veriexec4

Usage

Overview

The veriexec device is used by veriexec(8) to query and modify the state of mac_veriexec(4).

Once mac_veriexec(4) is active, only a process which is marked as ‘trusted’ (normally only veriexec(8)) is able to more than the VERIEXEC_GETSTATE ioctl.

Ioctls

The supported ioctls are described below.

VERIEXEC_SIGNED_LOAD struct verified_exec_params

Pass file information to mac_veriexec(4).

struct verified_exec_params  {
	unsigned char flags;
	char fp_type[VERIEXEC_FPTYPELEN];	/* type of fingerprint */
	char file[MAXPATHLEN];
	unsigned char fingerprint[MAXFINGERPRINTLEN];
};

VERIEXEC_LABEL_LOAD struct verified_exec_label_params

Pass file information and a label to mac_veriexec(4).

struct verified_exec_label_params  {
	struct verified_exec_params params;
	char label[MAXLABELLEN];
};

VERIEXEC_ACTIVE

VERIEXEC_DEBUG_OFF

VERIEXEC_DEBUG_ON int level

VERIEXEC_ENFORCE

VERIEXEC_GETSTATE

VERIEXEC_GETVERSION

VERIEXEC_LOCK

VERIEXEC_VERIFIED_FILE int fd

Rarely needed. Tells mac_veriexec(4) that the file associated with fd is verified.