Our security administration project, secadm, has gained a new feature, which we call Integriforce (short for "Integrity Enforce"). Integriforce verifies file integrity prior to execution, similar to NetBSD's Veriexec. This post is a Call For Testing of that feature.

In secadm's configuration file, you list the executables you want to make sure verify to a certain hash along with the hash. You can specify two modes: soft or hard. Soft means that execution is allowed even if the hashes don't match, but a warning message is logged. Hard mode disallows execution if the hashes don't match along with logging an error message.

We've completed our first milestone and are preparing to release secadm 0.2-rc1 within the next couple weeks. Verifying the integrity of applications using SHA1 and SHA256 are currently supported. The second milestone will be released as secadm version 0.3. That will include ELF binary signing with x509 certificates, similar to how PE files can be signed.

You can try out our Integriforce feature by installing it via pkg or checking our our code. secadm does require that you run HardenedBSD and not our upstream FreeBSD.

Here's Integriforce in action: