VirtualBox

Changeset 104384 in vbox


Ignore:
Timestamp:
Apr 19, 2024 10:03:10 PM (11 months ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
162874
Message:

/Config.kmk,SUPHardNt: s/VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK/VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT/; s/SUPHNTVI_F_TRUSTED_INSTALLER_OWNER/SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER/; some more comments, a @todo and dialing back the changes a little. bugref:10657

Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • TabularUnified trunk/Config.kmk

    r104381 r104384  
    11811181 endif
    11821182endif
    1183 VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK = 1
     1183# Building windows without a kernel code signing certificate (as good as
     1184# impossible to get these days, so enabled by default).
     1185VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT = 1
    11841186# Enable the system wide support service/daemon.
    11851187# Very sketchy work in progress.
    … …  
    48634865        $(CHMOD) a+rw -- "$@"
    48644866        $(VBOX_VCC_EDITBIN) /LargeAddressAware /DynamicBase /NxCompat /Release \
    4865                 $(if-expr !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK),/IntegrityCheck,) \
     4867                $(if-expr !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT),/IntegrityCheck,) \
    48664868                /Version:$(VBOX_VERSION_MAJOR)0$(VBOX_VERSION_MINOR).$(VBOX_VERSION_BUILD) \
    48674869                "$@"
    … …  
    48864888        $(CHMOD) a+rw -- "$@"
    48874889        $(VBOX_VCC_EDITBIN) /LargeAddressAware /DynamicBase /NxCompat /Release \
    4888                 $(if-expr !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK),/IntegrityCheck,) \
     4890                $(if-expr !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT),/IntegrityCheck,) \
    48894891                /Version:$(VBOX_VERSION_MAJOR)0$(VBOX_VERSION_MINOR).$(VBOX_VERSION_BUILD) \
    48904892                "$@"
    … …  
    53905392        -Version:$(VBOX_VERSION_MAJOR)0$(VBOX_VERSION_MINOR).$(VBOX_VERSION_BUILD) \
    53915393        -Stub:$(PATH_ROOT)/src/VBox/HostDrivers/Support/win/winstub.com
    5392   if defined(VBOX_SIGNING_MODE) && !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK)
     5394  if defined(VBOX_SIGNING_MODE) && !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT)
    53935395   TEMPLATE_VBoxRc_LDFLAGS          += -IntegrityCheck
    53945396  endif
    … …  
    55515553  TEMPLATE_VBoxR0_LDFLAGS          += -Merge:VTGPrLc.Data=VTGPrLc.Begin -Merge:VTGPrLc.End=VTGPrLc.Begin -Merge:VTGPrLc.Begin=VTGObj
    55525554 endif
    5553  if defined(VBOX_SIGNING_MODE) && !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK)
     5555 if defined(VBOX_SIGNING_MODE) && !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT)
    55545556  TEMPLATE_VBoxR0_LDFLAGS          += -IntegrityCheck
    55555557 endif
    … …  
    57545756  TEMPLATE_VBoxR0Drv_LDFLAGS          += -Merge:VTGPrLc.Data=VTGPrLc.Begin -Merge:VTGPrLc.End=VTGPrLc.Begin -Merge:VTGPrLc.Begin=VTGObj
    57555757 endif
    5756  if defined(VBOX_SIGNING_MODE) && !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK)
     5758 if defined(VBOX_SIGNING_MODE) && !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT)
    57575759  TEMPLATE_VBoxR0Drv_LDFLAGS          += -IntegrityCheck
    57585760 endif
    … …  
    63376339  TEMPLATE_VBoxR3Exe_LDFLAGS          += -Merge:VTGPrLc.Data=VTGPrLc.Begin -Merge:VTGPrLc.End=VTGPrLc.Begin -Merge:VTGPrLc.Begin=VTGObj
    63386340 endif
    6339  if defined(VBOX_SIGNING_MODE) && defined(VBOX_WITH_HARDENING) && !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK)
     6341 if defined(VBOX_SIGNING_MODE) && defined(VBOX_WITH_HARDENING) && !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT)
    63406342  TEMPLATE_VBoxR3Exe_LDFLAGS          += -IntegrityCheck
    63416343 endif
    … …  
    69846986TEMPLATE_VBoxR3HardenedTstDll_INST = $(INST_TESTCASE)
    69856987TEMPLATE_VBoxR3HardenedTstDll_LDFLAGS.win  = $(TEMPLATE_VBoxR3TstDll_LDFLAGS.win) \
    6986         $(if-expr !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK),-IntegrityCheck,)
     6988        $(if-expr !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT),-IntegrityCheck,)
    69876989ifn1of ($(KBUILD_TARGET), win os2)
    69886990 TEMPLATE_VBoxR3HardenedTstDll_LDFLAGS       = $(filter-out '$(VBOX_GCC_RPATH_OPT)%,$(TEMPLATE_VBoxR3TstDll_LDFLAGS))
    … …  
    72937295        /DISALLOWLIB:libucrt.lib \
    72947296        /DISALLOWLIB:libucrtd.lib
    7295  if defined(VBOX_SIGNING_MODE) && defined(VBOX_WITH_HARDENING) && !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK)
     7297 if defined(VBOX_SIGNING_MODE) && defined(VBOX_WITH_HARDENING) && !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT)
    72967298  TEMPLATE_VBoxMainExe_LDFLAGS          += -IntegrityCheck
    72977299 endif
    … …  
    79957997        /Version:$(VBOX_VERSION_MAJOR)0$(VBOX_VERSION_MINOR).$(VBOX_VERSION_BUILD) \
    79967998        /STUB:$(PATH_ROOT)/src/VBox/HostDrivers/Support/win/winstub.com
    7997   if defined(VBOX_SIGNING_MODE) && defined(VBOX_WITH_HARDENING) && !defined(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK)
     7999  if defined(VBOX_SIGNING_MODE) && defined(VBOX_WITH_HARDENING) && !defined(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT)
    79988000   TEMPLATE_VBoxQtGuiExe_LDFLAGS += -IntegrityCheck
    79998001  endif

  • TabularUnified trunk/src/VBox/HostDrivers/Support/Makefile.kmk

    r104381 r104384  
    240240        $(if $(VBOX_WITH_DRIVERLESS_NEM_FALLBACK),VBOX_WITH_DRIVERLESS_NEM_FALLBACK,) \
    241241        $(if $(VBOX_WITHOUT_DEBUGGER_CHECKS),VBOX_WITHOUT_DEBUGGER_CHECKS,) \
    242         $(if $(VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK),VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK,) \
     242        $(if $(VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT),VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT,) \
    243243        $(if $(VBOX_PERMIT_VISUAL_STUDIO_PROFILING),VBOX_PERMIT_VISUAL_STUDIO_PROFILING,) \
    244244        VBOX_PERMIT_MORE \

  • TabularUnified trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h

    r104381 r104384  
    148148/** Require kernel code signing level. */
    149149#  define SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING    RT_BIT(1)
    150 #  ifndef VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK
    151150/** Require the image to force the memory mapper to do signature checking. */
    152 #   define SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT  RT_BIT(2)
    153 #  endif
     151#  define SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT  RT_BIT(2)
    154152/** Whether to allow image verification by catalog file. */
    155153#  define SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION    RT_BIT(3)
    156 /** The file owner must be TrustedInstaller on Vista+. */
    157 #  define SUPHNTVI_F_TRUSTED_INSTALLER_OWNER        RT_BIT(4)
     154/** The file owner must be TrustedInstaller, Builtin\\Administrators
     155 *  (S-1-5-32-544) or local system (S-1-5-21) on Vista+. */
     156#  define SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER RT_BIT(4)
    158157/** Ignore the image architecture (otherwise it must match the verification
    159158 * code).  Used with resource images and such. */

  • TabularUnified trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

    r104381 r104384  
    808808
    809809        /* Must be owned by trusted installer. (This test is superfuous, thus no relaxation here.) */
    810         if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER)
     810        if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER)
    811811            && !supHardNtViCheckIsOwnedByTrustedInstallerOrSimilar(hFile, pwszName))
    812812            return rc;
    … …  
    869869
    870870        /* Must be owned by trusted installer. */
    871         if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER)
     871        if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER)
    872872            && !supHardNtViCheckIsOwnedByTrustedInstallerOrSimilar(hFile, pwszName))
    873873            return rc;
    … …  
    886886        pwsz = pwszName + cwcOther + 1;
    887887
    888         if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER)
     888        if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER)
    889889            && !supHardNtViCheckIsOwnedByTrustedInstallerOrSimilar(hFile, pwszName))
    890890            return rc;
    … …  
    934934       )
    935935    {
    936         if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER)
     936        if (   !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER)
    937937            && !supHardNtViCheckIsOwnedByTrustedInstallerOrSimilar(hFile, pwszName))
    938938            return rc;
    … …  
    944944     * Anything that's owned by the trusted installer.
    945945     */
    946     if (   (fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER)
     946    if (   (fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER)
    947947        || supHardNtViCheckIsOwnedByTrustedInstallerOrSimilar(hFile, pwszName))
    948948        return VINF_LDRVI_NOT_SIGNED;
    … …  
    12281228    {
    12291229#ifdef IN_RING3 /* Hack alert! (see above) */
    1230 # ifndef VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK
    12311230        if (   (pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING)
    12321231            && (pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT)
    12331232            && uTimestamp < g_uBuildTimestampHack)
    12341233            uTimestamp = g_uBuildTimestampHack;
    1235 # endif
    12361234#endif
    12371235        RTTimeSpecSetSeconds(&aTimes[0].TimeSpec, uTimestamp);
    … …  
    13821380    /** @todo Since we're now allowing Builtin\\Administrators after all, perhaps we
    13831381     *        could drop these system32 + winsxs hacks?? */
    1384     if (   (pNtViRdr->fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER)
     1382    if (   (pNtViRdr->fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER)
    13851383        && !supHardNtViCheckIsOwnedByTrustedInstallerOrSimilar(pNtViRdr->hFile, pwszName))
    13861384    {
    … …  
    14311429        RTErrInfoAddF(pErrInfo, rc, ": %ls", pwszName);
    14321430
    1433 #ifndef VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK
    14341431    /*
    14351432     * Check for the signature checking enforcement, if requested to do so.
    … …  
    14461443                               "The image '%ls' was not linked with /IntegrityCheck.", pwszName);
    14471444    }
    1448 #endif
    14491445
    14501446#ifdef IN_RING3

  • TabularUnified trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

    r104381 r104384  
    21482148     */
    21492149    uint32_t fFlags = fDll
    2150                     ? SUPHNTVI_F_TRUSTED_INSTALLER_OWNER | SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION
     2150                    ? SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER | SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION
    21512151                    : SUPHNTVI_F_REQUIRE_BUILD_CERT;
    21522152    if (f32bitResourceDll)
    … …  
    23952395                                   rcNt, pThis->hProcess);
    23962396    }
    2397 #ifndef VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK
     2397#ifndef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT /* A kernel code signing cert is only via way to use /IntegrityCheck. */
    23982398    if ( !(ImageInfo.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY))
    23992399        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EXE_MISSING_FORCE_INTEGRITY,

  • TabularUnified trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

    r104381 r104384  
    14781478    /*
    14791479     * Check the path.  We don't allow DLLs to be loaded from just anywhere:
    1480      *      1. System32      - normal code or cat signing, owner TrustedInstaller.
    1481      *      2. WinSxS        - normal code or cat signing, owner TrustedInstaller.
    1482      *      3. VirtualBox    - build cert code signing, and owner TrustedInstaller unless integrity check is enabled.
    1483      *      4. AppPatchDir   - normal code or cat signing, owner TrustedInstaller.
    1484      *      5. Program Files - normal code or cat signing, owner TrustedInstaller.
    1485      *      6. Common Files  - normal code or cat signing, owner TrustedInstaller.
     1480     *      1. System32      - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1481     *      2. WinSxS        - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1482     *      3. VirtualBox    - build with:
     1483     *         - regular code signing cert: build cert code signing, owner TrustedInstaller/Administrators/LocalSystem.
     1484     *         - kernel code signing cert:  kernel code signing and integrity checks.
     1485     *      4. AppPatchDir   - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1486     *      5. Program Files - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1487     *      6. Common Files  - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
    14861488     *      7. x86 variations of 4 & 5 - ditto.
     1489     *
     1490     * Note! VBOX_WITHOUT_KERNEL_CODE_SIGNING_CERT means the /IntegrityCheck does
     1491     *       work as it doesn't seems like MS has come up with a generally accessible
     1492     *       alternative to the expired kernel code signing scheme for using this
     1493     *       securty enhancement.
    14871494     */
    14881495    uint32_t fFlags = 0;
    14891496    if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_System32NtPath.UniStr, true /*fCheckSlash*/))
    1490         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1497        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    14911498    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_WinSxSNtPath.UniStr, true /*fCheckSlash*/))
    1492         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1499        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    14931500    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedAppBinNtPath.UniStr, true /*fCheckSlash*/))
    1494 # ifndef VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK
     1501# ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
     1502        /** @todo r=bird: See SUPHNTVI_F_REQUIRE_BUILD_CERT comment below (in the
     1503         *        code that's actually used). */
     1504        fFlags |= SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
     1505# else
    14951506        fFlags |= SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING | SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT;
    1496 # else
    1497         fFlags |= SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
    14981507# endif
    1499     }
    15001508# ifdef VBOX_PERMIT_MORE
    15011509    else if (supHardViIsAppPatchDir(uBuf.UniStr.Buffer, uBuf.UniStr.Length / sizeof(WCHAR)))
    1502         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1510        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15031511    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_ProgramFilesNtPath.UniStr, true /*fCheckSlash*/))
    1504         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1512        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15051513    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_CommonFilesNtPath.UniStr, true /*fCheckSlash*/))
    1506         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1514        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15071515#  ifdef RT_ARCH_AMD64
    15081516    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_ProgramFilesX86NtPath.UniStr, true /*fCheckSlash*/))
    1509         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1517        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15101518    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_CommonFilesX86NtPath.UniStr, true /*fCheckSlash*/))
    1511         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1519        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15121520#  endif
    15131521# endif
    … …  
    15371545    /*
    15381546     * Require trusted installer + some kind of signature on everything, except
    1539      * for the VBox bits where we require a specific certificate and maybe special
    1540      * integrity checks.
     1547     * for the VBox bits where we have extra requirements depending on the signing
     1548     * certificate used:
     1549     *         - regular code signing cert: build cert code signing, owner TrustedInstaller/Administrators/LocalSystem.
     1550     *         - kernel code signing cert:  kernel code signing and integrity checks.
    15411551     */
    15421552    uint32_t fFlags = 0;
    15431553    if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedAppBinNtPath.UniStr, true /*fCheckSlash*/))
    1544     {
    1545 # ifndef VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK
     1554# ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
     1555        /** @todo r=bird: Since extension packs are installed under
     1556         * g_SupLibHardenedAppBinNtPath and I'm pretty sure that everything loaded into
     1557         * a VBox VM process goes thru this validation step at DLL load time, this means
     1558         * only we can now sign extension packs.
     1559         *
     1560         * I suspect we have to relax the signing restrictions on the ExtensionPacks
     1561         * subdirectory to keep 3rd party extensions working.  */
     1562        fFlags |= SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
     1563# else
    15461564        fFlags |= SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING | SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT;
    1547 # else
    1548         fFlags |= SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
    15491565# endif
    1550     }
    15511566    else
    1552         fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER;
     1567        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15531568#endif /* VBOX_PERMIT_EVEN_MORE */
    15541569
Note: See TracChangeset for help on using the changeset viewer.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette