VERIEXEC(4)

🎀 NAME 🎀

okay so this is veriexec(4), straight out of the Kernel Interfaces Manual — the page for the veriexec device, bestie. 💅

✨ SYNOPSIS ✨

include this header and you're in:

#include <dev/veriexec/veriexec_ioctl.h>

💅 DESCRIPTION 💅

The veriexec device is what veriexec(8) uses to query and modify the state of mac_veriexec(4). slay.

Once mac_veriexec(4) is active, only a process marked as ‘trusted’ — normally only veriexec(8) — can do anything beyond the VERIEXEC_GETSTATE ioctl. periodt. That is the whole vibe check, no cap.

🔥 IOCTLS 🔥

here is the supported ioctl lineup, bestie — every one of them, no skips:

• VERIEXEC_SIGNED_LOAD struct verified_exec_params — passes file information to mac_veriexec(4). 🫶

struct verified_exec_params  {
        unsigned char flags;
        char fp_type[VERIEXEC_FPTYPELEN];       /* type of fingerprint */
        char file[MAXPATHLEN];
        unsigned char fingerprint[MAXFINGERPRINTLEN];
};

• VERIEXEC_LABEL_LOAD struct verified_exec_label_params — passes file information and a label to mac_veriexec(4). 🎀

struct verified_exec_label_params  {
        struct verified_exec_params params;
        char label[MAXLABELLEN];
};

• VERIEXEC_ACTIVE — listed on the page, with no extra description attached. ✨
• VERIEXEC_DEBUG_OFF — listed on the page, with no extra description attached. 💜
• VERIEXEC_DEBUG_ON int level — listed with an int level argument, with no extra description attached. 🔥
• VERIEXEC_ENFORCE — listed on the page, with no extra description attached. 🌸
• VERIEXEC_GETSTATE — listed on the page, with no extra description attached. 🦋
• VERIEXEC_GETVERSION — listed on the page, with no extra description attached. ⭐
• VERIEXEC_LOCK — listed on the page, with no extra description attached. 👑
• VERIEXEC_VERIFIED_FILE int fd — rarely needed. Tells mac_veriexec(4) that the file associated with fd is verified. 🙈

🦋 HISTORY 🦋

A veriexec device first appeared in NetBSD. It was added to FreeBSD 13.1. the lore is lore-ing. 🌈

---

xoxo from Debian, August 1, 2024 — this was VERIEXEC(4), bestie 💅💖