VERIEXEC(8)

NAME
veriexec - manipulate state of mac_veriexec

SYNOPSIS
veriexec [-v] [-C directory] [-S] manifest
veriexec -z state
veriexec -i state
veriexec -l file ...
veriexec -x file ...

DESCRIPTION
veriexec is a utility to query or manipulate the state of mac_veriexec(4).

The first form is for loading a manifest. veriexec first verifies a digital signature of the manifest and if successful, parses it and feeds its content to kernel. The -S flag indicates that certificate validity should be checked. Without this, a valid signature with an expired certificate will still be accepted.

The second form with -z is used to modify the state, and with -i to query the current state.

With -l veriexec will report any labels associated with the remaining arguments assumed to be files. If only a single file argument is given, the bare label (if any) will be reported, otherwise the pathname followed by label.

The final form with -x is used to test whether file is verified or not. This requires mac_veriexec(4) to be in the ‘active’ or ‘enforce’ state.

The possible states are:

loaded
    set automatically when the first manifest has been loaded.

active
    mac_veriexec(4) will begin checking files. This state can only be entered from the loaded state.

enforce
    mac_veriexec(4) will fail attempts to execve(2) or open(2) files with O_VERIFY unless verified.

locked
    prevent loading of any more manifests.

When setting or querying the state, it is sufficient to provide a unique prefix of the desired state. So -i a or -z e are sufficient, but -i loc is the minimum required to avoid confusion with loaded.

MANIFESTS
The manifest contains a mapping of relative pathnames to fingerprints with optional flags. For example:

    sbin/veriexec sha256=f22136...c0ff71 no_ptrace trusted
    usr/bin/python sha256=5944d9...876525 indirect
    sbin/somedaemon sha256=77fc2f...63f5687 label=mod1/val1,mod2/val2

The supported flags are:

‘indirect’
    the executable cannot be run directly, but can be used as an interpreter for example via:

        #!/usr/bin/python

‘no_fips’
    If the system has a notion of running in FIPS mode, a file marked with this flag will not be allowed to exec.

‘no_ptrace’
    do not allow running executable under a debugger. Useful for any application critical to the security state of system.

‘trusted’
    this flag is required for a process to use veriexec(4) to interact with mac_veriexec(4). Generally only veriexec should need this flag. Implies ‘no_ptrace’.

The ‘label’ argument allows associating a maclabel(7) with a file. Neither veriexec nor mac_veriexec(4) (if it supports labels) pay any attention to the content of the label they are provided for the use of other mac(4) modules or indeed other applications.

EXAMPLES
Load the manifest for a tarfs(5) package mounted on /mnt and be strict about enforcing certificate validity:

    # veriexec -S -C /mnt /mnt/manifest

veriexec will look for a detached signature that it recognizes, such as manifest.asc (OpenPGP) or manifest.*sig (X.509). In the case of an X.509 signature we also need a matching certificate chain manifest.*certs. In either case there needs to be a suitable trust anchor in the trust store.

We can now activate:

    # veriexec -z active

Any user can check if mac_veriexec(4) is ‘active’:

    $ veriexec -i active

Any user can check that /mnt/bin/app is verified:

    $ veriexec -x /mnt/bin/app

If it is not, we will get an Authentiaction error, but unless mac_veriexec(4) is enforcing we would still be able to run it.

NOTES
It is only safe to set mac_veriexec(4) to ‘enforce’ state, if sufficient manifests have been loaded to cover all the applications that might need to be run.

HISTORY
The Verified Exec system first appeared in NetBSD. This utility derives from the one found in Junos, which requires that manifest files be digitally signed.