Veriexec is a file-signing scheme for theNetBSD operating system.
It introduces a special device node (/dev/veriexec) through which asignature list can be loaded into thekernel. The list containsfile paths, together withhashes and an expected file type ("DIRECT" for executables, "INDIRECT" for scripts and "FILE" forshared libraries and regular files). The kernel then verifies the contents of the signed files against their hashes just before they are opened in anexec() oropen()system call.
When Veriexec is enabled at level 0, the kernel will simply warn about signature mismatches. At level 1, it will prevent access to mismatched files. At level 2, it prevents signed files from being overwritten or deleted. At the highest, level 3, the kernel will not allow unsigned files to be accessed at all.
