en Copyright 2015 Java http://172.16.0.5:8080/history/freebsd-14.2/lib/libveriexec/Makefile#d0b2dbfa Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd-14.2/lib/libveriexec/Makefile Wed, 16 Aug 2023 17:55:03 +0000 Warner Losh <imp@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-14.2/lib/libveriexec/Makefile#8512d82e veriexec: Additional functionality for MAC/veriexecEnsure veriexec opens the file before doing any read operations.When the MAC_VERIEXEC_CHECK_PATH_SYSCALL syscall is requested, veriexecneeds to open the file before calling mac_veriexec_check_vp. This is toensure any set up is done by the file system. Most file systems do notexplicitly need an open, but some (e.g. virtfs) require initializationof access tokens (file identifiers, etc.) before doing any read or writeoperations.The evaluate_fingerprint() function needs to ensure it has an open filefor reading in order to evaluate the fingerprint. The ideal solution isto have a hook after the VOP_OPEN call in vn_open. For now, we open thefile for reading, envaluate the fingerprint, and close the file. Whilethis leaves a potential hole that could possibly be taken advantage ofby a dedicated aversary, this code path is not typically visited oftenin our use cases, as we primarily encounter verified mounts and notindividual files. This should be considered a temporary workaround untildiscussions about the post-open hook have concluded and the hook becomesavailable.Add MAC_VERIEXEC_GET_PARAMS_PATH_SYSCALL andMAC_VERIEXEC_GET_PARAMS_PID_SYSCALL to mac_veriexec_syscall so we canfetch and check label contents in an unconstrained manner.Add a check for PRIV_VERIEXEC_CONTROL to do ioctl on /dev/veriexecMake it clear that trusted process cannot be debugged. Attempts to debuga trusted process already fail, but the failure path is very obscure.Add an explicit check for VERIEXEC_TRUSTED inmac_veriexec_proc_check_debug.We need mac_veriexec_priv_check to not block PRIV_KMEM_WRITE ifmac_priv_gant() says it is ok.Reviewed by: sjgObtained from: Juniper Networks, Inc. List of files: /freebsd-14.2/lib/libveriexec/Makefile Sun, 02 Apr 2023 19:33:10 +0000 Steve Kiernan <stevek@juniper.net> http://172.16.0.5:8080/history/freebsd-14.2/lib/libveriexec/Makefile#5ea556d9 Do not claim libbearssl et al are INTERNALLIBIf INTERNALLIB is defined we need PIE and bsd.incs.mk isnot included.PR: 245189Reviewed by: emasteMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org//D24233 List of files: /freebsd-14.2/lib/libveriexec/Makefile Wed, 01 Apr 2020 05:45:12 +0000 Simon J. Gerraty <sjg@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-14.2/lib/libveriexec/Makefile#b6b5dcf2 This library allows for user space applications to check file descriptorsor paths to see if they can be verified by MAC/veriexec.Reviewed by: jtl, wblockObtained from: Juniper Networks, Inc.Differential Revision: https://reviews.freebsd.org/D8562 List of files: /freebsd-14.2/lib/libveriexec/Makefile Wed, 20 Jun 2018 00:55:18 +0000 Stephen J. Kiernan <stevek@FreeBSD.org>