src/sys/security/mac_veriexec_parser, branch main

mac_veriexec_parser: Fix open_file error handling

2024-09-20T15:22:56Z

NDFREE_PNBUF should be called after checking the return value of vn_open(), and should only be called once. Reviewed by: imp, zlei, Kornel Dulęba , Elliott Mitchell Pull Request: https://github.com/freebsd/freebsd-src/pull/1338

sys: Automated cleanup of cdefs and other formatting

2023-11-27T05:24:00Z

Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+.*\n/ Remove /\n+#include\s+.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+\n#include\s+/ Remove /\n+#include\s+\n#include\s+/ Remove /\n+#include\s+\n#include\s+/ Sponsored by: Netflix

sys: Remove $FreeBSD$: one-line .c pattern

2023-08-16T17:54:36Z

Remove /^[\s*]*__FBSDID$"\$FreeBSD\$"$;?\s*\n/

mac_veriexec_parser: fix build after 7e1d3eefd410.

2022-09-09T12:09:08Z

vfs: NDFREE(&nd, NDF_ONLY_PNBUF) -> NDFREE_PNBUF(&nd)

2022-03-24T10:20:51Z

security: clean up empty lines in .c and .h files

2020-09-01T21:26:00Z

vfs: drop the mostly unused flags argument from VOP_UNLOCK

2020-01-03T22:29:58Z

Filesystems which want to use it in limited capacity can employ the VOP_UNLOCK_FLAGS macro. Reviewed by: kib (previous version) Differential Revision: https://reviews.freebsd.org/D21427

Fix mac_veriexec_parser build after r347938

2019-08-08T16:51:49Z

In r347938 the definition of mac_veriexec_metadata_add_file so adjust the argument list accordingly. Submitted by: Kornel Duleba

Create kernel module to parse Veriexec manifest based on envs

2019-04-03T03:57:37Z

The current approach of injecting manifest into mac_veriexec is to verify the integrity of it in userspace (veriexec (8)) and pass its entries into kernel using a char device (/dev/veriexec). This requires verifying root partition integrity in loader, for example by using memory disk and checking its hash. Otherwise if rootfs is compromised an attacker could inject their own data. This patch introduces an option to parse manifest in kernel based on envs. The loader sets manifest path and digest. EVENTHANDLER is used to launch the module right after the rootfs is mounted. It has to be done this way, since one might want to verify integrity of the init file. This means that manifest is required to be present on the root partition. Note that the envs have to be set right before boot to make sure that no one can spoof them. Submitted by: Kornel Duleba Reviewed by: sjg Obtained from: Semihalf Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D19281