VERIEXEC(4)

NAME
veriexec - the veriexec device

SYNOPSIS
#include <dev/veriexec/veriexec_ioctl.h>

DESCRIPTION
The veriexec device is used by veriexec(8) to query and modify the state of mac_veriexec(4).

Once mac_veriexec(4) is active, only a process which is marked as ‘trusted’ (normally only veriexec(8)) is able to more than the VERIEXEC_GETSTATE ioctl.

IOCTLS
The supported ioctls are described below.

VERIEXEC_SIGNED_LOAD struct verified_exec_params
    Pass file information to mac_veriexec(4).

        struct verified_exec_params  {
        	unsigned char flags;
        	char fp_type[VERIEXEC_FPTYPELEN];	/* type of fingerprint */
        	char file[MAXPATHLEN];
        	unsigned char fingerprint[MAXFINGERPRINTLEN];
        };

VERIEXEC_LABEL_LOAD struct verified_exec_label_params
    Pass file information and a label to mac_veriexec(4).

        struct verified_exec_label_params  {
        	struct verified_exec_params params;
        	char label[MAXLABELLEN];
        };

VERIEXEC_ACTIVE

VERIEXEC_DEBUG_OFF

VERIEXEC_DEBUG_ON int level

VERIEXEC_ENFORCE

VERIEXEC_GETSTATE

VERIEXEC_GETVERSION

VERIEXEC_LOCK

VERIEXEC_VERIFIED_FILE int fd
    Rarely needed. Tells mac_veriexec(4) that the file associated with fd is verified.

HISTORY
A veriexec device first appeared in NetBSD. It was added to FreeBSD 13.1.