Change Details

The current approach of injecting manifest into mac_veriexec is to verify the integrity of it in userspace(veriexec (8)) and pass its entries into kernel using a char device. (/dev/veriexec) This requires verifying root partition integrity in loader, for example by using memory disk and checking its hash. Otherwise if rootfs is compromised an attacker could inject their own data. This patch introduces an option to parse manifest in kernel based on envs. The loader sets manifest path and digest. EVENTHANDLER is used to launch the module right after the rootfs is mounted. It has to be done this way, since one might want to verify integrity of the init file. This means that manifest is required to be present on the root partition. Note that the envs have to be set right before boot to make sure that no one can spoof them. The patch relies on @sjg libsecureboot patches.

The current approach of injecting manifest into mac_veriexec is to verify the integrity of it in userspace(veriexec (8)) and pass its entries into kernel using a char device. (/dev/veriexec) This requires verifying root partition integrity in loader, for example by using memory disk and checking its hash. Otherwise if rootfs is compromised an attacker could inject their own data. This patch introduces an option to parse manifest in kernel based on envs. The loader sets manifest path and digest. EVENTHANDLER is used to launch the module right after the rootfs is mounted. It has to be done this way, since one might want to verify integrity of the init file. This means that manifest is required to be present on the root partition. Note that the envs have to be set right before boot to make sure that no one can spoof them.

The current approach of injecting manifest into mac_veriexec is to verify the integrity of it in userspace(veriexec (8)) and pass its entries into kernel using a char device. (/dev/veriexec) This requires verifying root partition integrity in loader, for example by using memory disk and checking its hash. Otherwise if rootfs is compromised an attacker could inject their own data. This patch introduces an option to parse manifest in kernel based on envs. The loader sets manifest path and digest. EVENTHANDLER is used to launch the module right after the rootfs is mounted. It has to be done this way, since one might want to verify integrity of the init file. This means that manifest is required to be present on the root partition. Note that the envs have to be set right before boot to make sure that no one can spoof them. The patch relies on @sjg libsecureboot patches.