1ed7b25daSStephen J. Kiernan /* 2ed7b25daSStephen J. Kiernan * 38512d82eSSteve Kiernan * Copyright (c) 2011-2023, Juniper Networks, Inc. 4ed7b25daSStephen J. Kiernan * All rights reserved. 5ed7b25daSStephen J. Kiernan * 6ed7b25daSStephen J. Kiernan * Redistribution and use in source and binary forms, with or without 7ed7b25daSStephen J. Kiernan * modification, are permitted provided that the following conditions 8ed7b25daSStephen J. Kiernan * are met: 9ed7b25daSStephen J. Kiernan * 1. Redistributions of source code must retain the above copyright 10ed7b25daSStephen J. Kiernan * notice, this list of conditions and the following disclaimer. 11ed7b25daSStephen J. Kiernan * 2. Redistributions in binary form must reproduce the above copyright 12ed7b25daSStephen J. Kiernan * notice, this list of conditions and the following disclaimer in the 13ed7b25daSStephen J. Kiernan * documentation and/or other materials provided with the distribution. 14ed7b25daSStephen J. Kiernan * 15ed7b25daSStephen J. Kiernan * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16ed7b25daSStephen J. Kiernan * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17ed7b25daSStephen J. Kiernan * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18ed7b25daSStephen J. Kiernan * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19ed7b25daSStephen J. Kiernan * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20ed7b25daSStephen J. Kiernan * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21ed7b25daSStephen J. Kiernan * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 22ed7b25daSStephen J. Kiernan * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23ed7b25daSStephen J. Kiernan * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24ed7b25daSStephen J. Kiernan * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25ed7b25daSStephen J. Kiernan * SUCH DAMAGE. 26ed7b25daSStephen J. Kiernan */ 27ed7b25daSStephen J. Kiernan 28ed7b25daSStephen J. Kiernan /* 29ed7b25daSStephen J. Kiernan * 30ed7b25daSStephen J. Kiernan * Definitions for the Verified Executables kernel function. 31ed7b25daSStephen J. Kiernan * 32ed7b25daSStephen J. Kiernan */ 33ed7b25daSStephen J. Kiernan #ifndef _DEV_VERIEXEC_VERIEXEC_IOCTL_H 34ed7b25daSStephen J. Kiernan #define _DEV_VERIEXEC_VERIEXEC_IOCTL_H 35ed7b25daSStephen J. Kiernan 36ed7b25daSStephen J. Kiernan #include <security/mac_veriexec/mac_veriexec.h> 37ed7b25daSStephen J. Kiernan 38bd4742c9SSteve Kiernan /* for backwards compatability */ 39bd4742c9SSteve Kiernan struct verified_exec_params32 { 40bd4742c9SSteve Kiernan unsigned char flags; 41bd4742c9SSteve Kiernan char fp_type[VERIEXEC_FPTYPELEN]; /* type of fingerprint */ 42bd4742c9SSteve Kiernan char file[MAXPATHLEN]; 43bd4742c9SSteve Kiernan unsigned char fingerprint[32]; 44bd4742c9SSteve Kiernan }; 45bd4742c9SSteve Kiernan 46ed7b25daSStephen J. Kiernan struct verified_exec_params { 47ed7b25daSStephen J. Kiernan unsigned char flags; 48ed7b25daSStephen J. Kiernan char fp_type[VERIEXEC_FPTYPELEN]; /* type of fingerprint */ 49ed7b25daSStephen J. Kiernan char file[MAXPATHLEN]; 50ed7b25daSStephen J. Kiernan unsigned char fingerprint[MAXFINGERPRINTLEN]; 51ed7b25daSStephen J. Kiernan }; 52ed7b25daSStephen J. Kiernan 5394288674SStephen J. Kiernan struct verified_exec_label_params { 5494288674SStephen J. Kiernan struct verified_exec_params params; 5594288674SStephen J. Kiernan char label[MAXLABELLEN]; 5694288674SStephen J. Kiernan }; 5794288674SStephen J. Kiernan 58ed7b25daSStephen J. Kiernan #define VERIEXEC_LOAD _IOW('S', 0x1, struct verified_exec_params) 59ed7b25daSStephen J. Kiernan #define VERIEXEC_ACTIVE _IO('S', 0x2) /* start checking */ 60ed7b25daSStephen J. Kiernan #define VERIEXEC_ENFORCE _IO('S', 0x3) /* fail exec */ 61ed7b25daSStephen J. Kiernan #define VERIEXEC_LOCK _IO('S', 0x4) /* don't allow new sigs */ 62ed7b25daSStephen J. Kiernan #define VERIEXEC_DEBUG_ON _IOWR('S', 0x5, int) /* set/get debug level */ 63ed7b25daSStephen J. Kiernan #define VERIEXEC_DEBUG_OFF _IO('S', 0x6) /* reset debug */ 64ed7b25daSStephen J. Kiernan #define VERIEXEC_GETSTATE _IOR('S', 0x7, int) /* get state */ 65bd4742c9SSteve Kiernan #define VERIEXEC_SIGNED_LOAD32 _IOW('S', 0x8, struct verified_exec_params32) 66*a1575a98SSimon J. Gerraty #define VERIEXEC_VERIFIED_FILE _IOW('S', 0x9, int) /* fd */ 67bd4742c9SSteve Kiernan #define VERIEXEC_GETVERSION _IOR('S', 0xa, int) /* get version */ 68bd4742c9SSteve Kiernan #define VERIEXEC_LABEL_LOAD _IOW('S', 0xb, struct verified_exec_label_params) 69bd4742c9SSteve Kiernan #define VERIEXEC_SIGNED_LOAD _IOW('S', 0xc, struct verified_exec_params) 70ed7b25daSStephen J. Kiernan 71ed7b25daSStephen J. Kiernan #define _PATH_DEV_VERIEXEC _PATH_DEV "veriexec" 72ed7b25daSStephen J. Kiernan 73ed7b25daSStephen J. Kiernan #endif 74