\hypertarget{verified__exec_8c_source}{}\doxysection{verified\+\_\+exec.\+c}
\label{verified__exec_8c_source}\index{dev/veriexec/verified\_exec.c@{dev/veriexec/verified\_exec.c}}
\mbox{\hyperlink{verified__exec_8c}{Go to the documentation of this file.}}
\begin{DoxyCode}{0}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00001}00001 \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00002}00002 \textcolor{comment}{ * \$FreeBSD\$}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00003}00003 \textcolor{comment}{ *}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00004}00004 \textcolor{comment}{ * Copyright (c) 2011-\/2013, 2015, 2019 Juniper Networks, Inc.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00005}00005 \textcolor{comment}{ * All rights reserved.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00006}00006 \textcolor{comment}{ *}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00007}00007 \textcolor{comment}{ * Redistribution and use in source and binary forms, with or without}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00008}00008 \textcolor{comment}{ * modification, are permitted provided that the following conditions}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00009}00009 \textcolor{comment}{ * are met:}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00010}00010 \textcolor{comment}{ * 1. Redistributions of source code must retain the above copyright}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00011}00011 \textcolor{comment}{ *    notice, this list of conditions and the following disclaimer.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00012}00012 \textcolor{comment}{ * 2. Redistributions in binary form must reproduce the above copyright}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00013}00013 \textcolor{comment}{ *    notice, this list of conditions and the following disclaimer in the}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00014}00014 \textcolor{comment}{ *    documentation and/or other materials provided with the distribution.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00015}00015 \textcolor{comment}{ *}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00016}00016 \textcolor{comment}{ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00017}00017 \textcolor{comment}{ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00018}00018 \textcolor{comment}{ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00019}00019 \textcolor{comment}{ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00020}00020 \textcolor{comment}{ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00021}00021 \textcolor{comment}{ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00022}00022 \textcolor{comment}{ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00023}00023 \textcolor{comment}{ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00024}00024 \textcolor{comment}{ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00025}00025 \textcolor{comment}{ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00026}00026 \textcolor{comment}{ * SUCH DAMAGE.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00027}00027 \textcolor{comment}{ */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00028}00028 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00029}00029 \textcolor{preprocessor}{\#include <sys/cdefs.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00030}00030 \textcolor{preprocessor}{\#include <sys/param.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00031}00031 \textcolor{preprocessor}{\#include <sys/systm.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00032}00032 \textcolor{preprocessor}{\#include <sys/buf.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00033}00033 \textcolor{preprocessor}{\#include <sys/conf.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00034}00034 \textcolor{preprocessor}{\#include <sys/errno.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00035}00035 \textcolor{preprocessor}{\#include <sys/fcntl.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00036}00036 \textcolor{preprocessor}{\#include <sys/file.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00037}00037 \textcolor{preprocessor}{\#include <sys/filedesc.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00038}00038 \textcolor{preprocessor}{\#include <sys/ioccom.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00039}00039 \textcolor{preprocessor}{\#include <sys/jail.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00040}00040 \textcolor{preprocessor}{\#include <sys/kernel.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00041}00041 \textcolor{preprocessor}{\#include <sys/lock.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00042}00042 \textcolor{preprocessor}{\#include <sys/malloc.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00043}00043 \textcolor{preprocessor}{\#include <sys/mdioctl.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00044}00044 \textcolor{preprocessor}{\#include <sys/mount.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00045}00045 \textcolor{preprocessor}{\#include <sys/mutex.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00046}00046 \textcolor{preprocessor}{\#include <sys/namei.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00047}00047 \textcolor{preprocessor}{\#include <sys/priv.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00048}00048 \textcolor{preprocessor}{\#include <sys/proc.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00049}00049 \textcolor{preprocessor}{\#include <sys/queue.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00050}00050 \textcolor{preprocessor}{\#include <sys/vnode.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00051}00051 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00052}00052 \textcolor{preprocessor}{\#include <security/mac\_veriexec/mac\_veriexec.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00053}00053 \textcolor{preprocessor}{\#include <security/mac\_veriexec/mac\_veriexec\_internal.h>}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00054}00054 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00055}00055 \textcolor{preprocessor}{\#include "{}\mbox{\hyperlink{veriexec__ioctl_8h}{veriexec\_ioctl.h}}"{}}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00056}00056 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00057}00057 \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00058}00058 \textcolor{comment}{ * We need a mutex while updating lists etc.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00059}00059 \textcolor{comment}{ */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00060}00060 \textcolor{keyword}{extern} \textcolor{keyword}{struct }mtx \mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00061}00061 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00062}00062 \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00063}00063 \textcolor{comment}{ * Handle the ioctl for the device}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00064}00064 \textcolor{comment}{ */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00065}00065 \textcolor{keyword}{static} \textcolor{keywordtype}{int}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00066}\mbox{\hyperlink{verified__exec_8c_a055f6c3adce5f6ae7a937616b5fa2b59}{00066}} \mbox{\hyperlink{verified__exec_8c_a055f6c3adce5f6ae7a937616b5fa2b59}{verifiedexecioctl}}(\textcolor{keyword}{struct} cdev *dev \_\_unused, u\_long cmd, caddr\_t data,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00067}00067     \textcolor{keywordtype}{int} flags, \textcolor{keyword}{struct} thread *td)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00068}00068 \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00069}00069         \textcolor{keyword}{struct }nameidata nid;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00070}00070         \textcolor{keyword}{struct }vattr vattr;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00071}00071         \textcolor{keyword}{struct }\mbox{\hyperlink{structverified__exec__label__params}{verified\_exec\_label\_params}} *lparams;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00072}00072         \textcolor{keyword}{struct }\mbox{\hyperlink{structverified__exec__params}{verified\_exec\_params}} *params;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00073}00073         \textcolor{keywordtype}{int} error = 0;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00074}00074 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00075}00075         \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00076}00076 \textcolor{comment}{         * These commands are considered safe requests for anyone who has}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00077}00077 \textcolor{comment}{         * permission to access to device node.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00078}00078 \textcolor{comment}{         */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00079}00079         \textcolor{keywordflow}{switch} (cmd) \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00080}00080         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_aba5cfb619d9e1b84f7a75d35d178f870}{VERIEXEC\_GETSTATE}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00081}00081                 \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00082}00082                         \textcolor{keywordtype}{int} *ip = (\textcolor{keywordtype}{int} *)data;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00083}00083 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00084}00084                         \textcolor{keywordflow}{if} (ip)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00085}00085                                 *ip = mac\_veriexec\_get\_state();}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00086}00086                         \textcolor{keywordflow}{else}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00087}00087                             error = EINVAL;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00088}00088 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00089}00089                         \textcolor{keywordflow}{return} (error);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00090}00090                 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00091}00091                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00092}00092         \textcolor{keywordflow}{default}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00093}00093                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00094}00094         \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00095}00095 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00096}00096         \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00097}00097 \textcolor{comment}{         * Anything beyond this point is considered dangerous, so we need to}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00098}00098 \textcolor{comment}{         * only allow processes that have kmem write privs to do them.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00099}00099 \textcolor{comment}{         *}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00100}00100 \textcolor{comment}{         * MAC/veriexec will grant kmem write privs to "{}trusted"{} processes.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00101}00101 \textcolor{comment}{         */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00102}00102         error = priv\_check(td, PRIV\_KMEM\_WRITE);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00103}00103         \textcolor{keywordflow}{if} (error)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00104}00104                 \textcolor{keywordflow}{return} (error);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00105}00105 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00106}00106         lparams = (\textcolor{keyword}{struct }\mbox{\hyperlink{structverified__exec__label__params}{verified\_exec\_label\_params}} *)data;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00107}00107         \textcolor{keywordflow}{if} (cmd == \mbox{\hyperlink{veriexec__ioctl_8h_a03d3d79b1fe17fdd1c39db8deaf9ee57}{VERIEXEC\_LABEL\_LOAD}})}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00108}00108                 \mbox{\hyperlink{structverified__exec__label__params_a0ac015f378d094ef95b83c948fa78055}{params}} = \&lparams-\/>\mbox{\hyperlink{structverified__exec__label__params_a0ac015f378d094ef95b83c948fa78055}{params}};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00109}00109         \textcolor{keywordflow}{else}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00110}00110                 \mbox{\hyperlink{structverified__exec__label__params_a0ac015f378d094ef95b83c948fa78055}{params}} = (\textcolor{keyword}{struct }\mbox{\hyperlink{structverified__exec__params}{verified\_exec\_params}} *)data;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00111}00111 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00112}00112         \textcolor{keywordflow}{switch} (cmd) \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00113}00113         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a420fdaf9023fe21c6fe581c2ec4c0601}{VERIEXEC\_ACTIVE}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00114}00114                 mtx\_lock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00115}00115                 \textcolor{keywordflow}{if} (mac\_veriexec\_in\_state(VERIEXEC\_STATE\_LOADED))}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00116}00116                         mac\_veriexec\_set\_state(VERIEXEC\_STATE\_ACTIVE);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00117}00117                 \textcolor{keywordflow}{else}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00118}00118                         error = EINVAL;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00119}00119                 mtx\_unlock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00120}00120                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00121}00121         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a3ed9bd34c54d0e796fa141c90cd966ac}{VERIEXEC\_DEBUG\_ON}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00122}00122                 mtx\_lock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00123}00123                 \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00124}00124                         \textcolor{keywordtype}{int} *ip = (\textcolor{keywordtype}{int} *)data;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00125}00125                         }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00126}00126                         mac\_veriexec\_debug++;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00127}00127                         \textcolor{keywordflow}{if} (ip) \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00128}00128                                 \textcolor{keywordflow}{if} (*ip > 0)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00129}00129                                         mac\_veriexec\_debug = *ip;       }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00130}00130                                 *ip = mac\_veriexec\_debug;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00131}00131                         \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00132}00132                 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00133}00133                 mtx\_unlock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00134}00134                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00135}00135         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a0cbae52462ff8d53f1eed35bbb2e6d17}{VERIEXEC\_DEBUG\_OFF}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00136}00136                 mac\_veriexec\_debug = 0;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00137}00137                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00138}00138         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a11fa49bc4ec48816906fa57baec94641}{VERIEXEC\_ENFORCE}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00139}00139                 mtx\_lock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00140}00140                 \textcolor{keywordflow}{if} (mac\_veriexec\_in\_state(VERIEXEC\_STATE\_LOADED))}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00141}00141                         mac\_veriexec\_set\_state(VERIEXEC\_STATE\_ACTIVE |}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00142}00142                             VERIEXEC\_STATE\_ENFORCE);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00143}00143                 \textcolor{keywordflow}{else}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00144}00144                         error = EINVAL;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00145}00145                 mtx\_unlock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00146}00146                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00147}00147         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a2c248224f98401f21b9cd065d5588184}{VERIEXEC\_GETVERSION}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00148}00148                 \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00149}00149                         \textcolor{keywordtype}{int} *ip = (\textcolor{keywordtype}{int} *)data;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00150}00150 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00151}00151                         \textcolor{keywordflow}{if} (ip)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00152}00152                                 *ip = MAC\_VERIEXEC\_VERSION;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00153}00153                         \textcolor{keywordflow}{else}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00154}00154                                 error = EINVAL;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00155}00155                 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00156}00156                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00157}00157         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a8907f405fa72bc28d587b4070f4e808a}{VERIEXEC\_LOCK}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00158}00158                 mtx\_lock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00159}00159                 mac\_veriexec\_set\_state(VERIEXEC\_STATE\_LOCKED);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00160}00160                 mtx\_unlock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00161}00161                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00162}00162         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a57db2e19410c5160010f53b318870cb6}{VERIEXEC\_LOAD}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00163}00163                 \textcolor{keywordflow}{if} (prison0.pr\_securelevel > 0)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00164}00164                         \textcolor{keywordflow}{return} (EPERM); \textcolor{comment}{/* no updates when secure */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00165}00165 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00166}00166                 \textcolor{comment}{/* FALLTHROUGH */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00167}00167         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_a03d3d79b1fe17fdd1c39db8deaf9ee57}{VERIEXEC\_LABEL\_LOAD}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00168}00168         \textcolor{keywordflow}{case} \mbox{\hyperlink{veriexec__ioctl_8h_ade14ecf9298f637c2c34b7120aec2333}{VERIEXEC\_SIGNED\_LOAD}}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00169}00169                 \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00170}00170 \textcolor{comment}{                 * If we use a loader that will only use a}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00171}00171 \textcolor{comment}{                 * digitally signed hash list -\/ which it verifies.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00172}00172 \textcolor{comment}{                 * We can load fingerprints provided veriexec is not locked.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00173}00173 \textcolor{comment}{                 */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00174}00174                 \textcolor{keywordflow}{if} (prison0.pr\_securelevel > 0 \&\&}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00175}00175                     !mac\_veriexec\_in\_state(VERIEXEC\_STATE\_LOADED)) \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00176}00176                         \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00177}00177 \textcolor{comment}{                         * If securelevel has been raised and we}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00178}00178 \textcolor{comment}{                         * do not have any fingerprints loaded,}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00179}00179 \textcolor{comment}{                         * it would dangerous to do so now.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00180}00180 \textcolor{comment}{                         */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00181}00181                         \textcolor{keywordflow}{return} (EPERM);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00182}00182                 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00183}00183                 \textcolor{keywordflow}{if} (mac\_veriexec\_in\_state(VERIEXEC\_STATE\_LOCKED))}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00184}00184                         error = EPERM;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00185}00185                 \textcolor{keywordflow}{else} \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00186}00186                         \textcolor{keywordtype}{size\_t} labellen = 0;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00187}00187                         \textcolor{keywordtype}{int} \mbox{\hyperlink{structverified__exec__params_a84366f7dc7aa1c40b50a16a3702c6299}{flags}} = FREAD;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00188}00188                         \textcolor{keywordtype}{int} \textcolor{keyword}{override} = (cmd != \mbox{\hyperlink{veriexec__ioctl_8h_a57db2e19410c5160010f53b318870cb6}{VERIEXEC\_LOAD}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00189}00189 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00190}00190                         \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00191}00191 \textcolor{comment}{                         * Get the attributes for the file name passed}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00192}00192 \textcolor{comment}{                         * stash the file's device id and inode number}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00193}00193 \textcolor{comment}{                         * along with it's fingerprint in a list for}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00194}00194 \textcolor{comment}{                         * exec to use later.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00195}00195 \textcolor{comment}{                         */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00196}00196                         \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00197}00197 \textcolor{comment}{                         * FreeBSD seems to copy the args to kernel space}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00198}00198 \textcolor{comment}{                         */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00199}00199                         NDINIT(\&nid, LOOKUP, FOLLOW, UIO\_SYSSPACE, params-\/>\mbox{\hyperlink{structverified__exec__params_a16a1049f384dbb26bcdaa230e7e62906}{file}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00200}00200                         \textcolor{keywordflow}{if} ((error = vn\_open(\&nid, \&\mbox{\hyperlink{structverified__exec__params_a84366f7dc7aa1c40b50a16a3702c6299}{flags}}, 0, NULL)) != 0)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00201}00201                                 \textcolor{keywordflow}{return} (error);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00202}00202 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00203}00203                         error = VOP\_GETATTR(nid.ni\_vp, \&vattr, td-\/>td\_ucred);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00204}00204                         \textcolor{keywordflow}{if} (error != 0) \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00205}00205                                 mac\_veriexec\_set\_fingerprint\_status(nid.ni\_vp,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00206}00206                                     FINGERPRINT\_INVALID);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00207}00207                                 VOP\_UNLOCK(nid.ni\_vp);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00208}00208                                 (void) vn\_close(nid.ni\_vp, FREAD, td-\/>td\_ucred,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00209}00209                                     td);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00210}00210                                 \textcolor{keywordflow}{return} (error);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00211}00211                         \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00212}00212                         \textcolor{keywordflow}{if} (\textcolor{keyword}{override}) \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00213}00213                                 \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00214}00214 \textcolor{comment}{                                 * If the file is on a "{}verified"{} filesystem}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00215}00215 \textcolor{comment}{                                 * someone may be playing games.}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00216}00216 \textcolor{comment}{                                 */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00217}00217                                 \textcolor{keywordflow}{if} ((nid.ni\_vp-\/>v\_mount-\/>mnt\_flag \&}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00218}00218                                     MNT\_VERIFIED) != 0)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00219}00219                                         \textcolor{keyword}{override} = 0;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00220}00220                         \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00221}00221 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00222}00222                         \textcolor{comment}{/*}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00223}00223 \textcolor{comment}{                         * invalidate the node fingerprint status}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00224}00224 \textcolor{comment}{                         * which will have been set in the vn\_open}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00225}00225 \textcolor{comment}{                         * and would always be FINGERPRINT\_NOTFOUND}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00226}00226 \textcolor{comment}{                         */}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00227}00227                         mac\_veriexec\_set\_fingerprint\_status(nid.ni\_vp,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00228}00228                             FINGERPRINT\_INVALID);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00229}00229                         VOP\_UNLOCK(nid.ni\_vp);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00230}00230                         (void) vn\_close(nid.ni\_vp, FREAD, td-\/>td\_ucred, td);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00231}00231                         \textcolor{keywordflow}{if} (params-\/>\mbox{\hyperlink{structverified__exec__params_a84366f7dc7aa1c40b50a16a3702c6299}{flags}} \& VERIEXEC\_LABEL)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00232}00232                                 labellen = strnlen(lparams-\/>\mbox{\hyperlink{structverified__exec__label__params_aa918c4a8119043b56ec7aeaab9af6177}{label}},}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00233}00233                                     \textcolor{keyword}{sizeof}(lparams-\/>\mbox{\hyperlink{structverified__exec__label__params_aa918c4a8119043b56ec7aeaab9af6177}{label}}) -\/ 1) + 1;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00234}00234 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00235}00235                         mtx\_lock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00236}00236                         error = mac\_veriexec\_metadata\_add\_file(}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00237}00237                             ((params-\/>\mbox{\hyperlink{structverified__exec__params_a84366f7dc7aa1c40b50a16a3702c6299}{flags}} \& VERIEXEC\_FILE) != 0),}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00238}00238                             vattr.va\_fsid, vattr.va\_fileid, vattr.va\_gen,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00239}00239                             params-\/>\mbox{\hyperlink{structverified__exec__params_aaac73b5ef0438da5a853651b858731b6}{fingerprint}},}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00240}00240                             (params-\/>\mbox{\hyperlink{structverified__exec__params_a84366f7dc7aa1c40b50a16a3702c6299}{flags}} \& VERIEXEC\_LABEL) ?}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00241}00241                             lparams-\/>\mbox{\hyperlink{structverified__exec__label__params_aa918c4a8119043b56ec7aeaab9af6177}{label}} : NULL, labellen,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00242}00242                             params-\/>\mbox{\hyperlink{structverified__exec__params_a84366f7dc7aa1c40b50a16a3702c6299}{flags}}, params-\/>\mbox{\hyperlink{structverified__exec__params_aabd34172e9012ad8869dfeb45f242565}{fp\_type}}, \textcolor{keyword}{override});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00243}00243 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00244}00244                         mac\_veriexec\_set\_state(VERIEXEC\_STATE\_LOADED);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00245}00245                         mtx\_unlock(\&\mbox{\hyperlink{verified__exec_8c_ac43ed93b52bb6da8bf14e6215eab1760}{ve\_mutex}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00246}00246                 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00247}00247                 \textcolor{keywordflow}{break};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00248}00248         \textcolor{keywordflow}{default}:}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00249}00249                 error = ENODEV;}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00250}00250         \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00251}00251         \textcolor{keywordflow}{return} (error);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00252}00252 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00253}00253 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00254}\mbox{\hyperlink{verified__exec_8c_a7234bb036136a8ba55e87e6086e5812d}{00254}} \textcolor{keyword}{struct }cdevsw \mbox{\hyperlink{verified__exec_8c_a7234bb036136a8ba55e87e6086e5812d}{veriexec\_cdevsw}} = \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00255}00255         .d\_version =    D\_VERSION,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00256}00256         .d\_ioctl =      \mbox{\hyperlink{verified__exec_8c_a055f6c3adce5f6ae7a937616b5fa2b59}{verifiedexecioctl}},}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00257}00257         .d\_name =       \textcolor{stringliteral}{"{}veriexec"{}},}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00258}00258 \};}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00259}00259 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00260}00260 \textcolor{keyword}{static} \textcolor{keywordtype}{void}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00261}\mbox{\hyperlink{verified__exec_8c_ae07d544045dc80cbb2711b89d8f8307f}{00261}} \mbox{\hyperlink{verified__exec_8c_ae07d544045dc80cbb2711b89d8f8307f}{veriexec\_drvinit}}(\textcolor{keywordtype}{void} *unused \_\_unused)}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00262}00262 \{}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00263}00263 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00264}00264         make\_dev(\&\mbox{\hyperlink{verified__exec_8c_a7234bb036136a8ba55e87e6086e5812d}{veriexec\_cdevsw}}, 0, UID\_ROOT, GID\_WHEEL, 0600, \textcolor{stringliteral}{"{}veriexec"{}});}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00265}00265 \}}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00266}00266 }
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00267}\mbox{\hyperlink{verified__exec_8c_a43a45bb84de9731ed10e8bd099de68f8}{00267}} \mbox{\hyperlink{verified__exec_8c_a43a45bb84de9731ed10e8bd099de68f8}{SYSINIT}}(veriexec, SI\_SUB\_PSEUDO, SI\_ORDER\_ANY, \mbox{\hyperlink{verified__exec_8c_ae07d544045dc80cbb2711b89d8f8307f}{veriexec\_drvinit}}, NULL);}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00268}\mbox{\hyperlink{verified__exec_8c_aaaf37633a694a5a696ce4ba54d173dd9}{00268}} \mbox{\hyperlink{verified__exec_8c_aaaf37633a694a5a696ce4ba54d173dd9}{MODULE\_DEPEND}}(veriexec, mac\_veriexec, MAC\_VERIEXEC\_VERSION,}
\DoxyCodeLine{\Hypertarget{verified__exec_8c_source_l00269}00269     MAC\_VERIEXEC\_VERSION, MAC\_VERIEXEC\_VERSION);}

\end{DoxyCode}
