sys: Remove $FreeBSD$: one-line .c patternRemove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
mac_veriexec_parser: fix build after 7e1d3eefd410.Sponsored by: Klara, Inc.
vfs: NDFREE(&nd, NDF_ONLY_PNBUF) -> NDFREE_PNBUF(&nd)
security: clean up empty lines in .c and .h files
vfs: drop the mostly unused flags argument from VOP_UNLOCKFilesystems which want to use it in limited capacity can employ theVOP_UNLOCK_FLAGS macro.Reviewed by: kib (previous version)Differenti
vfs: drop the mostly unused flags argument from VOP_UNLOCKFilesystems which want to use it in limited capacity can employ theVOP_UNLOCK_FLAGS macro.Reviewed by: kib (previous version)Differential Revision: https://reviews.freebsd.org/D21427
show more ...
Fix mac_veriexec_parser build after r347938In r347938 the definition of mac_veriexec_metadata_add_fileso adjust the argument list accordingly.Submitted by: Kornel Duleba <[email protected]>
Create kernel module to parse Veriexec manifest based on envsThe current approach of injecting manifest into mac_veriexec is toverify the integrity of it in userspace (veriexec (8)) and pass itse
Create kernel module to parse Veriexec manifest based on envsThe current approach of injecting manifest into mac_veriexec is toverify the integrity of it in userspace (veriexec (8)) and pass itsentries into kernel using a char device (/dev/veriexec).This requires verifying root partition integrity in loader,for example by using memory disk and checking its hash.Otherwise if rootfs is compromised an attacker could inject their own data.This patch introduces an option to parse manifest in kernel based on envs.The loader sets manifest path and digest.EVENTHANDLER is used to launch the module right after the rootfs is mounted.It has to be done this way, since one might want to verify integrity of the init file.This means that manifest is required to be present on the root partition.Note that the envs have to be set right before boot to make sure that no one can spoof them.Submitted by: Kornel Duleba <[email protected]>Reviewed by: sjgObtained from: SemihalfSponsored by: StormshieldDifferential Revision: https://reviews.freebsd.org/D19281