Enhance real-time file system integrity checking 7.4.4

In this enhancement, a hash of all executable binary files and shared libraries are taken during image build time. The file containing these hashes, called the executable hash, is also hashed. This new hash is signed together with other important files like the FortiOS firmware, AV and IPS engine files. This hash will follow the BIOS-level signature and integrity check during the boot process, to prevent any unauthorized changes from being loaded.

Once the integrity of the hash is verified, the corresponding hashes of every executable and shared library can be extracted from the executable hash and loaded into memory. When each executable and shared library is initialized, it will be verified against its respective hashes to ensure integrity. If any mismatch is found, the real-time file system integrity checking action will be taken, either by printing error messages or rebooting the system.

Additionally, files that are not in the list of executable and shared library will have executable permissions removed. Permissions for changing the executability of any files is also locked.