veriexec(4) [netbsd man page]
VERIEXEC(4) BSD Kernel Interfaces Manual VERIEXEC(4) NAME
veriexec -- Veriexec pseudo-device SYNOPSIS
pseudo-device veriexec DESCRIPTION
Veriexec verifies the integrity of specified executables and files before they are run or read. This makes it much more difficult to insert a trojan horse into the system and also makes it more difficult to run binaries that are not supposed to be running, for example, packet sniffers, DDoS clients and so on. The veriexec pseudo-device is used to load and delete entries to and from the in-kernel Veriexec databases, as well as query information about them. It can also be used to dump the entire database. Kernel-userland interaction Veriexec uses proplib(3) for communication between the kernel and userland. VERIEXEC_LOAD Load an entry for a file to be monitored by Veriexec. The dictionary passed contains the following elements: Name Type Purpose file string filename for this entry entry-type uint8 entry type (see below) fp-type string fingerprint hashing algorithm fp data the fingerprint ``entry-type'' can be one or more (binary-OR'd) of the following: Type Effect VERIEXEC_DIRECT can execute directly VERIEXEC_INDIRECT can execute indirectly (interpreter, mmap(2)) VERIEXEC_FILE can be opened VERIEXEC_UNTRUSTED located on untrusted storage VERIEXEC_DELETE Removes either an entry for a single file or entries for an entire mount from Veriexec. The dictionary passed contains the following elements: Name Type Purpose file string filename or mount-point VERIEXEC_DUMP Dump the Veriexec monitored files database from the kernel. Only files that the filename is kept for them will be dumped. The returned array contains dictionaries with the following elements: Name Type Purpose file string filename fp-type string fingerprint hashing algorithm fp data the fingerprint entry-type uint8 entry type (see above) VERIEXEC_FLUSH Flush the Veriexec database, removing all entries. This command has no parameters. VERIEXEC_QUERY Queries Veriexec about a file, returning information that may be useful about it. The dictionary passed contains the following elements: Name Type Purpose file string filename The dictionary returned contains the following elements: Name Type Purpose entry-type uint8 entry type (see above) status uint8 entry status fp-type string fingerprint hashing algorithm fp data the fingerprint ``status'' can be one of the following: Status Meaning FINGERPRINT_NOTEVAL not evaluated FINGERPRINT_VALID fingerprint match FINGERPRINT_MISMATCH fingerprint mismatch Note that the requests VERIEXEC_LOAD, VERIEXEC_DELETE, and VERIEXEC_FLUSH are not permitted once the strict level has been raised past 0. SEE ALSO
proplib(3), sysctl(3), security(7), sysctl(8), veriexecctl(8), veriexecgen(8), veriexec(9) NOTES
veriexec is part of the default configuration on the following architectures: amd64, i386, prep, sparc64. AUTHORS
Brett Lymn <blymn@NetBSD.org> Elad Efrat <elad@NetBSD.org> BSD
March 19, 2011 BSD
Check Out this Related Man Page
DM(4) BSD Kernel Interfaces Manual DM(4) NAME
dm -- Device-mapper disk driver SYNOPSIS
pseudo-device dm DESCRIPTION
The dm driver provides the capability of creating one or more virtual disks based on the target mapping. This document assumes that you're familiar with how to generate kernels, how to properly configure disks and pseudo-devices in a kernel con- figuration file, and how to partition disks. This driver is used by the Linux lvm2tools to create and manage lvm in NetBSD. Currently, the linear, zero, and error targets are implemented. Each component partition should be offset at least 2 sectors from the begin- ning of the component disk. This avoids potential conflicts between the component disk's disklabel and dm's disklabel. In i386 it is offset by 65 sectors, where 63 sectors are the initial boot sectors and 2 sectors are used for the disklabel which is set to be read-only. In order to compile in support for dm, you must add a line similar to the following to your kernel configuration file: pseudo-device dm #device-mapper disk device dm may create linear mapped devices, zero, and error block devices. Zero and error block devices are used mostly for testing. Linear devices are used to create virtual disks with linearly mapped virtual blocks to blocks on real disk. dm Device-mapper devices are controlled through the /dev/mapper/control device. For controlling this device ioctl(2) calls are used. For the implementation of the communication channel, the proplib(3) library is used. The protocol channel is defined as a proplib dictionary with needed values. For more details, look at sys/dev/dm/netbsd-dm.h. Before any device can be used, every device-mapper disk device must be initialized. For initialization one line must be passed to the kernel driver in the form of a proplib dictionary. Every device can have more than one table active. An example for such a line is: 0 10240 linear /dev/wd1a 384 dm The first parameter is the start sector for the table defined with this line, the second is the length in sectors which is described with this table. The third parameter is the target name. All other parts of this line depend on the chosen target. dm For the linear target, there are two additional parameters: The first parameter describes the disk device to which the device-mapper disk is mapped. The second parameter is the offset on this disk from the start of the disk/partition. SEE ALSO
config(1), proplib(3), MAKEDEV(8), dmsetup(8), fsck(8), lvm(8), mount(8), newfs(8) HISTORY
The device-mapper disk driver first appeared in NetBSD 6.0. AUTHORS
Adam Hamsik <haad@NetBSD.org> implemented the device-mapper driver for NetBSD. Brett Lymn <blymn@NetBSD.org>, Reinoud Zandijk <reinoud@NetBSD.org>, and Bill Stouder-Studenmund <wrstuden@NetBSD.org> provided guidance and answered questions about the NetBSD implementation. BUGS
This driver is still work-in-progress--there can be bugs. BSD
August 30, 2008 BSD