Verified Exec (Veriexec) File Signing and Verification for Junos OS

How Veriexec Works

Veriexec uses a digitally signed manifest that contains fingerprints for executables and other files that must remain immutable.

The verification process typically follows these steps:

1. The Veriexec loader verifies the digital signatures associated with the manifest.
2. After successful verification, the loader provides the manifest contents to the kernel.
3. The system verifies the kernel during startup.
4. The system verifies kernel modules when they are loaded, either during startup or during system operation.
5. The kernel verifies that files match their expected fingerprints before allowing them to be used.

Veriexec requires the kernel, root file system image, and kernel modules to pass verification before the system can use them.

If Veriexec enforcement is enabled, only executables with verified fingerprints can run. In addition, protected files cannot be written to, modified, or changed.

Verification Scope

Veriexec verifies software integrity at multiple stages:

Before installation, the Veriexec framework verifies that a software package has not been altered and can be trusted. Package verification and runtime verification use the same Veriexec framework and support the same hashing algorithms.

Script Execution Considerations

• Veriexec blocks a verified shell script from executing an unsigned script that is not listed in the manifest.

• You can use the /bin/sh file to run arbitrary scripts. From a security perspective, these scripts are treated similarly to interactive commands because execution is controlled through user authentication and permissions.

Verification Failures

If a fingerprint is missing or incorrect, the loader or kernel rejects the file. The impact depends on the file type and its role in the system.

When verification fails:

• The loader or kernel rejects the affected file.
• The impact varies depending on the importance of the file.
• By default, the loader skips files that fail verification.
• Optionally, you can configure the loader to halt the boot process when it encounters an incorrect hash.

Manifest and Hashing Algorithms

Each installation image contains a read-only manifest that stores fingerprints and related attributes for protected files.

The fingerprint examples in this topic use SHA-1 hashes for illustration purposes only. Veriexec supports SHA-1, SHA-256, SHA-384, and SHA-512 hashing algorithms. The Junos OS release and platform determine which hashing algorithm Veriexec uses for verification.

The manifest identifies each protected file and stores its expected fingerprint and associated attributes. The manifest contains entries such as the following:

Fingerprint Mismatch and Log Messages

When the calculated fingerprint of a file does not match the fingerprint stored in the manifest, Veriexec generates a log message.

The log message is in the following format:

If a file has been modified and the resulting fingerprint differs from the one in the manifest, you see a log message similar to the following:

A fingerprint mismatch indicates that the file contents do not match the trusted fingerprint stored in the manifest. This mismatch can occur because of file corruption, storage issues, or unauthorized modification.

Critical files that fail verification cannot be trusted. Contact JTAC for guidance.

Benefits of Veriexec

• Secure systems—Safeguard Juniper Networks routers, switches, and firewalls from security breaches.

• Prevent unauthorized access—Block threat actors from gaining persistent, unauthorized access or causing system failure.

• Prevent malware execution—Block unauthorized modifications and malware through prevention of unsigned binary execution.

• Support authorized code—Add signed, authorized code to Junos OS with Veriexec enforcement using the JET SDK. For more information about the SDK solution, see Juniper Extension Toolkit Developer Guide.

Check Veriexec Enforcement Status

On supported platforms, Junos OS offers an optional version with Veriexec enforcement disabled. For details about this feature and its use cases, see Junos Enhanced Automation.

To verify whether Veriexec is enforced, run the following commands from the Junos OS CLI shell:

1. Start the shell.

2. Use the sysctl security.mac.veriexec.state command.

   If Veriexec is enforced, the output is security.mac.veriexec.state: loaded active enforce. If Veriexec is not enforced, the output is security.mac.veriexec.state: loaded active.

Validate Veriexec File Enforcement

To verify that Veriexec enforcement is active, copy an authorized file to an unprotected location outside the manifest scope (for example, /usr/bin/id) to a new location as shown below. Veriexec prevents the copied file from running because the manifest contains a valid entry for /usr/bin/id but not for /tmp/id. Although copying does not change the file contents, Veriexec validates the file against the manifest entry, including its path and associated metadata. As a result, Veriexec blocks the copied file because it does not match any protected manifest entry.

1. Start the shell.

2. Change directories and then copy an authorized file, for example, /usr/bin/id, to a new location.

Install Veriexec Loader

The Veriexec-capable loader (veloader) is used on BSDX-based Junos platforms beginning with Junos OS Release 19.2. The loader validates Junos OS images before they are trusted for booting. The Veriexec loader validates the Junos OS image that you install from a Trivial File Transfer Protocol (TFTP) server or a USB storage device.

• To install a Junos OS image from a TFTP server, use the following command:

• To install a Junos OS image from a USB storage device, use the following command:

The loader boots only Junos OS images that contain fingerprints and does not boot images that do not contain fingerprints or a valid kernel. You can use the nextboot function to check the current boot device.

Bootupgrade is a tool available in the Junos OS package to support BIOS firmware upgrading. You can use the bootupgrade shell command to upgrade, check U-Boot, manually load, and install the Veriexec-capable loader. The bootupgrade -c loader command prints the version string for the current loader.

Before you install the Veriexec-capable loader, the system verifies that both dual-root partitions contain Junos OS fingerprints.

Install the Veriexec-capable loader from the Junos OS CLI shell:

1. Start the shell.

2. Use the bootupgrade -l /boot/veloader command to install the Veriexec-capable loader.

3. You can see different scenarios here:

   • Use request system software add /var/tmp/xxx.tgz no-copy no-validate command to install Junos OS with fingerprints. The no-validate option does not disable package signature verification, and the system continues to reject invalid packages.

   • If the Veriexec-capable loader does not support a target Junos OS image from an earlier release, you can downgrade the loader to a version that is compatible with that release. Use the request system software add /var/tmp/xxx.tgz no-copy no-validate command to automatically downgrade to an earlier version of the loader.

   • Use the request system software add /var/tmp/xxx command to check whether the Junos OS package is compatible with the Veriexec loader.

     In this example, the system terminates the installation because the Veriexec loader does not support Junos OS releases earlier than 20.3R1.