1eb12b8eaSSimon J. Gerraty.\"- 21554ba03SSimon J. Gerraty.\" SPDX-License-Identifier: BSD-2-Clause 31554ba03SSimon J. Gerraty.\" 4*b77f6185SSimon J. Gerraty.\" Copyright (c) 2018-2024, Juniper Networks, Inc. 5eb12b8eaSSimon J. Gerraty.\" 6eb12b8eaSSimon J. Gerraty.\" Redistribution and use in source and binary forms, with or without 7eb12b8eaSSimon J. Gerraty.\" modification, are permitted provided that the following conditions 8eb12b8eaSSimon J. Gerraty.\" are met: 9eb12b8eaSSimon J. Gerraty.\" 1. Redistributions of source code must retain the above copyright 10eb12b8eaSSimon J. Gerraty.\" notice, this list of conditions and the following disclaimer. 11eb12b8eaSSimon J. Gerraty.\" 2. Redistributions in binary form must reproduce the above copyright 12eb12b8eaSSimon J. Gerraty.\" notice, this list of conditions and the following disclaimer in the 13eb12b8eaSSimon J. Gerraty.\" documentation and/or other materials provided with the distribution. 14eb12b8eaSSimon J. Gerraty.\" 15eb12b8eaSSimon J. Gerraty.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16eb12b8eaSSimon J. Gerraty.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17eb12b8eaSSimon J. Gerraty.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 18eb12b8eaSSimon J. Gerraty.\" A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 19eb12b8eaSSimon J. Gerraty.\" OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 20eb12b8eaSSimon J. Gerraty.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 21eb12b8eaSSimon J. Gerraty.\" LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22eb12b8eaSSimon J. Gerraty.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23eb12b8eaSSimon J. Gerraty.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24eb12b8eaSSimon J. Gerraty.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 25eb12b8eaSSimon J. Gerraty.\" OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26eb12b8eaSSimon J. Gerraty.\" 27*b77f6185SSimon J. Gerraty.Dd August 1, 2024 28eb12b8eaSSimon J. Gerraty.Dt VERIEXEC 8 29eb12b8eaSSimon J. Gerraty.Os 30eb12b8eaSSimon J. Gerraty.Sh NAME 31eb12b8eaSSimon J. Gerraty.Nm veriexec 32eb12b8eaSSimon J. Gerraty.Nd manipulate state of mac_veriexec 33eb12b8eaSSimon J. Gerraty.Sh SYNOPSIS 34eb12b8eaSSimon J. Gerraty.Nm 35eb12b8eaSSimon J. Gerraty.Op Fl v 36eb12b8eaSSimon J. Gerraty.Op Fl C Ar directory 37ab4f0a15SSimon J. Gerraty.Op Fl S 38eb12b8eaSSimon J. Gerraty.Pa manifest 39eb12b8eaSSimon J. Gerraty.Nm 40eb12b8eaSSimon J. Gerraty.Fl z Ar state 41eb12b8eaSSimon J. Gerraty.Nm 42eb12b8eaSSimon J. Gerraty.Fl i Ar state 43eb12b8eaSSimon J. Gerraty.Nm 441554ba03SSimon J. Gerraty.Fl l 451554ba03SSimon J. Gerraty.Ar file ... 461554ba03SSimon J. Gerraty.Nm 47eb12b8eaSSimon J. Gerraty.Fl x 48eb12b8eaSSimon J. Gerraty.Ar file ... 49eb12b8eaSSimon J. Gerraty.Sh DESCRIPTION 50eb12b8eaSSimon J. Gerraty.Nm 51eb12b8eaSSimon J. Gerratyis a utility to query or manipulate the state of 52eb12b8eaSSimon J. Gerraty.Xr mac_veriexec 4 . 53eb12b8eaSSimon J. Gerraty.Pp 54eb12b8eaSSimon J. GerratyThe first form is for loading a 55eb12b8eaSSimon J. Gerraty.Pa manifest . 56eb12b8eaSSimon J. Gerraty.Nm 57eb12b8eaSSimon J. Gerratyfirst verifies a digital signature of the 58eb12b8eaSSimon J. Gerraty.Ar manifest 59eb12b8eaSSimon J. Gerratyand if successful, parses it and feeds its content to kernel. 60ab4f0a15SSimon J. GerratyThe 61ab4f0a15SSimon J. Gerraty.Fl S 62ab4f0a15SSimon J. Gerratyflag indicates that certificate validity should be checked. 63ab4f0a15SSimon J. GerratyWithout this, a valid signature with an expired certificate 64ab4f0a15SSimon J. Gerratywill still be accepted. 65eb12b8eaSSimon J. Gerraty.Pp 66eb12b8eaSSimon J. GerratyThe second form with 67eb12b8eaSSimon J. Gerraty.Fl z 68eb12b8eaSSimon J. Gerratyis used to modify the 69eb12b8eaSSimon J. Gerraty.Ar state , 70eb12b8eaSSimon J. Gerratyand with 71eb12b8eaSSimon J. Gerraty.Fl i 72eb12b8eaSSimon J. Gerratyto query the current 73eb12b8eaSSimon J. Gerraty.Ar state . 74eb12b8eaSSimon J. Gerraty.Pp 751554ba03SSimon J. GerratyWith 761554ba03SSimon J. Gerraty.Fl l 771554ba03SSimon J. Gerraty.Nm 781554ba03SSimon J. Gerratywill report any labels associated with the remaining arguments 791554ba03SSimon J. Gerratyassumed to be files. 801554ba03SSimon J. GerratyIf only a single file argument is given, the bare label (if any) 811554ba03SSimon J. Gerratywill be reported, otherwise the pathname followed by label. 821554ba03SSimon J. Gerraty.Pp 83eb12b8eaSSimon J. GerratyThe final form with 84eb12b8eaSSimon J. Gerraty.Fl x 85eb12b8eaSSimon J. Gerratyis used to test whether 86eb12b8eaSSimon J. Gerraty.Ar file 87eb12b8eaSSimon J. Gerratyis verified or not. 88eb12b8eaSSimon J. GerratyThis requires 89eb12b8eaSSimon J. Gerraty.Xr mac_veriexec 4 90eb12b8eaSSimon J. Gerratyto be in the 91eb12b8eaSSimon J. Gerraty.Ql active 92eb12b8eaSSimon J. Gerratyor 93eb12b8eaSSimon J. Gerraty.Ql enforce 94eb12b8eaSSimon J. Gerratystate. 95eb12b8eaSSimon J. Gerraty.Pp 96eb12b8eaSSimon J. GerratyThe possible states 97eb12b8eaSSimon J. Gerratyare: 98eb12b8eaSSimon J. Gerraty.Bl -tag -width enforce 99eb12b8eaSSimon J. Gerraty.It Ar loaded 100*b77f6185SSimon J. Gerratyset automatically when the first 101eb12b8eaSSimon J. Gerraty.Pa manifest 102eb12b8eaSSimon J. Gerratyhas been loaded. 103eb12b8eaSSimon J. Gerraty.It Ar active 104eb12b8eaSSimon J. Gerraty.Xr mac_veriexec 4 105eb12b8eaSSimon J. Gerratywill begin checking files. 106eb12b8eaSSimon J. GerratyThis state can only be entered from the 107eb12b8eaSSimon J. Gerraty.Ar loaded 108eb12b8eaSSimon J. Gerratystate. 109eb12b8eaSSimon J. Gerraty.It Ar enforce 110eb12b8eaSSimon J. Gerraty.Xr mac_veriexec 4 111eb12b8eaSSimon J. Gerratywill fail attempts to 112eb12b8eaSSimon J. Gerraty.Xr exec 2 113eb12b8eaSSimon J. Gerratyor 114eb12b8eaSSimon J. Gerraty.Xr open 2 115eb12b8eaSSimon J. Gerratyfiles with 116eb12b8eaSSimon J. Gerraty.Dv O_VERIFY 117eb12b8eaSSimon J. Gerratyunless verified. 118eb12b8eaSSimon J. Gerraty.It Ar locked 119eb12b8eaSSimon J. Gerratyprevent loading of any more manifests. 120eb12b8eaSSimon J. Gerraty.El 121a8189e9bSSimon J. Gerraty.Pp 122a8189e9bSSimon J. GerratyWhen setting or querying the state, it is sufficient to provide 123a8189e9bSSimon J. Gerratya unique prefix of the desired state. 124a8189e9bSSimon J. GerratySo 125a8189e9bSSimon J. Gerraty.Fl i 126a8189e9bSSimon J. Gerraty.Ar a 127a8189e9bSSimon J. Gerratyor 128a8189e9bSSimon J. Gerraty.Fl z 129a8189e9bSSimon J. Gerraty.Ar e 130a8189e9bSSimon J. Gerratyare sufficient, but 131a8189e9bSSimon J. Gerraty.Fl i 132a8189e9bSSimon J. Gerraty.Ar loc 133a8189e9bSSimon J. Gerratyis the minimum required to avoid confusion with 134a8189e9bSSimon J. Gerraty.Ar loaded . 135eb12b8eaSSimon J. Gerraty.Sh MANIFESTS 136eb12b8eaSSimon J. GerratyThe manifest contains a mapping of relative pathnames to fingerprints 137eb12b8eaSSimon J. Gerratywith optional flags. 138eb12b8eaSSimon J. GerratyFor example: 139eb12b8eaSSimon J. Gerraty.Bd -literal -offset indent 140*b77f6185SSimon J. Gerratysbin/veriexec sha256=f22136...c0ff71 no_ptrace trusted 141eb12b8eaSSimon J. Gerratyusr/bin/python sha256=5944d9...876525 indirect 142eb12b8eaSSimon J. Gerratysbin/somedaemon sha256=77fc2f...63f5687 label=mod1/val1,mod2/val2 143eb12b8eaSSimon J. Gerraty.Ed 144*b77f6185SSimon J. Gerraty.Pp 145eb12b8eaSSimon J. GerratyThe supported flags are: 146eb12b8eaSSimon J. Gerraty.Bl -tag -width indirect 147eb12b8eaSSimon J. Gerraty.It Ql indirect 148eb12b8eaSSimon J. Gerratythe executable cannot be run directly, 149eb12b8eaSSimon J. Gerratybut can be used as an interpreter for example via: 150eb12b8eaSSimon J. Gerraty.Bd -literal -offset indent 151eb12b8eaSSimon J. Gerraty#!/usr/bin/python 152eb12b8eaSSimon J. Gerraty.Ed 153*b77f6185SSimon J. Gerraty.It Ql no_fips 154*b77f6185SSimon J. GerratyIf the system has a notion of running in FIPS mode, 155*b77f6185SSimon J. Gerratya file marked with this flag will not be allowed to 156*b77f6185SSimon J. Gerratyexec. 157eb12b8eaSSimon J. Gerraty.It Ql no_ptrace 158eb12b8eaSSimon J. Gerratydo not allow running executable under a debugger. 159eb12b8eaSSimon J. GerratyUseful for any application critical to the security state of system. 160*b77f6185SSimon J. Gerraty.It Ql trusted 161*b77f6185SSimon J. Gerratythis flag is required for a process to use 162*b77f6185SSimon J. Gerraty.Xr veriexec 4 163*b77f6185SSimon J. Gerratyto interact with 164*b77f6185SSimon J. Gerraty.Xr mac_veriexec 4 . 165*b77f6185SSimon J. GerratyGenerally only 166*b77f6185SSimon J. Gerraty.Nm 167*b77f6185SSimon J. Gerratyshould need this flag. 168*b77f6185SSimon J. GerratyImplies 169*b77f6185SSimon J. Gerraty.Ql no_ptrace . 170*b77f6185SSimon J. Gerraty 171eb12b8eaSSimon J. Gerraty.El 172eb12b8eaSSimon J. Gerraty.Pp 173eb12b8eaSSimon J. GerratyThe 174eb12b8eaSSimon J. Gerraty.Ql label 175eb12b8eaSSimon J. Gerratyargument allows associating a 176eb12b8eaSSimon J. Gerraty.Xr maclabel 7 177*b77f6185SSimon J. Gerratywith a file. 178eb12b8eaSSimon J. GerratyNeither 179eb12b8eaSSimon J. Gerraty.Nm 180eb12b8eaSSimon J. Gerratynor 181eb12b8eaSSimon J. Gerraty.Xr mac_veriexec 4 182eb12b8eaSSimon J. Gerraty(if it supports labels) 183eb12b8eaSSimon J. Gerratypay any attention to the content of the label 184eb12b8eaSSimon J. Gerratythey are provided for the use of other 185eb12b8eaSSimon J. Gerraty.Xr mac 4 186*b77f6185SSimon J. Gerratymodules or indeed other applications. 187*b77f6185SSimon J. Gerraty.Sh EXAMPLES 188*b77f6185SSimon J. GerratyLoad the manifest for a 189*b77f6185SSimon J. Gerraty.Xr tarfs 5 190*b77f6185SSimon J. Gerratypackage mounted on 191*b77f6185SSimon J. Gerraty.Pa /mnt 192*b77f6185SSimon J. Gerratyand be strict about enforcing certificate validity: 193*b77f6185SSimon J. Gerraty.Bd -literal -offset indent 194*b77f6185SSimon J. Gerraty# veriexec -S -C /mnt /mnt/manifest 195*b77f6185SSimon J. Gerraty 196*b77f6185SSimon J. Gerraty.Ed 197*b77f6185SSimon J. Gerraty.Nm 198*b77f6185SSimon J. Gerratywill look for a detatched signature that it recognizes, such as 199*b77f6185SSimon J. Gerraty.Pa manifest.asc 200*b77f6185SSimon J. Gerraty(OpenPGP) or 201*b77f6185SSimon J. Gerraty.Pa manifest.*sig 202*b77f6185SSimon J. Gerraty(X.509). 203*b77f6185SSimon J. GerratyIn the case of an X.509 signature we also need a matching certificate chain 204*b77f6185SSimon J. Gerraty.Pa manifest.*certs . 205*b77f6185SSimon J. GerratyIn either case there needs to be a suitable trust anchor in the trust store. 206*b77f6185SSimon J. Gerraty.Pp 207*b77f6185SSimon J. GerratyWe can now activate: 208*b77f6185SSimon J. Gerraty.Bd -literal -offset indent 209*b77f6185SSimon J. Gerraty# veriexec -z active 210*b77f6185SSimon J. Gerraty 211*b77f6185SSimon J. Gerraty.Ed 212*b77f6185SSimon J. GerratyAny user can check if 213*b77f6185SSimon J. Gerraty.Xr mac_veriexec 4 214*b77f6185SSimon J. Gerratyis 215*b77f6185SSimon J. Gerraty.Ql active : 216*b77f6185SSimon J. Gerraty.Bd -literal -offset indent 217*b77f6185SSimon J. Gerraty$ veriexec -i active 218*b77f6185SSimon J. Gerraty 219*b77f6185SSimon J. Gerraty.Ed 220*b77f6185SSimon J. GerratyAny user can check that 221*b77f6185SSimon J. Gerraty.Pa /mnt/bin/app 222*b77f6185SSimon J. Gerratyis verified: 223*b77f6185SSimon J. Gerraty.Bd -literal -offset indent 224*b77f6185SSimon J. Gerraty$ veriexec -x /mnt/bin/app 225*b77f6185SSimon J. Gerraty 226*b77f6185SSimon J. Gerraty.Ed 227*b77f6185SSimon J. GerratyIf it is not, we will get an Authentiaction error, 228*b77f6185SSimon J. Gerratybut unless 229*b77f6185SSimon J. Gerraty.Xr mac_veriexec 4 230*b77f6185SSimon J. Gerratyis enforcing we would still be able to run it. 231*b77f6185SSimon J. Gerraty.Sh NOTES 232*b77f6185SSimon J. GerratyIt is only safe to set 233*b77f6185SSimon J. Gerraty.Xr mac_veriexec 4 234*b77f6185SSimon J. Gerratyto 235*b77f6185SSimon J. Gerraty.Ql enforce 236*b77f6185SSimon J. Gerratystate, if sufficient manifests have been loaded 237*b77f6185SSimon J. Gerratyto cover all the applications that might need to be run. 238eb12b8eaSSimon J. Gerraty.Sh HISTORY 23939dd0ed9SGordon BerglingThe Verified Exec system first appeared in 24039dd0ed9SGordon Bergling.Nx . 241*b77f6185SSimon J. GerratyThis utility derives from the one found in Junos, 242*b77f6185SSimon J. Gerratywhich requires that manifest files be digitally signed. 243