Document Veriexec strict levels (hm, maybe we should have veriexec(8)?)

as requested by Adam Hamsik.

share/man/man8/security.8

@@ -1,4 +1,4 @@
-.\" $NetBSD: security.8,v 1.6 2006/11/22 13:00:02 elad Exp $
+.\" $NetBSD: security.8,v 1.7 2006/11/23 13:23:22 elad Exp $
 .\"
 .\" Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
 .\" All rights reserved.
@@ -28,7 +28,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd November 22, 2006
+.Dd November 23, 2006
 .Dt SECURITY 8
 .Os
 .Sh NAME
@@ -48,11 +48,71 @@ It can be used for a variety of purposes, including defense against trojanned
 binaries, indirect attacks via third-party remote file-systems, and
 config file corruption.
 It can operate in four modes, also referred to as strict levels:
-.Em learning mode ,
-.Em IDS mode ,
-.Em IPS mode ,
+.Bl -tag -width flag
+.It Learning mode ( strict level 0 )
+The only level at which the fingerprint tables can be modified, this level is
+used to help fine-tune the signature database.
+No enforcement is made, and verbose information is provided (fingerprint
+matches and mismatches, file removals, incorrect access, etc.).
+.It IDS mode ( strict level 1 )
+IDS (intrusion detection system) mode provides an adequate level of integrity
+for the files it monitors.
+Implications:
+.Pp
+.Bl -hyphen -compact
+.It
+Monitored files cannot be removed
+.It
+If raw disk access is granted to a disk with monitored files on it, all
+monitored files' fingerprints will be invalidated
+.It
+Access to files with mismatched fingerprints is denied
+.It
+Write access to monitored files is allowed
+.It
+Access type is not enforced
+.El
+.It IPS mode ( strict level 2 )
+IPS (intrusion prevention system) mode provides a high level of integrity
+for the files it monitors.
+Implications:
+.Pp
+.Bl -hyphen -compact
+.It
+All implications of IDS mode
+.It
+Write access to monitored files is denied
+.It
+Access type is enforced
+.It
+Raw disk access to disk devices with monitored files on them is denied
+.It
+Execution of non-monitored files is denied
+.It
+Write access to kernel memory via
+.Pa /dev/mem
 and
-.Em lockdown mode .
+.Pa /dev/kmem
+is denied
+.El
+.It Lockdown mode ( strict level 3 )
+Lockdown mode provides high assurance integrity for the entire system.
+Implications:
+.Pp
+.Bl -hyphen -compact
+.It
+All implications of IPS mode
+.It
+Access to non-monitored files is denied
+.It
+Write access to files is allowed only if the file was opened before the
+strict level was raised to this mode
+.It
+Creation of new files is denied
+.It
+Raw access to system disks is denied
+.El
+.El
 .Pp
 .Em Veriexec
 requires a list of monitored files, along with their digital fingerprint and
@@ -179,7 +239,7 @@ can be done like this:
 .Bd -literal -offset indent
 # paxctl +g /bin/ls
 .Ed
-.Ss GCC Stack Smashing Protection (SSP)
+.Ss GCC Stack Smashing Protection ( SSP )
 Since
 .Nx 4.0 ,
 .Xr gcc 1
@@ -202,7 +262,7 @@ The system (userland, kernel) can be built with
 by using the
 .Dq USE_SSP
 flag in
-.Pa /etc/mk.conf:
+.Pa /etc/mk.conf :
 .Bd -literal -offset indent
 USE_SSP=yes
 .Ed