SUPR3HardenedVerify.cpp@ 29826

Last change on this file since 29826 was 29250, checked in by vboxsync, 14 years ago
iprt/asm.h: split out asm-math.h, don't include asm-.h from asm.h, don't include asm.h from sup.h. Fixed a couple file headers.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 31.5 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 29250 2010-05-09 17:53:58Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/*******************************************************************************
28	* Header Files *
29	*******************************************************************************/
30	#if defined(RT_OS_OS2)
31	# define INCL_BASE
32	# define INCL_ERRORS
33	# include <os2.h>
34	# include <stdio.h>
35	# include <stdlib.h>
36	# include <unistd.h>
37	# include <sys/fcntl.h>
38	# include <sys/errno.h>
39	# include <sys/syslimits.h>
40
41	#elif defined(RT_OS_WINDOWS)
42	# include <Windows.h>
43	# include <stdio.h>
44
45	#else /* UNIXes */
46	# include <sys/types.h>
47	# include <stdio.h>
48	# include <stdlib.h>
49	# include <dlfcn.h>
50	# include <fcntl.h>
51	# include <limits.h>
52	# include <errno.h>
53	# include <unistd.h>
54	# include <sys/stat.h>
55	# include <sys/time.h>
56	# include <sys/fcntl.h>
57	# include <stdio.h>
58	# include <pwd.h>
59	# ifdef RT_OS_DARWIN
60	# include <mach-o/dyld.h>
61	# endif
62
63	#endif
64
65	#include <VBox/sup.h>
66	#include <VBox/err.h>
67	#include <iprt/asm.h>
68	#include <iprt/string.h>
69	#include <iprt/param.h>
70
71	#include "SUPLibInternal.h"
72
73
74
75
76	/*******************************************************************************
77	* Global Variables *
78	*******************************************************************************/
79	/**
80	* The files that gets verified.
81	*
82	* @todo This needs reviewing against the linux packages.
83	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
84	* the time being we're building the linux packages with SharedLib pointing to
85	* AppPrivArch (lazy bird).
86	*/
87	static SUPINSTFILE const g_aSupInstallFiles[] =
88	{
89	/* type, dir, fOpt, "pszFile" */
90	/* ---------------------------------------------------------------------- */
91	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
92	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
93	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
94
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
96	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
97	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
98
99	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
100	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
101	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
102	#if HC_ARCH_BITS == 32
103	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
104	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
105	#endif
106	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
107	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
108	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
109
110	//#ifdef VBOX_WITH_DEBUGGER_GUI
111	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
112	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
113	//#endif
114
115	//#ifdef VBOX_WITH_SHARED_CLIPBOARD
116	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
117	//#endif
118	//#ifdef VBOX_WITH_SHARED_FOLDERS
119	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
120	//#endif
121	//#ifdef VBOX_WITH_GUEST_PROPS
122	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
123	//#endif
124	//#ifdef VBOX_WITH_GUEST_CONTROL
125	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestControlSvc" SUPLIB_DLL_SUFF },
126	//#endif
127	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
128	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
129	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
130	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
131
132	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
133
134	#ifdef VBOX_WITH_MAIN
135	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
136	#ifdef RT_OS_WINDOWS
137	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
138	#else
139	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
140	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
141	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
142	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
143	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
144	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
145	#endif
146	#endif
147
148	//#ifdef VBOX_WITH_VRDP
149	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
150	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
151	//#endif
152
153	//#ifdef VBOX_WITH_HEADLESS
154	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
155	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
156	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
157	//#endif
158
159	//#ifdef VBOX_WITH_QTGUI
160	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
161	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
162	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
163	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
164	# endif
165	//#endif
166
167	//#ifdef VBOX_WITH_VBOXSDL
168	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
169	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
170	//#endif
171
172	//#ifdef VBOX_WITH_VBOXBFE
173	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
174	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
175	//#endif
176
177	//#ifdef VBOX_WITH_WEBSERVICES
178	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
179	//#endif
180
181	#ifdef RT_OS_LINUX
182	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
183	#endif
184
185	//#ifdef VBOX_WITH_NETFLT
186	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
187	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
188	//#endif
189	};
190
191
192	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
193	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
194
195	/** Array index by install directory specifier containing info about verified directories. */
196	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
197
198
199	/**
200	* Assembles the path to a dirtory.
201	*
202	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
203	* decides whether it returns or not).
204	*
205	* @param enmDir The directory.
206	* @param pszDst Where to assemble the path.
207	* @param cchDst The size of the buffer.
208	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
209	*/
210	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
211	{
212	int rc;
213	switch (enmDir)
214	{
215	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
216	case kSupID_Bin:
217	rc = supR3HardenedPathExecDir(pszDst, cchDst);
218	break;
219	case kSupID_SharedLib:
220	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
221	break;
222	case kSupID_AppPrivArch:
223	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
224	break;
225	case kSupID_AppPrivArchComp:
226	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
227	if (RT_SUCCESS(rc))
228	{
229	size_t off = strlen(pszDst);
230	if (cchDst - off >= sizeof("/components"))
231	memcpy(&pszDst[off], "/components", sizeof("/components"));
232	else
233	rc = VERR_BUFFER_OVERFLOW;
234	}
235	break;
236	case kSupID_AppPrivNoArch:
237	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
238	break;
239	default:
240	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
241	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
242	}
243	if (RT_FAILURE(rc))
244	supR3HardenedError(rc, fFatal,
245	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
246	return rc;
247	}
248
249
250
251	/**
252	* Assembles the path to a file table entry, with or without the actual filename.
253	*
254	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
255	* decides whether it returns or not).
256	*
257	* @param pFile The file table entry.
258	* @param pszDst Where to assemble the path.
259	* @param cchDst The size of the buffer.
260	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
261	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
262	*/
263	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
264	{
265	/*
266	* Combine supR3HardenedMakePath and the filename.
267	*/
268	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
269	if (RT_SUCCESS(rc))
270	{
271	size_t cchFile = strlen(pFile->pszFile);
272	size_t off = strlen(pszDst);
273	if (cchDst - off >= cchFile + 2)
274	{
275	pszDst[off++] = '/';
276	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
277	}
278	else
279	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
280	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
281	pFile->pszFile, (long)off);
282	}
283	return rc;
284	}
285
286
287	/**
288	* Verifies a directory.
289	*
290	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
291	* fFatal is clear and if it's set the function wont return.
292	* @param enmDir The directory specifier.
293	* @param fFatal Whether validation failures should be treated as
294	* fatal (true) or not (false).
295	*/
296	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
297	{
298	/*
299	* Validate the index just to be on the safe side...
300	*/
301	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
302	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
303	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
304
305	/*
306	* Already validated?
307	*/
308	if (g_aSupVerifiedDirs[enmDir].fValidated)
309	return VINF_SUCCESS; /** @todo revalidate? */
310
311	/* initialize the entry. */
312	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
313	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
314	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
315	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
316	g_aSupVerifiedDirs[enmDir].hDir = -1;
317	g_aSupVerifiedDirs[enmDir].fValidated = false;
318
319	/*
320	* Make the path and open the directory.
321	*/
322	char szPath[RTPATH_MAX];
323	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
324	if (RT_SUCCESS(rc))
325	{
326	#if defined(RT_OS_WINDOWS)
327	HANDLE hDir = CreateFile(szPath,
328	GENERIC_READ,
329	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
330	NULL,
331	OPEN_ALWAYS,
332	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
333	NULL);
334	if (hDir != INVALID_HANDLE_VALUE)
335	{
336	/** @todo check the type */
337	/* That's all on windows, for now at least... */
338	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
339	g_aSupVerifiedDirs[enmDir].fValidated = true;
340	}
341	else
342	{
343	int err = GetLastError();
344	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
345	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
346	szPath, err);
347	}
348	#else /* UNIXY */
349	int fd = open(szPath, O_RDONLY, 0);
350	if (fd >= 0)
351	{
352	/*
353	* On unixy systems we'll make sure the directory is owned by root
354	* and not writable by the group and user.
355	*/
356	struct stat st;
357	if (!fstat(fd, &st))
358	{
359
360	if ( st.st_uid == 0
361	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
362	&& S_ISDIR(st.st_mode))
363	{
364	g_aSupVerifiedDirs[enmDir].hDir = fd;
365	g_aSupVerifiedDirs[enmDir].fValidated = true;
366	}
367	else
368	{
369	if (!S_ISDIR(st.st_mode))
370	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
371	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
372	szPath, (long)st.st_uid);
373	else if (st.st_uid)
374	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
375	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
376	szPath, (long)st.st_uid);
377	else
378	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
379	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
380	szPath, (long)st.st_mode);
381	close(fd);
382	}
383	}
384	else
385	{
386	int err = errno;
387	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
388	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
389	szPath, strerror(err), err);
390	close(fd);
391	}
392	}
393	else
394	{
395	int err = errno;
396	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
397	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
398	szPath, strerror(err), err);
399	}
400	#endif /* UNIXY */
401	}
402
403	return rc;
404	}
405
406
407	/**
408	* Verifies a file entry.
409	*
410	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
411	* fFatal is clear and if it's set the function wont return.
412	*
413	* @param iFile The file table index of the file to be verified.
414	* @param fFatal Whether validation failures should be treated as
415	* fatal (true) or not (false).
416	* @param fLeaveFileOpen Whether the file should be left open.
417	*/
418	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
419	{
420	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
421	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
422
423	/*
424	* Already done?
425	*/
426	if (pVerified->fValidated)
427	return VINF_SUCCESS; /** @todo revalidate? */
428
429
430	/* initialize the entry. */
431	if (pVerified->hFile != 0)
432	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
433	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
434	(void *)pVerified->hFile, pFile->pszFile);
435	pVerified->hFile = -1;
436	pVerified->fValidated = false;
437
438	/*
439	* Verify the directory then proceed to open it.
440	* (This'll make sure the directory is opened and that we can (later)
441	* use openat if we wish.)
442	*/
443	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
444	if (RT_SUCCESS(rc))
445	{
446	char szPath[RTPATH_MAX];
447	rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
448	if (RT_SUCCESS(rc))
449	{
450	#if defined(RT_OS_WINDOWS)
451	HANDLE hFile = CreateFile(szPath,
452	GENERIC_READ,
453	FILE_SHARE_READ,
454	NULL,
455	OPEN_ALWAYS,
456	FILE_ATTRIBUTE_NORMAL,
457	NULL);
458	if (hFile != INVALID_HANDLE_VALUE)
459	{
460	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
461	{
462	/* it's valid. */
463	if (fLeaveFileOpen)
464	pVerified->hFile = (intptr_t)hFile;
465	else
466	CloseHandle(hFile);
467	pVerified->fValidated = true;
468	}
469	}
470	else
471	{
472	int err = GetLastError();
473	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
474	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
475	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
476	szPath, err);
477	}
478	#else /* UNIXY */
479	int fd = open(szPath, O_RDONLY, 0);
480	if (fd >= 0)
481	{
482	/*
483	* On unixy systems we'll make sure the directory is owned by root
484	* and not writable by the group and user.
485	*/
486	struct stat st;
487	if (!fstat(fd, &st))
488	{
489	if ( st.st_uid == 0
490	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
491	&& S_ISREG(st.st_mode))
492	{
493	/* it's valid. */
494	if (fLeaveFileOpen)
495	pVerified->hFile = fd;
496	else
497	close(fd);
498	pVerified->fValidated = true;
499	}
500	else
501	{
502	if (!S_ISREG(st.st_mode))
503	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
504	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
505	szPath, (long)st.st_uid);
506	else if (st.st_uid)
507	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
508	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
509	szPath, (long)st.st_uid);
510	else
511	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
512	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
513	szPath, (long)st.st_mode);
514	close(fd);
515	}
516	}
517	else
518	{
519	int err = errno;
520	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
521	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
522	szPath, strerror(err), err);
523	close(fd);
524	}
525	}
526	else
527	{
528	int err = errno;
529	if (!pFile->fOptional \|\| err != ENOENT)
530	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
531	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
532	szPath, strerror(err), err);
533	}
534	#endif /* UNIXY */
535	}
536	}
537
538	return rc;
539	}
540
541
542	/**
543	* Verifies that the specified table entry matches the given filename.
544	*
545	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
546	* error is returned or we terminate the application.
547	*
548	* @param iFile The file table index.
549	* @param pszFilename The filename.
550	* @param fFatal Whether validation failures should be treated as
551	* fatal (true) or not (false).
552	*/
553	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
554	{
555	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
556
557	/*
558	* Construct the full path for the file table entry
559	* and compare it with the specified file.
560	*/
561	char szName[RTPATH_MAX];
562	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
563	if (RT_FAILURE(rc))
564	return rc;
565	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
566	if (stricmp(szName, pszFilename))
567	#else
568	if (strcmp(szName, pszFilename))
569	#endif
570	{
571	/*
572	* Normalize the two paths and compare again.
573	*/
574	rc = VERR_NOT_SAME_DEVICE;
575	#if defined(RT_OS_WINDOWS)
576	LPSTR pszIgnored;
577	char szName2[RTPATH_MAX];
578	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
579	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
580	if (!stricmp(szName2, szName))
581	rc = VINF_SUCCESS;
582	#else
583	AssertCompile(RTPATH_MAX >= PATH_MAX);
584	char szName2[RTPATH_MAX];
585	if ( realpath(szName, szName2) != NULL
586	&& realpath(pszFilename, szName) != NULL)
587	if (!strcmp(szName2, szName))
588	rc = VINF_SUCCESS;
589	#endif
590
591	if (RT_FAILURE(rc))
592	{
593	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
594	return supR3HardenedError(rc, fFatal,
595	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
596	pszFilename, szName);
597	}
598	}
599
600	/*
601	* Check more stuff like the stat info if it's an already open file?
602	*/
603
604
605
606	return VINF_SUCCESS;
607	}
608
609
610	/**
611	* Verifies a file.
612	*
613	* @returns VINF_SUCCESS on success.
614	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
615	* On verfication failure, an error code will be returned when fFatal is clear,
616	* otherwise the program will be termindated.
617	*
618	* @param pszFilename The filename.
619	* @param fFatal Whether validation failures should be treated as
620	* fatal (true) or not (false).
621	*/
622	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
623	{
624	/*
625	* Lookup the file and check if it's the same file.
626	*/
627	const char *pszName = supR3HardenedPathFilename(pszFilename);
628	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
629	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
630	{
631	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
632	if (RT_SUCCESS(rc))
633	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
634	return rc;
635	}
636
637	return VERR_NOT_FOUND;
638	}
639
640
641	/**
642	* Verifies a program, worker for supR3HardenedVerifyAll.
643	*
644	* @returns See supR3HardenedVerifyAll.
645	* @param pszProgName See supR3HardenedVerifyAll.
646	* @param fFatal See supR3HardenedVerifyAll.
647	*/
648	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
649	{
650	/*
651	* Search the table looking for the executable and the DLL/DYLIB/SO.
652	*/
653	int rc = VINF_SUCCESS;
654	bool fExe = false;
655	bool fDll = false;
656	size_t const cchProgName = strlen(pszProgName);
657	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
658	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
659	{
660	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
661	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
662	{
663	/* This only has to be found (once). */
664	if (fDll)
665	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
666	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
667	fDll = true;
668	}
669	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
670	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
671	{
672	/* Here we'll have to check that the specific program is the same as the entry. */
673	if (fExe)
674	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
675	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
676	fExe = true;
677
678	char szFilename[RTPATH_MAX];
679	int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
680	if (RT_SUCCESS(rc2))
681	{
682	strcat(szFilename, "/");
683	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
684	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
685	}
686	else
687	rc = supR3HardenedError(rc2, fFatal,
688	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
689	}
690	}
691
692	/*
693	* Check the findings.
694	*/
695	if (!fDll && !fExe)
696	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
697	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
698	else if (!fExe)
699	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
700	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
701	else if (!fDll)
702	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
703	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
704	return rc;
705	}
706
707
708
709	/**
710	* Verifies all the known files.
711	*
712	* @returns VINF_SUCCESS on success.
713	* On verfication failure, an error code will be returned when fFatal is clear,
714	* otherwise the program will be termindated.
715	*
716	* @param fFatal Whether validation failures should be treated as
717	* fatal (true) or not (false).
718	* @param fLeaveFilesOpen If set, all the verfied files are left open.
719	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
720	* to verify that both the executable and corresponding
721	* DLL/DYLIB/SO are valid.
722	*/
723	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
724	{
725	/*
726	* The verify all the files.
727	*/
728	int rc = VINF_SUCCESS;
729	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
730	{
731	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
732	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
733	rc = rc2;
734	}
735
736	/*
737	* Verify the program name if specified, that is to say, just check that
738	* it's in the table (=> we've already verified it).
739	*/
740	if (pszProgName)
741	{
742	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
743	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
744	rc2 = rc;
745	}
746
747	return rc;
748	}
749
750
751	/**
752	* Gets the pre-init data for the hand-over to the other version
753	* of this code.
754	*
755	* The reason why we pass this information on is that it contains
756	* open directories and files. Later it may include even more info
757	* (int the verified arrays mostly).
758	*
759	* The receiver is supR3HardenedRecvPreInitData.
760	*
761	* @param pPreInitData Where to store it.
762	*/
763	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
764	{
765	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
766	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
767	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
768
769	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
770	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
771	}
772
773
774	/**
775	* Receives the pre-init data from the static executable stub.
776	*
777	* @returns VBox status code. Will not bitch on failure since the
778	* runtime isn't ready for it, so that is left to the exe stub.
779	*
780	* @param pPreInitData The hand-over data.
781	*/
782	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
783	{
784	/*
785	* Compare the array lengths and the contents of g_aSupInstallFiles.
786	*/
787	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
788	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
789	return VERR_VERSION_MISMATCH;
790	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
791	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
792	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
793	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
794	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
795	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
796	return VERR_VERSION_MISMATCH;
797
798	/*
799	* Check that we're not called out of order.
800	* If dynamic linking it screwed up, we may end up here.
801	*/
802	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
803	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
804	return VERR_WRONG_ORDER;
805
806	/*
807	* Copy the verification data over.
808	*/
809	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
810	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
811	return VINF_SUCCESS;
812	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 29826

Download in other formats: