freebsd-src/lib/libveriexec/Makefile


.include <src.opts.mk>

LIB=		veriexec
MAN=		veriexec.3
INCS=		libveriexec.h

WARNS?=		2

SRCS= \
	exec_script.c \
	gbl_check.c \
	veriexec_check.c \
	veriexec_get.c \

.include <bsd.lib.mk>
This library allows for user space applications to check file descriptors or paths to see if they can be verified by MAC/veriexec. Reviewed by: jtl, wblock Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D8562 2018-06-20 00:55:18 +00:00
Do not claim libbearssl et al are INTERNALLIB If INTERNALLIB is defined we need PIE and bsd.incs.mk is not included. PR: 245189 Reviewed by: emaste MFC after: 1 week Differential Revision: https://reviews.freebsd.org//D24233 2020-04-01 05:45:12 +00:00			`.include <src.opts.mk>`
This library allows for user space applications to check file descriptors or paths to see if they can be verified by MAC/veriexec. Reviewed by: jtl, wblock Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D8562 2018-06-20 00:55:18 +00:00
			`LIB= veriexec`
			`MAN= veriexec.3`
			`INCS= libveriexec.h`

			`WARNS?= 2`

veriexec: Additional functionality for MAC/veriexec Ensure veriexec opens the file before doing any read operations. When the MAC_VERIEXEC_CHECK_PATH_SYSCALL syscall is requested, veriexec needs to open the file before calling mac_veriexec_check_vp. This is to ensure any set up is done by the file system. Most file systems do not explicitly need an open, but some (e.g. virtfs) require initialization of access tokens (file identifiers, etc.) before doing any read or write operations. The evaluate_fingerprint() function needs to ensure it has an open file for reading in order to evaluate the fingerprint. The ideal solution is to have a hook after the VOP_OPEN call in vn_open. For now, we open the file for reading, envaluate the fingerprint, and close the file. While this leaves a potential hole that could possibly be taken advantage of by a dedicated aversary, this code path is not typically visited often in our use cases, as we primarily encounter verified mounts and not individual files. This should be considered a temporary workaround until discussions about the post-open hook have concluded and the hook becomes available. Add MAC_VERIEXEC_GET_PARAMS_PATH_SYSCALL and MAC_VERIEXEC_GET_PARAMS_PID_SYSCALL to mac_veriexec_syscall so we can fetch and check label contents in an unconstrained manner. Add a check for PRIV_VERIEXEC_CONTROL to do ioctl on /dev/veriexec Make it clear that trusted process cannot be debugged. Attempts to debug a trusted process already fail, but the failure path is very obscure. Add an explicit check for VERIEXEC_TRUSTED in mac_veriexec_proc_check_debug. We need mac_veriexec_priv_check to not block PRIV_KMEM_WRITE if mac_priv_gant() says it is ok. Reviewed by: sjg Obtained from: Juniper Networks, Inc. 2023-04-02 19:33:10 +00:00			`SRCS= \`
Add mac_grantbylabel This module allows controlled privilege escallation via mac labels securely associated with a process via mac_veriexec. There are over 700 PRIV_* but we can compress many of them into a single GBL_* thus constraining the size of gbl labels. The goal is to allow a daemon to run as an unprivileged process while still being able a set of privileged operations needed. We add APIs to libveriexec so that userland processes can check labels and an exec_script API that allows a suitably labeled process to run something like a python interpreter directly if necessary; overcomming the 'indirect' flag applied to the interpreter. Add -l option to sbin/veriexec to report labels. Reviewed by: stevek Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D41431 2023-08-25 00:41:22 +00:00			`exec_script.c \`
			`gbl_check.c \`
veriexec: Additional functionality for MAC/veriexec Ensure veriexec opens the file before doing any read operations. When the MAC_VERIEXEC_CHECK_PATH_SYSCALL syscall is requested, veriexec needs to open the file before calling mac_veriexec_check_vp. This is to ensure any set up is done by the file system. Most file systems do not explicitly need an open, but some (e.g. virtfs) require initialization of access tokens (file identifiers, etc.) before doing any read or write operations. The evaluate_fingerprint() function needs to ensure it has an open file for reading in order to evaluate the fingerprint. The ideal solution is to have a hook after the VOP_OPEN call in vn_open. For now, we open the file for reading, envaluate the fingerprint, and close the file. While this leaves a potential hole that could possibly be taken advantage of by a dedicated aversary, this code path is not typically visited often in our use cases, as we primarily encounter verified mounts and not individual files. This should be considered a temporary workaround until discussions about the post-open hook have concluded and the hook becomes available. Add MAC_VERIEXEC_GET_PARAMS_PATH_SYSCALL and MAC_VERIEXEC_GET_PARAMS_PID_SYSCALL to mac_veriexec_syscall so we can fetch and check label contents in an unconstrained manner. Add a check for PRIV_VERIEXEC_CONTROL to do ioctl on /dev/veriexec Make it clear that trusted process cannot be debugged. Attempts to debug a trusted process already fail, but the failure path is very obscure. Add an explicit check for VERIEXEC_TRUSTED in mac_veriexec_proc_check_debug. We need mac_veriexec_priv_check to not block PRIV_KMEM_WRITE if mac_priv_gant() says it is ok. Reviewed by: sjg Obtained from: Juniper Networks, Inc. 2023-04-02 19:33:10 +00:00			`veriexec_check.c \`
Add mac_grantbylabel This module allows controlled privilege escallation via mac labels securely associated with a process via mac_veriexec. There are over 700 PRIV_* but we can compress many of them into a single GBL_* thus constraining the size of gbl labels. The goal is to allow a daemon to run as an unprivileged process while still being able a set of privileged operations needed. We add APIs to libveriexec so that userland processes can check labels and an exec_script API that allows a suitably labeled process to run something like a python interpreter directly if necessary; overcomming the 'indirect' flag applied to the interpreter. Add -l option to sbin/veriexec to report labels. Reviewed by: stevek Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D41431 2023-08-25 00:41:22 +00:00			`veriexec_get.c \`
This library allows for user space applications to check file descriptors or paths to see if they can be verified by MAC/veriexec. Reviewed by: jtl, wblock Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D8562 2018-06-20 00:55:18 +00:00
			`.include <bsd.lib.mk>`