====== Security Topics ======

===== Verified Execution (veriexec) =====

==== Available ====

See [[https://github.com/hackagadget/freebsd/tree/hackagadget/veriexec]]
  - MAC/veriexec module
  - libveriexec
  - veriexecctl utility

==== In Review ====
  - verified mounts ([[https://reviews.freebsd.org/D2902|D2902]])

==== Committed ====
  - **O_VERIFY** flag

==== Needed ====

  - signed manifest support

<callout type="info">
\\ We have some X.509-based signed manifest functionality in Junos, but it possibly will not be what the %%FreeBSD%% project may want.
</callout>

  - veriexec for loader(8) to load kernel, modules, etc.

===== MAC Framework =====

==== Available ====

  - allow for MAC modules to effectively do a setuid/setgid operation
    - this will most likely need to be revisited, as it has been some time since the changes were made in Junos

==== In Review ====

==== Committed ====

==== Needed ====

  - resolve securelevel and MAC interaction
    - Currently there are some things that securelevel takes precedence over MAC policies