Cem Kayali wrote:
It looks like sysctl.conf modifies strict value before veriexec loads
signature file and there is no way to update/load signature file
after kern.veriexec.strict>0.
load [file]
Load the fingerprint entries contained in file, if
specified, or
the default signatures file otherwise.
This operation is only allowed in learning mode (strict level
zero).
This is confusing, it is hard to guess such order.
Ah, but Veriexec's strict levels shouldn't be modified using
sysctl.conf, but rather the Veriexec flags in rc.conf. From veriexec(8):
RC Configuration
Veriexec also allows loading signatures and setting the strict
level (see below) during the boot process using the following
variables set in rc.conf(5):
veriexec=YES
veriexec_strict=1 # IDS mode
Maybe we should document this better, perhaps a note in sysctl(7)? (see
diff attached, for real this time :)
Thanks,
-e.