Enhance file integrity check to perform verification during system bootup 7.4.4

This enhancement improves upon previous BIOS-level and real-time file integrity checks by requiring the kernel to verify the signed hashes of important file-system and object files during bootup. This prevents unauthorized changes to file-systems to be mounted and other unauthorized objects to be loaded into user space on bootup.

This verification does not depend on the security level of the device. The verification will always run when the firmware image type is a GA, SA, Beta, or Top3 image. If the signed hash verification fails, the system will halt during bootup.

This enhancement supplements previous security measures to validate the firmware, AV, and IPS packages in the BIOS (see Enhance BIOS-level signature and file integrity checking), as well as performing real-time binary and executable integrity checks in user space (see Real-time file system integrity checking).

Example

Upon detection of an altered IPS library file upon bootup, the system will halt as follows:

FortiGate-60E (18:03-01.27.2017)
Ver:05000012
Serial number: FGT60ETK1804xxxx
CPU: 1000MHz
Total RAM: 2 GB
Initializing boot device...
Initializing MAC... nplite#0
Please wait for OS to boot, or press any key to display configuration menu......

Booting OS...
Reading boot image... 2891501 bytes.
Initializing firewall...
fos_ima: System Integrity check failed....   
CPU3: stopping
CPU1: stopping
CPU0: stopping

The exact display in the CLI may vary depending on the model of device, security level, or reasons for the failed verification.