper .. crypto .. dev acpica .. agp .. an .. bktr .. ciss .. evdev .. filemon .. firewire .. hwpmc .. hyperv .. ic .. iicbus .. io .. mfi .. mlx5 .. mmc .. mpt mpilib .. .. nand .. nvme .. ofw .. pbio .. pci .. powermac_nvram .. ppbus .. smbus .. speaker .. tcp_log .. usb .. + veriexec + .. vkbd .. wi .. .. devdctl .. edit readline .. .. fs cuse .. devfs .. fdescfs .. msdosfs .. nandfs .. nfs .. nullfs .. procfs .. smbfs .. udf .. unionfs .. .. gcc 4.2 .. .. geom cache .. concat .. eli .. gate .. journal .. label .. mirror .. mountver .. multipath .. nop .. raid .. raid3 .. shsec .. stripe .. virstor .. .. gnu posix .. .. gssapi .. infiniband complib .. iba .. opensm .. vendor .. .. isofs cd9660 .. .. kadm5 .. krb5 .. lib80211 .. libipt .. libmilter .. libxo .. lzma .. machine pc .. .. net altq .. .. net80211 .. netgraph atm .. bluetooth include .. .. netflow .. .. netinet cc .. netdump .. .. netinet6 .. netipsec .. netnatm api .. msg .. saal .. sig .. .. netpfil pf .. .. netsmb .. nfs .. nfsclient .. nfsserver .. opencsd c_api .. etmv3 .. etmv4 .. ptm .. stm .. .. openssl .. pcap .. protocols .. rdma .. rpc .. rpcsvc .. security audit .. mac_biba .. mac_bsdextended .. mac_lomac .. mac_mls .. mac_partition + .. + mac_veriexec .. .. ssp .. sys disk .. .. teken .. ufs ffs .. ufs .. .. vm .. xlocale .. .. Index: head/include/Makefile =================================================================== --- head/include/Makefile (revision 344566) +++ head/include/Makefile (revision 344567) @@ -1,409 +1,418 @@ # @(#)Makefile 8.2 (Berkeley) 1/4/94 # $FreeBSD$ # # Doing a "make install" builds /usr/include. .include PACKAGE=runtime TAGS+= development CLEANFILES= osreldate.h version SUBDIR= arpa protocols rpcsvc rpc xlocale SUBDIR_PARALLEL= INCS= a.out.h ar.h assert.h bitstring.h complex.h cpio.h _ctype.h ctype.h \ db.h \ dirent.h dlfcn.h elf.h elf-hints.h err.h fmtmsg.h fnmatch.h fstab.h \ fts.h ftw.h getopt.h glob.h grp.h \ ieeefp.h ifaddrs.h \ inttypes.h iso646.h kenv.h langinfo.h libgen.h limits.h link.h \ locale.h malloc.h malloc_np.h memory.h monetary.h mpool.h mqueue.h \ ndbm.h netconfig.h \ netdb.h nl_types.h nlist.h nss.h nsswitch.h paths.h \ printf.h proc_service.h pthread.h \ pthread_np.h pwd.h ranlib.h readpassphrase.h regex.h \ res_update.h resolv.h runetype.h search.h semaphore.h setjmp.h \ signal.h spawn.h stab.h stdalign.h stdbool.h stddef.h \ stdnoreturn.h stdio.h stdlib.h string.h stringlist.h \ strings.h sysexits.h tar.h termios.h tgmath.h \ time.h timeconv.h timers.h ttyent.h \ uchar.h ulimit.h unistd.h utime.h utmpx.h uuid.h varargs.h \ wchar.h wctype.h wordexp.h xlocale.h .PATH: ${SRCTOP}/contrib/libc-vis INCS+= vis.h MHDRS= float.h floatingpoint.h stdarg.h PHDRS= sched.h _semaphore.h LHDRS= aio.h errno.h fcntl.h linker_set.h poll.h stdatomic.h stdint.h \ syslog.h ucontext.h LDIRS= bsm cam geom net net80211 netgraph netinet netinet6 \ netipsec netsmb nfs nfsclient nfsserver sys vm LSUBDIRS= cam/ata cam/mmc cam/nvme cam/scsi \ dev/acpica dev/agp dev/an dev/bktr dev/ciss dev/filemon dev/firewire \ dev/hwpmc dev/hyperv \ dev/ic dev/iicbus dev/io dev/mfi dev/mmc dev/nvme \ dev/ofw dev/pbio dev/pci ${_dev_powermac_nvram} dev/ppbus dev/smbus \ - dev/speaker dev/tcp_log dev/vkbd dev/wi \ + dev/speaker dev/tcp_log dev/veriexec dev/vkbd dev/wi \ fs/devfs fs/fdescfs fs/msdosfs fs/nandfs fs/nfs fs/nullfs \ fs/procfs fs/smbfs fs/udf fs/unionfs \ geom/cache geom/concat geom/eli geom/gate geom/journal geom/label \ geom/mirror geom/mountver geom/multipath geom/nop \ geom/raid geom/raid3 geom/shsec geom/stripe geom/virstor \ net/altq \ netgraph/atm netgraph/netflow \ netinet/cc \ netinet/netdump \ security/audit \ security/mac_biba security/mac_bsdextended security/mac_lomac \ security/mac_mls security/mac_partition \ + security/mac_veriexec \ sys/disk \ ufs/ffs ufs/ufs LSUBSUBDIRS= dev/mpt/mpilib .if ${MK_BLUETOOTH} != "no" LSUBSUBDIRS+= netgraph/bluetooth/include .endif .if ${MK_CUSE} != "no" LSUBDIRS+= fs/cuse .endif .if ${MK_GSSAPI} != "no" SUBDIR+= gssapi INCS+= gssapi.h .endif .if ${MK_HESIOD} != "no" INCS+= hesiod.h .endif # Handle the #define aliases for libiconv .if ${MK_ICONV} == "yes" INCS+= iconv.h .endif .if ${MK_USB} != "no" LSUBDIRS+= dev/usb .endif .if ${MACHINE_ARCH} == "powerpc" || ${MACHINE_ARCH} == "powerpc64" _dev_powermac_nvram= dev/powermac_nvram .endif # Define SHARED to indicate whether you want symbolic links to the system # source (``symlinks''), or a separate copy (``copies''). ``symlinks'' is # probably only useful for developers and should be avoided if you do not # wish to tie your /usr/include and /usr/src together. #SHARED= symlinks SHARED?= copies INCS+= osreldate.h SYSDIR= ${SRCTOP}/sys NEWVERS_SH= ${SYSDIR}/conf/newvers.sh PARAM_H= ${SYSDIR}/sys/param.h MK_OSRELDATE_SH= ${.CURDIR}/mk-osreldate.sh SYMLINKS+= ${LIBDIR:C,[^/]+,..,g:C,^/,,}${INCLUDEDIR} ${LIBDIR}/include osreldate.h: ${NEWVERS_SH} ${PARAM_H} ${MK_OSRELDATE_SH} env NEWVERS_SH=${NEWVERS_SH} PARAMFILE=${PARAM_H} SYSDIR=${SYSDIR} \ sh ${MK_OSRELDATE_SH} .for i in ${LHDRS} INCSLINKS+= sys/$i ${INCLUDEDIR}/$i .endfor .for i in ${MHDRS} INCSLINKS+= machine/$i ${INCLUDEDIR}/$i .endfor .for i in ${PHDRS} INCSLINKS+= sys/$i ${INCLUDEDIR}/$i .endfor .if ${MACHINE} != ${MACHINE_CPUARCH} _MARCHS= ${MACHINE_CPUARCH} .endif .if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64" _MARCHS+= x86 .endif META_TARGETS+= compat stage_includes: ${SHARED} SDESTDIR= ${SYSROOT:U${DESTDIR}} # Take care of stale directory-level symlinks. compat: .for i in ${LDIRS} ${LSUBDIRS} machine ${_MARCHS} crypto if [ -L ${SDESTDIR}${INCLUDEDIR}/$i ]; then \ rm -f ${SDESTDIR}${INCLUDEDIR}/$i; \ fi .endfor mtree -deU ${NO_ROOT:D-W} ${MTREE_FOLLOWS_SYMLINKS} \ -f ${SRCTOP}/etc/mtree/BSD.include.dist \ -p ${SDESTDIR}${INCLUDEDIR} > /dev/null copies: .PHONY .META .for i in ${LDIRS} ${LSUBDIRS} ${LSUBSUBDIRS} crypto machine machine/pc \ ${_MARCHS} if [ -d ${SDESTDIR}${INCLUDEDIR}/$i ]; then \ cd ${SDESTDIR}${INCLUDEDIR}/$i; \ for h in *.h; do \ if [ -L $$h ]; then rm -f $$h; fi; \ done; \ fi .endfor -.for i in ${LDIRS} ${LSUBDIRS:Ndev/agp:Ndev/acpica:Ndev/bktr:Ndev/evdev:Ndev/hyperv:Ndev/nand:Ndev/pci} ${LSUBSUBDIRS} +.for i in ${LDIRS} ${LSUBDIRS:Ndev/agp:Ndev/acpica:Ndev/bktr:Ndev/evdev:Ndev/hyperv:Ndev/nand:Ndev/pci:Ndev/veriexec} ${LSUBSUBDIRS} cd ${SRCTOP}/sys; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 $i/*.h \ ${SDESTDIR}${INCLUDEDIR}/$i .endfor cd ${SRCTOP}/sys/dev/acpica; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 acpiio.h \ ${SDESTDIR}${INCLUDEDIR}/dev/acpica; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 acpi_hpet.h \ ${SDESTDIR}${INCLUDEDIR}/dev/acpica cd ${SRCTOP}/sys/dev/agp; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 agpreg.h \ ${SDESTDIR}${INCLUDEDIR}/dev/agp cd ${SRCTOP}/sys/dev/bktr; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 ioctl_*.h \ ${SDESTDIR}${INCLUDEDIR}/dev/bktr .if ${MK_NAND} != "no" cd ${SRCTOP}/sys/dev/nand; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 nandsim.h \ ${SDESTDIR}${INCLUDEDIR}/dev/nand; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 nand_dev.h \ ${SDESTDIR}${INCLUDEDIR}/dev/nand .endif cd ${SRCTOP}/sys/dev/evdev; \ ${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 input.h \ ${SDESTDIR}${INCLUDEDIR}/dev/evdev; \ ${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 input-event-codes.h \ ${SDESTDIR}${INCLUDEDIR}/dev/evdev; \ ${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 uinput.h \ ${SDESTDIR}${INCLUDEDIR}/dev/evdev cd ${SRCTOP}/sys/dev/hyperv/include; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 hyperv.h \ ${SDESTDIR}${INCLUDEDIR}/dev/hyperv cd ${SRCTOP}/sys/dev/hyperv/utilities; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 hv_snapshot.h \ ${SDESTDIR}${INCLUDEDIR}/dev/hyperv cd ${SRCTOP}/sys/dev/pci; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 pcireg.h \ ${SDESTDIR}${INCLUDEDIR}/dev/pci + cd ${SRCTOP}/sys/dev/veriexec; \ + ${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 veriexec_ioctl.h \ + ${SDESTDIR}${INCLUDEDIR}/dev/veriexec cd ${SRCTOP}/sys/fs/cd9660/; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/isofs/cd9660 .if ${MK_IPFILTER} != "no" cd ${SRCTOP}/sys/contrib/ipfilter/netinet; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/netinet .endif .if ${MK_PF} != "no" cd ${SRCTOP}/sys/netpfil/pf; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/netpfil/pf .endif cd ${SRCTOP}/sys/crypto; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 rijndael/rijndael.h \ ${SDESTDIR}${INCLUDEDIR}/crypto cd ${SRCTOP}/sys/opencrypto; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/crypto cd ${SRCTOP}/sys/${MACHINE}/include; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/machine .if exists(${SRCTOP}/sys/${MACHINE}/include/pc) cd ${SRCTOP}/sys/${MACHINE}/include/pc; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/machine/pc .endif .for _MARCH in ${_MARCHS} .if exists(${SRCTOP}/sys/${_MARCH}/include) ${INSTALL} -d ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 755 \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}; \ cd ${SRCTOP}/sys/${_MARCH}/include; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH} .if exists(${SRCTOP}/sys/${_MARCH}/include/pc) ${INSTALL} -d ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 755 \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}/pc; \ cd ${SRCTOP}/sys/${_MARCH}/include/pc; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 *.h \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}/pc .endif .endif .endfor cd ${SRCTOP}/sys/rpc; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 types.h \ ${SDESTDIR}${INCLUDEDIR}/rpc cd ${SRCTOP}/sys/teken; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 teken.h \ ${SDESTDIR}${INCLUDEDIR}/teken .if ${MK_CDDL} != "no" cd ${SRCTOP}/sys/cddl/contrib/opensolaris/uts/common/sys; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 nvpair.h \ ${SDESTDIR}${INCLUDEDIR}/sys .endif .if ${MK_MLX5TOOL} != "no" cd ${SRCTOP}/sys/dev/mlx5; \ ${INSTALL} -C ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 444 mlx5io.h \ ${SDESTDIR}${INCLUDEDIR}/dev/mlx5 .endif symlinks: .PHONY .META @${ECHO} "Setting up symlinks to kernel source tree..." .for i in ${LDIRS} cd ${SRCTOP}/sys/$i; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/$i/$$h ${SDESTDIR}${INCLUDEDIR}/$i; \ done .endfor -.for i in ${LSUBDIRS:Ndev/agp:Ndev/acpica:Ndev/bktr:Ndev/evdev:Ndev/hyperv:Ndev/nand:Ndev/pci} +.for i in ${LSUBDIRS:Ndev/agp:Ndev/acpica:Ndev/bktr:Ndev/evdev:Ndev/hyperv:Ndev/nand:Ndev/pci:Ndev/veriexec} cd ${SRCTOP}/sys/$i; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/$i/$$h ${SDESTDIR}${INCLUDEDIR}/$i; \ done .endfor cd ${SRCTOP}/sys/dev/acpica; \ for h in acpiio.h acpi_hpet.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/acpica/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/acpica; \ done cd ${SRCTOP}/sys/dev/agp; \ for h in agpreg.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/agp/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/agp; \ done cd ${SRCTOP}/sys/dev/bktr; \ for h in ioctl_*.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/bktr/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/bktr; \ done .if ${MK_NAND} != "no" cd ${SRCTOP}/sys/dev/nand; \ for h in nandsim.h nand_dev.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/nand/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/nand; \ done .endif cd ${SRCTOP}/sys/dev/evdev; \ for h in input.h input-event-codes.h uinput.h; do \ ln -fs ../../../../sys/dev/evdev/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/evdev; \ done cd ${SRCTOP}/sys/dev/hyperv/include; \ for h in hyperv.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/hyperv/include/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/hyperv; \ done cd ${SRCTOP}/sys/dev/hyperv/utilities; \ for h in hv_snapshot.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/hyperv/utilities/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/hyperv; \ done cd ${SRCTOP}/sys/dev/pci; \ for h in pcireg.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/pci/$$h \ ${SDESTDIR}${INCLUDEDIR}/dev/pci; \ + done + cd ${SRCTOP}/sys/dev/veriexec; \ + for h in veriexec_ioctl.h; do \ + ln -fs ../../../../sys/dev/veriexec/$$h \ + ${SDESTDIR}${INCLUDEDIR}/dev/veriexec; \ done .for i in ${LSUBSUBDIRS} cd ${SRCTOP}/sys/$i; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../../sys/$i/$$h ${SDESTDIR}${INCLUDEDIR}/$i; \ done .endfor .if ${MK_IPFILTER} != "no" cd ${SRCTOP}/sys/contrib/ipfilter/netinet; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/contrib/ipfilter/netinet/$$h \ ${SDESTDIR}${INCLUDEDIR}/netinet; \ done .endif .if ${MK_PF} != "no" cd ${SRCTOP}/sys/netpfil/pf; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/netpfil/pf/$$h \ ${SDESTDIR}${INCLUDEDIR}/netpfil/pf; \ done .endif cd ${SRCTOP}/sys/crypto; \ for h in rijndael/rijndael.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/crypto/$$h \ ${SDESTDIR}${INCLUDEDIR}/crypto; \ done cd ${SRCTOP}/sys/opencrypto; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/opencrypto/$$h \ ${SDESTDIR}${INCLUDEDIR}/crypto; \ done cd ${SRCTOP}/sys/${MACHINE}/include; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/${MACHINE}/include/$$h \ ${SDESTDIR}${INCLUDEDIR}/machine; \ done .if exists(${SRCTOP}/sys/${MACHINE}/include/pc) cd ${SRCTOP}/sys/${MACHINE}/include/pc; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/${MACHINE}/include/pc/$$h \ ${SDESTDIR}${INCLUDEDIR}/machine/pc; \ done .endif .for _MARCH in ${_MARCHS} .if exists(${SRCTOP}/sys/${_MARCH}/include) ${INSTALL} -d ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 755 \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}; \ cd ${SRCTOP}/sys/${_MARCH}/include; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/${_MARCH}/include/$$h \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}; \ done .if exists(${SRCTOP}/sys/${_MARCH}/include/pc) ${INSTALL} -d ${TAG_ARGS} -o ${BINOWN} -g ${BINGRP} -m 755 \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}/pc; \ cd ${SRCTOP}/sys/${_MARCH}/include/pc; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/${_MARCH}/include/pc/$$h \ ${SDESTDIR}${INCLUDEDIR}/${_MARCH}/pc; \ done .endif .endif .endfor cd ${SRCTOP}/sys/fs/cd9660; \ for h in *.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/fs/cd9660/$$h \ ${SDESTDIR}${INCLUDEDIR}/isofs/cd9660; \ done cd ${SRCTOP}/sys/rpc; \ for h in types.h; do \ ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../sys/rpc/$$h \ ${SDESTDIR}${INCLUDEDIR}/rpc; \ done .if ${MK_CDDL} != "no" ${INSTALL_SYMLINK} ${TAG_ARGS} \ ../../../sys/cddl/contrib/opensolaris/uts/common/sys/nvpair.h \ ${SDESTDIR}${INCLUDEDIR}/sys .endif .if ${MK_MLX5TOOL} != "no" ${INSTALL_SYMLINK} ${TAG_ARGS} ../../../../sys/dev/mlx5/mlx5io.h \ ${SDESTDIR}${INCLUDEDIR}/dev/mlx5 .endif .include installincludes: ${SHARED} ${SHARED}: compat .if ${MACHINE} == "host" && !defined(_SKIP_BUILD) # we're here because we are building a sysroot... # we need MACHINE et al set correctly HOST_MACHINE!= uname -m HOST_MACHINE_ARCH!= uname -p MACHINE:= ${HOST_MACHINE} MACHINE_ARCH:= ${HOST_MACHINE_ARCH} .endif Index: head/sbin/Makefile =================================================================== --- head/sbin/Makefile (revision 344566) +++ head/sbin/Makefile (revision 344567) @@ -1,99 +1,100 @@ # @(#)Makefile 8.5 (Berkeley) 3/31/94 # $FreeBSD$ .include SUBDIR=adjkerntz \ camcontrol \ clri \ comcontrol \ conscontrol \ ddb \ devfs \ devmatch \ dhclient \ dmesg \ dump \ dumpfs \ dumpon \ etherswitchcfg \ ffsinfo \ fsck \ fsck_ffs \ fsck_msdosfs \ fsdb \ fsirand \ gbde \ geom \ ggate \ growfs \ gvinum \ ifconfig \ init \ kldconfig \ kldload \ kldstat \ kldunload \ ldconfig \ md5 \ mdconfig \ mdmfs \ mknod \ mksnap_ffs \ mount \ mount_cd9660 \ mount_fusefs \ mount_msdosfs \ mount_nfs \ mount_nullfs \ mount_udf \ mount_unionfs \ newfs \ newfs_msdos \ nfsiod \ nos-tun \ pfilctl \ ping \ rcorder \ reboot \ recoverdisk \ resolvconf \ restore \ route \ savecore \ setkey \ shutdown \ spppcontrol \ swapon \ sysctl \ tunefs \ umount SUBDIR.${MK_CCD}+= ccdconfig SUBDIR.${MK_CXX}+= devd SUBDIR.${MK_HAST}+= hastctl SUBDIR.${MK_HAST}+= hastd SUBDIR.${MK_INET6}+= ping6 SUBDIR.${MK_INET6}+= rtsol SUBDIR.${MK_IPFILTER}+= ipf SUBDIR.${MK_IPFW}+= ipfw SUBDIR.${MK_IPFW}+= natd SUBDIR.${MK_ISCSI}+= iscontrol SUBDIR.${MK_NAND}+= nandfs SUBDIR.${MK_NAND}+= newfs_nandfs SUBDIR.${MK_NVME}+= nvmecontrol SUBDIR.${MK_OPENSSL}+= decryptcore SUBDIR.${MK_PF}+= pfctl SUBDIR.${MK_PF}+= pflogd SUBDIR.${MK_QUOTAS}+= quotacheck SUBDIR.${MK_ROUTED}+= routed +SUBDIR.${MK_VERIEXEC}+= veriexec SUBDIR.${MK_ZFS}+= bectl SUBDIR.${MK_ZFS}+= zfsbootcfg SUBDIR.${MK_TESTS}+= tests .include SUBDIR_PARALLEL= .include Index: head/sbin/veriexec/Makefile =================================================================== --- head/sbin/veriexec/Makefile (nonexistent) +++ head/sbin/veriexec/Makefile (revision 344567) @@ -0,0 +1,20 @@ +# $FreeBSD$ + +PROG= veriexec +MAN= veriexec.8 +SRCS= \ + veriexec.c \ + manifest_parser.y \ + manifest_lexer.l + +LIBADD+= veriexec secureboot bearssl + +NO_SHARED= + +.include + +CFLAGS+= -I${.CURDIR} ${XCFLAGS.${.TARGET:T:R}:U} + +XCFLAGS.manifest_lexer+= -Wno-missing-variable-declarations \ + -Wno-unneeded-internal-declaration +XCFLAGS.manifest_parser+= -Wno-missing-variable-declarations Property changes on: head/sbin/veriexec/Makefile ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property Index: head/sbin/veriexec/Makefile.depend =================================================================== --- head/sbin/veriexec/Makefile.depend (nonexistent) +++ head/sbin/veriexec/Makefile.depend (revision 344567) @@ -0,0 +1,20 @@ +# $FreeBSD$ +# Autogenerated - do NOT edit! + +DIRDEPS = \ + gnu/lib/csu \ + include \ + include/xlocale \ + lib/${CSU_DIR} \ + lib/libbearssl \ + lib/libc \ + lib/libcompiler_rt \ + lib/libsecureboot \ + lib/libveriexec \ + + +.include + +.if ${DEP_RELDIR} == ${_DEP_RELDIR} +# local dependencies - needed for -jN in clean tree +.endif Property changes on: head/sbin/veriexec/Makefile.depend ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property Index: head/sbin/veriexec/manifest_lexer.l =================================================================== --- head/sbin/veriexec/manifest_lexer.l (nonexistent) +++ head/sbin/veriexec/manifest_lexer.l (revision 344567) @@ -0,0 +1,151 @@ +%{ +/*- + * Copyright (c) 2004-2018, Juniper Networks, Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ + */ + +#include +#include +#include "veriexec.h" +#include "manifest_parser.h" + +#define YY_NO_UNPUT + +int lineno = 1; +int bol = 1; +extern int parser_version; + +void yyerror(const char *message); +void warning(const char *message); +int yylex(void); + +%} + +%% + +\n { + lineno++; + bol=1; + return EOL; +} + +[/a-zA-Z0-9\.][^ \t\n=]* { + yylval.string = strdup(yytext); + if (bol) { + bol=0; + return PATH; + } else + return STRING; +} + += { + return EQ; +} + + +[ \t\r] ; /* eat white ones */ + +#>[0-9]+ { + /* + * If we are older than the specified version + * ignore rest of line, otherwise just discard this token. + */ + int skip = atoi(&yytext[2]); + + VERBOSE(3, ("%s: skip if %d <= %d\n", yytext, parser_version, skip)); + if (parser_version <= skip) { + /* treat as a comment, yyless() is cheaper than yyunput() */ + yytext[yyleng - 1] = '#'; + yyless(2); + } +} + +#[^>\n].* ; /* comment */ + +. yyerror("invalid character"); + +%% + +static char *manifest_file = NULL; + +struct string_buf { + const char *buf; + size_t pos, size; +}; + +static int +read_string_buf (void *token, char *dest, int count) +{ + struct string_buf *str_buf_p = (struct string_buf *)token; + ssize_t n; + + if (count < 0) + return 0; + + n = str_buf_p->size - str_buf_p->pos; + if (count < n) + n = count; + + memcpy(dest, str_buf_p->buf + str_buf_p->pos, n); + str_buf_p->pos += n; + + return n; +} + +FILE * +manifest_open (const char *file, const char *file_content) +{ + static struct string_buf str_buf; + + if (manifest_file) { + free(manifest_file); + fclose(yyin); + } + + str_buf.buf = file_content; + str_buf.pos = 0; + str_buf.size = strlen(file_content); + yyin = fropen(&str_buf, read_string_buf); + if (yyin) { + manifest_file = strdup(file); + lineno = 1; + manifest_parser_init(); + } else + manifest_file = NULL; + return yyin; +} + +void +yyerror(const char *string) +{ + fprintf(stderr, "%s: %d: %s at %s\n", + manifest_file, lineno, string, yytext); +} + +int +yywrap(void) +{ + return (1); +} Property changes on: head/sbin/veriexec/manifest_lexer.l ___________________________________________________________________ Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Index: head/sbin/veriexec/manifest_parser.y =================================================================== --- head/sbin/veriexec/manifest_parser.y (nonexistent) +++ head/sbin/veriexec/manifest_parser.y (revision 344567) @@ -0,0 +1,301 @@ +%{ +/*- + * Copyright (c) 2004-2018, Juniper Networks, Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ + */ + +#include +#include +#include +#include +#include +#include + +#include "veriexec.h" + +int yylex(void); +void yyerror(const char *); + +/* function prototypes */ +static int convert(char *fp, unsigned int count, unsigned char *out); +static void do_ioctl(void); +static int get_fingerprint_type(const char *fp_type); + +/* ioctl parameter struct */ +#ifdef MAXLABELLEN +static struct verified_exec_label_params lparams; +static struct verified_exec_params *params = &lparams.params; +#else +static struct verified_exec_params oparams; +static struct verified_exec_params *params = &oparams; +#endif + +#ifndef SHA256_DIGEST_LENGTH +# define SHA_DIGEST_LENGTH br_sha1_SIZE +# define SHA256_DIGEST_LENGTH br_sha256_SIZE +# define SHA384_DIGEST_LENGTH br_sha384_SIZE +#endif + +static int fmode; + +extern int lineno; +extern int dev_fd; + +struct fingerprint_type { + const char *fp_type; + int fp_size; +}; + +/* static globals */ +static const struct fingerprint_type fingerprint_table[] = { + { "sha1", SHA_DIGEST_LENGTH }, + { "sha256", SHA256_DIGEST_LENGTH }, +#if MAXFINGERPRINTLEN > 32 + { "sha384", SHA384_DIGEST_LENGTH }, +#endif + { NULL, 0 } +}; + +/* + * Indicate to lexer our version. + * A token #>NUMBER will be consumed (and discared) + * by lexer if parser_version > NUMBER + * Otherwise the rest of the line will be discared + * as for a comment. + */ +int parser_version = 1; + +%} + +%union { + char *string; + int intval; +} + +%token EOL +%token EQ +%token PATH +%token STRING + +%% + +statement: /* empty */ + | statement path attributes eol + | statement error eol { + yyclearin; /* discard lookahead */ + yyerrok; /* no more error */ + fprintf(stderr, + "skipping to next fingerprint\n"); + } + ; + +attributes: /* empty */ + | attributes flag + | attributes attr + ; + +attr: STRING EQ STRING +{ + int fptype; + + fptype = get_fingerprint_type($1); + + /* + * There's only one attribute we care about + */ + if (fingerprint_table[fptype].fp_size) { + strlcpy(params->fp_type, $1, sizeof(params->fp_type)); + if (convert($3, fingerprint_table[fptype].fp_size, + params->fingerprint) < 0) { + yyerror("bad fingerprint"); + YYERROR; + } + } else if (strcmp($1, "label") == 0) { + static int warned_labels = 0; + +#ifdef VERIEXEC_LABEL + strlcpy(lparams.label, $3, sizeof(lparams.label)); + VERBOSE(3, ("version=%d label=%s\n", VeriexecVersion, + lparams.label)); + if (VeriexecVersion > 1) { + params->flags |= VERIEXEC_LABEL; + } else +#endif + if (!warned_labels) { + warnx("ignoring labels"); + warned_labels = 1; + } + } else if (strcmp($1, "mode") == 0) { + fmode = (int)strtol($3, NULL, 8); + } +}; + +flag: STRING +{ + /* + * indirect only matters if the interpreter itself is not + * executable. + */ + if (!strcmp($1, "indirect")) { + params->flags |= VERIEXEC_INDIRECT; + } else if (!strcmp($1, "no_ptrace")) { + params->flags |= VERIEXEC_NOTRACE; + } else if (!strcmp($1, "trusted")) { + params->flags |= VERIEXEC_TRUSTED; + } else if (!strcmp($1, "no_fips")) { +#ifdef VERIEXEC_NOFIPS + params->flags |= VERIEXEC_NOFIPS; +#endif + } +} +; + +path: PATH +{ + if (strlen($1) >= MAXPATHLEN) { + yyerror("Path >= MAXPATHLEN"); + YYERROR; + } + /* + * The majority of files in the manifest are relative + * to the package mount point, but we want absolute paths. + * Prepending '/' is actually all we need. + */ + if (snprintf(params->file, sizeof(params->file), "%s%s%s", + Cdir ? Cdir : "", + ($1[0] == '/') ? "" : "/", + $1) >= (int)sizeof(params->file)) { + errx(EX_DATAERR, "cannot form pathname"); + } + params->flags = 0; + fmode = -1; /* unknown */ +}; + +eol: EOL +{ + if (!YYRECOVERING()) { /* Don't do the ioctl if we saw an error */ + do_ioctl(); + } + params->fp_type[0] = '\0'; /* invalidate it */ +}; + +%% + +void +manifest_parser_init(void) +{ + params->fp_type[0] = '\0'; /* invalidate it */ +} + +int +get_fingerprint_type(const char *fp_type) +{ + int i; + + for (i = 0; fingerprint_table[i].fp_type; i++) + if (!strcmp(fp_type, fingerprint_table[i].fp_type)) + break; + + return (i); +} + +/* + * Convert: takes the hexadecimal string pointed to by fp and converts + * it to a "count" byte binary number which is stored in the array pointed to + * by out. Returns -1 if the conversion fails. + */ +static int +convert(char *fp, unsigned int count, unsigned char *out) +{ + unsigned int i; + int value; + + for (i = 0; i < count; i++) { + value = 0; + if (isdigit(fp[i * 2])) + value += fp[i * 2] - '0'; + else if (isxdigit(fp[i * 2])) + value += 10 + tolower(fp[i * 2]) - 'a'; + else + return (-1); + value <<= 4; + if (isdigit(fp[i * 2 + 1])) + value += fp[i * 2 + 1] - '0'; + else if (isxdigit(fp[i * 2 + 1])) + value += 10 + tolower(fp[i * 2 + 1]) - 'a'; + else + return (-1); + out[i] = value; + } + + return (i); +} + +/* + * Perform the load of the fingerprint. Assumes that the fingerprint + * pseudo-device is opened and the file handle is in fd. + */ +static void +do_ioctl(void) +{ + struct stat st; + + if (params->fp_type[0] == '\0') { + VERBOSE(1,("skipping %s\n", params->file)); + return; + } + + /* + * See if the path is executable, if not put it on the FILE list. + */ + if (fmode > 0) { + if (!(fmode & (S_IXUSR|S_IXGRP|S_IXOTH))) { + params->flags |= VERIEXEC_FILE; + } + } else if (stat(params->file, &st) == 0) { + if (!(st.st_mode & (S_IXUSR|S_IXGRP|S_IXOTH))) { + params->flags |= VERIEXEC_FILE; + } + } + /* + * We may be forcing some flags... + */ + params->flags |= ForceFlags; + VERBOSE(1, ("loading %s for %s %s flags=%#x\n", + params->fp_type, + (params->flags == VERIEXEC_FILE) ? "file" : "executable", + params->file, params->flags)); + +#ifdef VERIEXEC_LABEL + if (params->flags & VERIEXEC_LABEL) { + if (ioctl(dev_fd, VERIEXEC_LABEL_LOAD, &lparams) < 0) + warn("cannot update veriexec label for %s", + params->file); + } else +#endif + if (ioctl(dev_fd, VERIEXEC_SIGNED_LOAD, params) < 0) + warn("cannot update veriexec for %s", params->file); + params->fp_type[0] = '\0'; +} Property changes on: head/sbin/veriexec/manifest_parser.y ___________________________________________________________________ Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Index: head/sbin/veriexec/veriexec.8 =================================================================== --- head/sbin/veriexec/veriexec.8 (nonexistent) +++ head/sbin/veriexec/veriexec.8 (revision 344567) @@ -0,0 +1,146 @@ +.\"- +.\" Copyright (c) 2018, Juniper Networks, Inc. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +.\" A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +.\" OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +.\" LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +.\" OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd July 4, 2018 +.Dt VERIEXEC 8 +.Os +.Sh NAME +.Nm veriexec +.Nd manipulate state of mac_veriexec +.Sh SYNOPSIS +.Nm +.Op Fl v +.Op Fl C Ar directory +.Pa manifest +.Nm +.Fl z Ar state +.Nm +.Fl i Ar state +.Nm +.Fl x +.Ar file ... +.Sh DESCRIPTION +.Nm +is a utility to query or manipulate the state of +.Xr mac_veriexec 4 . +.Pp +The first form is for loading a +.Pa manifest . +.Nm +first verifies a digital signature of the +.Ar manifest +and if successful, parses it and feeds its content to kernel. +.Pp +The second form with +.Fl z +is used to modify the +.Ar state , +and with +.Fl i +to query the current +.Ar state . +.Pp +The final form with +.Fl x +is used to test whether +.Ar file +is verified or not. +This requires +.Xr mac_veriexec 4 +to be in the +.Ql active +or +.Ql enforce +state. +.Pp +The possible states +are: +.Bl -tag -width enforce +.It Ar loaded +set automatically when first +.Pa manifest +has been loaded. +.It Ar active +.Xr mac_veriexec 4 +will begin checking files. +This state can only be entered from the +.Ar loaded +state. +.It Ar enforce +.Xr mac_veriexec 4 +will fail attempts to +.Xr exec 2 +or +.Xr open 2 +files with +.Dv O_VERIFY +unless verified. +.It Ar locked +prevent loading of any more manifests. +.El +.Sh MANIFESTS +The manifest contains a mapping of relative pathnames to fingerprints +with optional flags. +For example: +.Bd -literal -offset indent +sbin/veriexec sha256=f22136...c0ff71 no_ptrace +usr/bin/python sha256=5944d9...876525 indirect +sbin/somedaemon sha256=77fc2f...63f5687 label=mod1/val1,mod2/val2 +.Ed +The supported flags are: +.Bl -tag -width indirect +.It Ql indirect +the executable cannot be run directly, +but can be used as an interpreter for example via: +.Bd -literal -offset indent +#!/usr/bin/python +.Ed +.It Ql no_ptrace +do not allow running executable under a debugger. +Useful for any application critical to the security state of system. +.El +.Pp +The +.Ql label +argument allows associating a +.Xr maclabel 7 +with the executable. +Neither +.Nm +nor +.Xr mac_veriexec 4 +(if it supports labels) +pay any attention to the content of the label +they are provided for the use of other +.Xr mac 4 +modules. +.Sh HISTORY +The Verified Exec system first appeared in NetBSD. +This utility derrives from the one found in Junos. +The key difference is the requirement that manifest files +be digitally signed. + + Property changes on: head/sbin/veriexec/veriexec.8 ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property Index: head/sbin/veriexec/veriexec.c =================================================================== --- head/sbin/veriexec/veriexec.c (nonexistent) +++ head/sbin/veriexec/veriexec.c (revision 344567) @@ -0,0 +1,177 @@ +/*- + * Copyright (c) 2018, Juniper Networks, Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ +#include +__FBSDID("$FreeBSD$"); + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "veriexec.h" + +int dev_fd = -1; +int ForceFlags = 0; +int Verbose = 0; +int VeriexecVersion = 0; + +const char *Cdir = NULL; + +static int +veriexec_load(const char *manifest) +{ + unsigned char *content; + int rc; + + content = verify_signed(manifest, VEF_VERBOSE); + if (!content) + errx(EX_USAGE, "cannot verify %s", manifest); + if (manifest_open(manifest, content)) { + rc = yyparse(); + } else { + err(EX_NOINPUT, "cannot load %s", manifest); + } + free(content); + return (rc); +} + +int +main(int argc, char *argv[]) +{ + unsigned long ctl; + int c; + int x; + + dev_fd = open(_PATH_DEV_VERIEXEC, O_WRONLY, 0); + + while ((c = getopt(argc, argv, "C:i:x:vz:")) != -1) { + switch (c) { + case 'C': + Cdir = optarg; + break; + case 'i': + if (dev_fd < 0) { + err(EX_UNAVAILABLE, "cannot open veriexec"); + } + if (ioctl(dev_fd, VERIEXEC_GETSTATE, &x)) { + err(EX_UNAVAILABLE, + "Cannot get veriexec state"); + } + switch (optarg[0]) { + case 'a': /* active */ + ctl = VERIEXEC_STATE_ACTIVE; + break; + case 'e': /* enforce */ + ctl = VERIEXEC_STATE_ENFORCE; + break; + case 'l': /* loaded/locked */ + ctl = (strncmp(optarg, "lock", 4)) ? + VERIEXEC_STATE_LOCKED : + VERIEXEC_STATE_LOADED; + break; + default: + errx(EX_USAGE, "unknown state %s", optarg); + break; + } + exit((x & ctl) == 0); + break; + case 'v': + Verbose++; + break; + case 'x': + /* + * -x says all other args are paths to check. + */ + for (x = 0; optind < argc; optind++) { + if (veriexec_check_path(argv[optind])) { + warn("%s", argv[optind]); + x = 2; + } + } + exit(x); + break; + case 'z': + switch (optarg[0]) { + case 'a': /* active */ + ctl = VERIEXEC_ACTIVE; + break; + case 'd': /* debug* */ + ctl = (strstr(optarg, "off")) ? + VERIEXEC_DEBUG_OFF : VERIEXEC_DEBUG_ON; + if (optind < argc && ctl == VERIEXEC_DEBUG_ON) { + x = atoi(argv[optind]); + if (x == 0) + ctl = VERIEXEC_DEBUG_OFF; + } + break; + case 'e': /* enforce */ + ctl = VERIEXEC_ENFORCE; + break; + case 'g': + ctl = VERIEXEC_GETSTATE; /* get state */ + break; + case 'l': /* lock */ + ctl = VERIEXEC_LOCK; + break; + default: + errx(EX_USAGE, "unknown command %s", optarg); + break; + } + if (dev_fd < 0) { + err(EX_UNAVAILABLE, "cannot open veriexec"); + } + if (ioctl(dev_fd, ctl, &x)) { + err(EX_UNAVAILABLE, "cannot %s veriexec", optarg); + } + if (ctl == VERIEXEC_DEBUG_ON || + ctl == VERIEXEC_DEBUG_OFF) { + printf("debug is: %d\n", x); + } else if (ctl == VERIEXEC_GETSTATE) { + printf("%#o\n", x); + } + exit(EX_OK); + break; + } + } + openlog(getprogname(), LOG_PID, LOG_AUTH); + if (ve_trust_init() < 1) + errx(EX_OSFILE, "cannot initialize trust store"); +#ifdef VERIEXEC_GETVERSION + if (ioctl(dev_fd, VERIEXEC_GETVERSION, &VeriexecVersion)) { + VeriexecVersion = 0; /* unknown */ + } +#endif + + for (; optind < argc; optind++) { + if (veriexec_load(argv[optind])) { + err(EX_DATAERR, "cannot load %s", argv[optind]); + } + } + exit(EX_OK); +} Property changes on: head/sbin/veriexec/veriexec.c ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property Index: head/sbin/veriexec/veriexec.h =================================================================== --- head/sbin/veriexec/veriexec.h (nonexistent) +++ head/sbin/veriexec/veriexec.h (revision 344567) @@ -0,0 +1,48 @@ +/*- + * Copyright (c) 2018, Juniper Networks, Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ + */ + +#ifndef __VERIEXEC_H__ +#define __VERIEXEC_H__ + +#include +#include + +extern int dev_fd; +extern int parser_version; +extern int ForceFlags; +extern int Verbose; +extern int VeriexecVersion; +extern const char *Cdir; + +#define VERBOSE(n, x) if (Verbose > n) printf x + +FILE * manifest_open (const char *file, const char *file_content); +void manifest_parser_init(void); +int yyparse(void); +extern FILE *yyin; + +#endif Property changes on: head/sbin/veriexec/veriexec.h ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property