VERIEXEC(8) | System Manager's Manual | VERIEXEC(8) |
veriexec
— file
integrity subsystem
Veriexec is an in-kernel, real-time, file-system independent, file integrity subsystem. It can be used for a variety of purposes, including defense against trojaned binaries, indirect attacks via third-party remote file-systems, and malicious configuration file corruption.
Veriexec requires a signatures database -- a list of monitored files, along with their digital fingerprint and (optionally) access modes. The format of this file is described by veriexec(5).
NetBSD provides a tool, veriexecgen(8), for generating the signatures database. Example usage:
# veriexecgen
Although it should be loaded on system boot (see “RC Configuration” below), this list can be loaded manually using veriexecctl(8):
# veriexecctl load
Veriexec requires a kernel with fileassoc(9) support and a pseudo-device to run:
options FILEASSOC pseudo-device veriexec
Additionally, one or more options for digital fingerprint algorithm support:
options VERIFIED_EXEC_FP_SHA256 options VERIFIED_EXEC_FP_SHA384 options VERIFIED_EXEC_FP_SHA512
Some kernels already enable Veriexec by default. See your kernel's config file for more information.
Veriexec also allows loading signatures and setting the strict level (see below) during the boot process using the following variables set in rc.conf(5):
veriexec=YES veriexec_strict=1 # IDS mode
Veriexec can operate in four modes, also referred to as strict levels:
Veriexec exports runtime information that may be useful for various purposes.
It reports the currently supported fingerprinting algorithms, for example:
# /sbin/sysctl kern.veriexec.algorithms kern.veriexec.algorithms = SHA256 SHA384 SHA512
It reports the current verbosity and strict levels, for example:
# /sbin/sysctl kern.veriexec.{verbose,strict} kern.veriexec.verbose = 0 kern.veriexec.strict = 1
It reports a summary of currently loaded files and the mount-points they're on, for example:
# /sbin/sysctl kern.veriexec.count kern.veriexec.count.table0.mntpt = / kern.veriexec.count.table0.fstype = ffs kern.veriexec.count.table0.nentries = 33
Other information may be retrieved using veriexecctl(8).
options(4), veriexec(5), sysctl(7), sysctl(8), veriexecctl(8), veriexecgen(8)
Elad Efrat <elad@NetBSD.org>
September 13, 2017 | NetBSD 10.99 |