SUPR3HardenedMain.cpp@ 27877

Last change on this file since 27877 was 27877, checked in by vboxsync, 15 years ago
linux/hardened: call prctl(PR_SET_DUMPABLE) to make VBox binaries dump ELF core files (if allowed by ulimit -c)
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 34.6 KB

Line
1	/* $Id: SUPR3HardenedMain.cpp 27877 2010-03-31 10:29:46Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Hardened main().
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39	# include <stdlib.h>
40	# include <dlfcn.h>
41
42	#elif RT_OS_WINDOWS
43	# include <Windows.h>
44	# include <stdio.h>
45
46	#else /* UNIXes */
47	# include <iprt/types.h> /* stdint fun on darwin. */
48
49	# include <stdio.h>
50	# include <stdlib.h>
51	# include <dlfcn.h>
52	# include <limits.h>
53	# include <errno.h>
54	# include <unistd.h>
55	# include <sys/stat.h>
56	# include <sys/time.h>
57	# include <stdio.h>
58	# include <sys/types.h>
59	# if defined(RT_OS_LINUX)
60	# undef USE_LIB_PCAP /* don't depend on libcap as we had to depend on either
61	libcap1 or libcap2 */
62
63	# undef _POSIX_SOURCE
64	# include <sys/capability.h>
65	# include <sys/prctl.h>
66	# ifndef CAP_TO_MASK
67	# define CAP_TO_MASK(cap) RT_BIT(cap)
68	# endif
69	# elif defined(RT_OS_FREEBSD)
70	# include <sys/param.h>
71	# include <sys/sysctl.h>
72	# elif defined(RT_OS_SOLARIS)
73	# include <priv.h>
74	# endif
75	# include <pwd.h>
76	# ifdef RT_OS_DARWIN
77	# include <mach-o/dyld.h>
78	# endif
79
80	#endif
81
82	#include <VBox/sup.h>
83	#include <VBox/err.h>
84	#include <iprt/string.h>
85	#include <iprt/param.h>
86
87	#include "SUPLibInternal.h"
88
89
90	/*******************************************************************************
91	* Defined Constants And Macros *
92	*******************************************************************************/
93	/** @def SUP_HARDENED_SUID
94	* Whether we're employing set-user-ID-on-execute in the hardening.
95	*/
96	#if !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_L4)
97	# define SUP_HARDENED_SUID
98	#else
99	# undef SUP_HARDENED_SUID
100	#endif
101
102	/** @def SUP_HARDENED_SYM
103	* Decorate a symbol that's resolved dynamically.
104	*/
105	#ifdef RT_OS_OS2
106	# define SUP_HARDENED_SYM(sym) "_" sym
107	#else
108	# define SUP_HARDENED_SYM(sym) sym
109	#endif
110
111
112	/*******************************************************************************
113	* Structures and Typedefs *
114	*******************************************************************************/
115	/** @see RTR3InitEx */
116	typedef DECLCALLBACK(int) FNRTR3INITEX(uint32_t iVersion, const char *pszProgramPath, bool fInitSUPLib);
117	typedef FNRTR3INITEX *PFNRTR3INITEX;
118
119
120	/*******************************************************************************
121	* Global Variables *
122	*******************************************************************************/
123	/** The pre-init data we pass on to SUPR3 (residing in VBoxRT). */
124	static SUPPREINITDATA g_SupPreInitData;
125	/** The progam executable path. */
126	static char g_szSupLibHardenedExePath[RTPATH_MAX];
127	/** The program directory path. */
128	static char g_szSupLibHardenedDirPath[RTPATH_MAX];
129
130	/** The program name. */
131	static const char *g_pszSupLibHardenedProgName;
132
133	#ifdef SUP_HARDENED_SUID
134	/** The real UID at startup. */
135	static uid_t g_uid;
136	/** The real GID at startup. */
137	static gid_t g_gid;
138	# ifdef RT_OS_LINUX
139	static uint32_t g_uCaps;
140	# endif
141	#endif
142
143
144	/*******************************************************************************
145	* Internal Functions *
146	*******************************************************************************/
147	#ifdef SUP_HARDENED_SUID
148	static void supR3HardenedMainDropPrivileges(void);
149	#endif
150	static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName);
151
152
153	/**
154	* @copydoc RTPathStripFilename.
155	*/
156	static void suplibHardenedPathStripFilename(char *pszPath)
157	{
158	char *psz = pszPath;
159	char *pszLastSep = pszPath;
160
161	for (;; psz++)
162	{
163	switch (*psz)
164	{
165	/* handle separators. */
166	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
167	case ':':
168	pszLastSep = psz + 1;
169	break;
170
171	case '\\':
172	#endif
173	case '/':
174	pszLastSep = psz;
175	break;
176
177	/* the end */
178	case '\0':
179	if (pszLastSep == pszPath)
180	*pszLastSep++ = '.';
181	*pszLastSep = '\0';
182	return;
183	}
184	}
185	/* will never get here */
186	}
187
188
189	/**
190	* @copydoc RTPathFilename
191	*/
192	DECLHIDDEN(char ) supR3HardenedPathFilename(const char pszPath)
193	{
194	const char *psz = pszPath;
195	const char *pszLastComp = pszPath;
196
197	for (;; psz++)
198	{
199	switch (*psz)
200	{
201	/* handle separators. */
202	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
203	case ':':
204	pszLastComp = psz + 1;
205	break;
206
207	case '\\':
208	#endif
209	case '/':
210	pszLastComp = psz + 1;
211	break;
212
213	/* the end */
214	case '\0':
215	if (*pszLastComp)
216	return (char )(void )pszLastComp;
217	return NULL;
218	}
219	}
220
221	/* will never get here */
222	return NULL;
223	}
224
225
226	/**
227	* @copydoc RTPathAppPrivateNoArch
228	*/
229	DECLHIDDEN(int) supR3HardenedPathAppPrivateNoArch(char *pszPath, size_t cchPath)
230	{
231	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE)
232	const char *pszSrcPath = RTPATH_APP_PRIVATE;
233	size_t cchPathPrivateNoArch = strlen(pszSrcPath);
234	if (cchPathPrivateNoArch >= cchPath)
235	supR3HardenedFatal("supR3HardenedPathAppPrivateNoArch: Buffer overflow, %lu >= %lu\n",
236	(unsigned long)cchPathPrivateNoArch, (unsigned long)cchPath);
237	memcpy(pszPath, pszSrcPath, cchPathPrivateNoArch + 1);
238	return VINF_SUCCESS;
239
240	#else
241	return supR3HardenedPathExecDir(pszPath, cchPath);
242	#endif
243	}
244
245
246	/**
247	* @copydoc RTPathAppPrivateArch
248	*/
249	DECLHIDDEN(int) supR3HardenedPathAppPrivateArch(char *pszPath, size_t cchPath)
250	{
251	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE_ARCH)
252	const char *pszSrcPath = RTPATH_APP_PRIVATE_ARCH;
253	size_t cchPathPrivateArch = strlen(pszSrcPath);
254	if (cchPathPrivateArch >= cchPath)
255	supR3HardenedFatal("supR3HardenedPathAppPrivateArch: Buffer overflow, %lu >= %lu\n",
256	(unsigned long)cchPathPrivateArch, (unsigned long)cchPath);
257	memcpy(pszPath, pszSrcPath, cchPathPrivateArch + 1);
258	return VINF_SUCCESS;
259
260	#else
261	return supR3HardenedPathExecDir(pszPath, cchPath);
262	#endif
263	}
264
265
266	/**
267	* @copydoc RTPathSharedLibs
268	*/
269	DECLHIDDEN(int) supR3HardenedPathSharedLibs(char *pszPath, size_t cchPath)
270	{
271	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_SHARED_LIBS)
272	const char *pszSrcPath = RTPATH_SHARED_LIBS;
273	size_t cchPathSharedLibs = strlen(pszSrcPath);
274	if (cchPathSharedLibs >= cchPath)
275	supR3HardenedFatal("supR3HardenedPathSharedLibs: Buffer overflow, %lu >= %lu\n",
276	(unsigned long)cchPathSharedLibs, (unsigned long)cchPath);
277	memcpy(pszPath, pszSrcPath, cchPathSharedLibs + 1);
278	return VINF_SUCCESS;
279
280	#else
281	return supR3HardenedPathExecDir(pszPath, cchPath);
282	#endif
283	}
284
285
286	/**
287	* @copydoc RTPathAppDocs
288	*/
289	DECLHIDDEN(int) supR3HardenedPathAppDocs(char *pszPath, size_t cchPath)
290	{
291	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_DOCS)
292	const char *pszSrcPath = RTPATH_APP_DOCS;
293	size_t cchPathAppDocs = strlen(pszSrcPath);
294	if (cchPathAppDocs >= cchPath)
295	supR3HardenedFatal("supR3HardenedPathAppDocs: Buffer overflow, %lu >= %lu\n",
296	(unsigned long)cchPathAppDocs, (unsigned long)cchPath);
297	memcpy(pszPath, pszSrcPath, cchPathAppDocs + 1);
298	return VINF_SUCCESS;
299
300	#else
301	return supR3HardenedPathExecDir(pszPath, cchPath);
302	#endif
303	}
304
305
306	/**
307	* Returns the full path to the executable.
308	*
309	* @returns IPRT status code.
310	* @param pszPath Where to store it.
311	* @param cchPath How big that buffer is.
312	*/
313	static void supR3HardenedGetFullExePath(void)
314	{
315	/*
316	* Get the program filename.
317	*
318	* Most UNIXes have no API for obtaining the executable path, but provides a symbolic
319	* link in the proc file system that tells who was exec'ed. The bad thing about this
320	* is that we have to use readlink, one of the weirder UNIX APIs.
321	*
322	* Darwin, OS/2 and Windows all have proper APIs for getting the program file name.
323	*/
324	#if defined(RT_OS_LINUX) \|\| defined(RT_OS_FREEBSD) \|\| defined(RT_OS_SOLARIS)
325	# ifdef RT_OS_LINUX
326	int cchLink = readlink("/proc/self/exe", &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
327
328	# elif defined(RT_OS_SOLARIS)
329	char szFileBuf[PATH_MAX + 1];
330	sprintf(szFileBuf, "/proc/%ld/path/a.out", (long)getpid());
331	int cchLink = readlink(szFileBuf, &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
332
333	# else /* RT_OS_FREEBSD */
334	int aiName[4];
335	aiName[0] = CTL_KERN;
336	aiName[1] = KERN_PROC;
337	aiName[2] = KERN_PROC_PATHNAME;
338	aiName[3] = getpid();
339
340	size_t cbPath = sizeof(g_szSupLibHardenedExePath);
341	if (sysctl(aiName, RT_ELEMENTS(aiName), g_szSupLibHardenedExePath, &cbPath, NULL, 0) < 0)
342	supR3HardenedFatal("supR3HardenedExecDir: sysctl failed\n");
343	g_szSupLibHardenedExePath[sizeof(g_szSupLibHardenedExePath) - 1] = '\0';
344	int cchLink = strlen(g_szSupLibHardenedExePath); /* paranoid? can't we use cbPath? */
345
346	# endif
347	if (cchLink < 0 \|\| cchLink == sizeof(g_szSupLibHardenedExePath) - 1)
348	supR3HardenedFatal("supR3HardenedExecDir: couldn't read \"%s\", errno=%d cchLink=%d\n",
349	g_szSupLibHardenedExePath, errno, cchLink);
350	g_szSupLibHardenedExePath[cchLink] = '\0';
351
352	#elif defined(RT_OS_OS2) \|\| defined(RT_OS_L4)
353	_execname(g_szSupLibHardenedExePath, sizeof(g_szSupLibHardenedExePath));
354
355	#elif defined(RT_OS_DARWIN)
356	const char *pszImageName = _dyld_get_image_name(0);
357	if (!pszImageName)
358	supR3HardenedFatal("supR3HardenedExecDir: _dyld_get_image_name(0) failed\n");
359	size_t cchImageName = strlen(pszImageName);
360	if (!cchImageName \|\| cchImageName >= sizeof(g_szSupLibHardenedExePath))
361	supR3HardenedFatal("supR3HardenedExecDir: _dyld_get_image_name(0) failed, cchImageName=%d\n", cchImageName);
362	memcpy(g_szSupLibHardenedExePath, pszImageName, cchImageName + 1);
363
364	#elif defined(RT_OS_WINDOWS)
365	HMODULE hExe = GetModuleHandle(NULL);
366	if (!GetModuleFileName(hExe, &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath)))
367	supR3HardenedFatal("supR3HardenedExecDir: GetModuleFileName failed, rc=%d\n", GetLastError());
368	#else
369	# error needs porting.
370	#endif
371
372	/*
373	* Strip off the filename part (RTPathStripFilename()).
374	*/
375	strcpy(g_szSupLibHardenedDirPath, g_szSupLibHardenedExePath);
376	suplibHardenedPathStripFilename(g_szSupLibHardenedDirPath);
377	}
378
379
380	#ifdef RT_OS_LINUX
381	/**
382	* Checks if we can read /proc/self/exe.
383	*
384	* This is used on linux to see if we have to call init
385	* with program path or not.
386	*
387	* @returns true / false.
388	*/
389	static bool supR3HardenedMainIsProcSelfExeAccssible(void)
390	{
391	char szPath[RTPATH_MAX];
392	int cchLink = readlink("/proc/self/exe", szPath, sizeof(szPath));
393	return cchLink != -1;
394	}
395	#endif /* RT_OS_LINUX */
396
397
398
399	/**
400	* @copydoc RTPathExecDir
401	*/
402	DECLHIDDEN(int) supR3HardenedPathExecDir(char *pszPath, size_t cchPath)
403	{
404	/*
405	* Lazy init (probably not required).
406	*/
407	if (!g_szSupLibHardenedDirPath[0])
408	supR3HardenedGetFullExePath();
409
410	/*
411	* Calc the length and check if there is space before copying.
412	*/
413	size_t cch = strlen(g_szSupLibHardenedDirPath) + 1;
414	if (cch <= cchPath)
415	{
416	memcpy(pszPath, g_szSupLibHardenedDirPath, cch + 1);
417	return VINF_SUCCESS;
418	}
419
420	supR3HardenedFatal("supR3HardenedPathExecDir: Buffer too small (%u < %u)\n", cchPath, cch);
421	return VERR_BUFFER_OVERFLOW;
422	}
423
424
425	DECLHIDDEN(void) supR3HardenedFatalMsgV(const char pszWhere, SUPINITOP enmWhat, int rc, const char pszMsgFmt, va_list va)
426	{
427	/*
428	* To the console first, like supR3HardenedFatalV.
429	*/
430	fprintf(stderr, "%s: Error %d in %s!\n", g_pszSupLibHardenedProgName, rc, pszWhere);
431	fprintf(stderr, "%s: ", g_pszSupLibHardenedProgName);
432	va_list vaCopy;
433	va_copy(vaCopy, va);
434	vfprintf(stderr, pszMsgFmt, vaCopy);
435	va_end(vaCopy);
436	fprintf(stderr, "\n");
437
438	switch (enmWhat)
439	{
440	case kSupInitOp_Driver:
441	fprintf(stderr,
442	"\n"
443	"%s: Tip! Make sure the kernel module is loaded. It may also help to reinstall VirtualBox.\n",
444	g_pszSupLibHardenedProgName);
445	break;
446
447	case kSupInitOp_IPRT:
448	case kSupInitOp_Integrity:
449	case kSupInitOp_RootCheck:
450	fprintf(stderr,
451	"\n"
452	"%s: Tip! It may help to reinstall VirtualBox.\n",
453	g_pszSupLibHardenedProgName);
454	break;
455
456	default:
457	/* no hints here */
458	break;
459	}
460
461	#ifdef SUP_HARDENED_SUID
462	/*
463	* Drop any root privileges we might be holding, this won't return
464	* if it fails but end up calling supR3HardenedFatal[V].
465	*/
466	supR3HardenedMainDropPrivileges();
467	#endif /* SUP_HARDENED_SUID */
468
469	/*
470	* Now try resolve and call the TrustedError entry point if we can
471	* find it. We'll fork before we attempt this because that way the
472	* session management in main will see us exiting immediately (if
473	* it's invovled with us).
474	*/
475	#if !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
476	int pid = fork();
477	if (pid <= 0)
478	#endif
479	{
480	PFNSUPTRUSTEDERROR pfnTrustedError = supR3HardenedMainGetTrustedError(g_pszSupLibHardenedProgName);
481	if (pfnTrustedError)
482	pfnTrustedError(pszWhere, enmWhat, rc, pszMsgFmt, va);
483	}
484
485	/*
486	* Quit
487	*/
488	for (;;)
489	#ifdef _MSC_VER
490	exit(1);
491	#else
492	_Exit(1);
493	#endif
494	}
495
496
497	DECLHIDDEN(void) supR3HardenedFatalMsg(const char pszWhere, SUPINITOP enmWhat, int rc, const char pszMsgFmt, ...)
498	{
499	va_list va;
500	va_start(va, pszMsgFmt);
501	supR3HardenedFatalMsgV(pszWhere, enmWhat, rc, pszMsgFmt, va);
502	va_end(va);
503	}
504
505
506	DECLHIDDEN(void) supR3HardenedFatalV(const char *pszFormat, va_list va)
507	{
508	fprintf(stderr, "%s: ", g_pszSupLibHardenedProgName);
509	vfprintf(stderr, pszFormat, va);
510	for (;;)
511	#ifdef _MSC_VER
512	exit(1);
513	#else
514	_Exit(1);
515	#endif
516	}
517
518
519	DECLHIDDEN(void) supR3HardenedFatal(const char *pszFormat, ...)
520	{
521	va_list va;
522	va_start(va, pszFormat);
523	supR3HardenedFatalV(pszFormat, va);
524	va_end(va);
525	}
526
527
528	DECLHIDDEN(int) supR3HardenedErrorV(int rc, bool fFatal, const char *pszFormat, va_list va)
529	{
530	if (fFatal)
531	supR3HardenedFatalV(pszFormat, va);
532
533	fprintf(stderr, "%s: ", g_pszSupLibHardenedProgName);
534	vfprintf(stderr, pszFormat, va);
535	return rc;
536	}
537
538
539	DECLHIDDEN(int) supR3HardenedError(int rc, bool fFatal, const char *pszFormat, ...)
540	{
541	va_list va;
542	va_start(va, pszFormat);
543	supR3HardenedErrorV(rc, fFatal, pszFormat, va);
544	va_end(va);
545	return rc;
546	}
547
548
549	/**
550	* Wrapper around snprintf which will throw a fatal error on buffer overflow.
551	*
552	* @returns Number of chars in the result string.
553	* @param pszDst The destination buffer.
554	* @param cchDst The size of the buffer.
555	* @param pszFormat The format string.
556	* @param ... Format arguments.
557	*/
558	static size_t supR3HardenedStrPrintf(char pszDst, size_t cchDst, const char pszFormat, ...)
559	{
560	va_list va;
561	va_start(va, pszFormat);
562	#ifdef _MSC_VER
563	int cch = _vsnprintf(pszDst, cchDst, pszFormat, va);
564	#else
565	int cch = vsnprintf(pszDst, cchDst, pszFormat, va);
566	#endif
567	va_end(va);
568	if ((unsigned)cch >= cchDst \|\| cch < 0)
569	supR3HardenedFatal("supR3HardenedStrPrintf: buffer overflow, %d >= %lu\n", cch, (long)cchDst);
570	return cch;
571	}
572
573
574	/**
575	* Attempts to open /dev/vboxdrv (or equvivalent).
576	*
577	* @remarks This function will not return on failure.
578	*/
579	static void supR3HardenedMainOpenDevice(void)
580	{
581	int rc = suplibOsInit(&g_SupPreInitData.Data, false);
582	if (RT_SUCCESS(rc))
583	return;
584
585	switch (rc)
586	{
587	/** @todo better messages! */
588	case VERR_VM_DRIVER_NOT_INSTALLED:
589	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
590	"Kernel driver not installed");
591	case VERR_VM_DRIVER_NOT_ACCESSIBLE:
592	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
593	"Kernel driver not accessible");
594	case VERR_VM_DRIVER_LOAD_ERROR:
595	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
596	"VERR_VM_DRIVER_LOAD_ERROR");
597	case VERR_VM_DRIVER_OPEN_ERROR:
598	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
599	"VERR_VM_DRIVER_OPEN_ERROR");
600	case VERR_VM_DRIVER_VERSION_MISMATCH:
601	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
602	"Kernel driver version mismatch");
603	case VERR_ACCESS_DENIED:
604	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
605	"VERR_ACCESS_DENIED");
606	case VERR_NO_MEMORY:
607	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
608	"Kernel memory allocation/mapping failed");
609	default:
610	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
611	"Unknown rc=%d", rc);
612	}
613	}
614
615
616	#ifdef SUP_HARDENED_SUID
617
618	/**
619	* Grabs extra non-root capabilities / privileges that we might require.
620	*
621	* This is currently only used for being able to do ICMP from the NAT engine.
622	*
623	* @note We still have root privileges at the time of this call.
624	*/
625	static void supR3HardenedMainGrabCapabilites(void)
626	{
627	# if defined(RT_OS_LINUX)
628	/*
629	* We are about to drop all our privileges. Remove all capabilities but
630	* keep the cap_net_raw capability for ICMP sockets for the NAT stack.
631	*/
632	if (g_uCaps != 0)
633	{
634	# ifdef USE_LIB_PCAP
635	/* XXX cap_net_bind_service */
636	if (!cap_set_proc(cap_from_text("all-eip cap_net_raw+ep")))
637	prctl(PR_SET_KEEPCAPS, 1 /keep=/, 0, 0, 0);
638	prctl(PR_SET_DUMPABLE, 1 /dump/, 0, 0, 0);
639	# else
640	cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
641	cap_user_data_t cap = (cap_user_data_t)alloca(sizeof(*cap));
642	memset(hdr, 0, sizeof(*hdr));
643	hdr->version = _LINUX_CAPABILITY_VERSION;
644	memset(cap, 0, sizeof(*cap));
645	cap->effective = g_uCaps;
646	cap->permitted = g_uCaps;
647	if (!capset(hdr, cap))
648	prctl(PR_SET_KEEPCAPS, 1 /keep/, 0, 0, 0);
649	prctl(PR_SET_DUMPABLE, 1 /dump/, 0, 0, 0);
650	# endif /* !USE_LIB_PCAP */
651	}
652
653	# elif defined(RT_OS_SOLARIS)
654	/*
655	* Add net_icmpaccess privilege to permitted, effective and inheritable privileges
656	* before dropping root privileges.
657	*/
658	priv_set_t *pPrivSet = priv_str_to_set("basic", ",", NULL);
659	if (pPrivSet)
660	{
661	priv_addset(pPrivSet, PRIV_NET_ICMPACCESS);
662	int rc = setppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
663	if (!rc)
664	{
665	rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
666	if (!rc)
667	{
668	rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
669	if (rc)
670	supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effectives privilege set.\n");
671	}
672	else
673	supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
674	}
675	else
676	supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set inheritable privilege set.\n");
677
678	priv_freeset(pPrivSet);
679	}
680	else
681	supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to get basic privilege set.\n");
682
683	# endif
684	}
685
686	/*
687	* Look at the environment for some special options.
688	*/
689	static void supR3GrabOptions(void)
690	{
691	const char *pszOpt;
692
693	# ifdef RT_OS_LINUX
694	g_uCaps = 0;
695
696	/*
697	* Do _not_ perform any capability-related system calls for root processes
698	* (leaving g_uCaps at 0).
699	* (Hint: getuid gets the real user id, not the effective.)
700	*/
701	if (getuid() != 0)
702	{
703	/*
704	* CAP_NET_RAW.
705	* Default: enabled.
706	* Can be disabled with 'export VBOX_HARD_CAP_NET_RAW=0'.
707	*/
708	pszOpt = getenv("VBOX_HARD_CAP_NET_RAW");
709	if ( !pszOpt
710	\|\| memcmp(pszOpt, "0", sizeof("0")) != 0)
711	g_uCaps = CAP_TO_MASK(CAP_NET_RAW);
712
713	/*
714	* CAP_NET_BIND_SERVICE.
715	* Default: disabled.
716	* Can be enabled with 'export VBOX_HARD_CAP_NET_BIND_SERVICE=1'.
717	*/
718	pszOpt = getenv("VBOX_HARD_CAP_NET_BIND_SERVICE");
719	if ( pszOpt
720	&& memcmp(pszOpt, "0", sizeof("0")) != 0)
721	g_uCaps \|= CAP_TO_MASK(CAP_NET_BIND_SERVICE);
722	}
723	# endif
724	}
725
726	/**
727	* Drop any root privileges we might be holding.
728	*/
729	static void supR3HardenedMainDropPrivileges(void)
730	{
731	/*
732	* Try use setre[ug]id since this will clear the save uid/gid and thus
733	* leave fewer traces behind that libs like GTK+ may pick up.
734	*/
735	uid_t euid, ruid, suid;
736	gid_t egid, rgid, sgid;
737	# if defined(RT_OS_DARWIN)
738	/* The really great thing here is that setreuid isn't available on
739	OS X 10.4, libc emulates it. While 10.4 have a sligtly different and
740	non-standard setuid implementation compared to 10.5, the following
741	works the same way with both version since we're super user (10.5 req).
742	The following will set all three variants of the group and user IDs. */
743	setgid(g_gid);
744	setuid(g_uid);
745	euid = geteuid();
746	ruid = suid = getuid();
747	egid = getegid();
748	rgid = sgid = getgid();
749
750	# elif defined(RT_OS_SOLARIS)
751	/* Solaris doesn't have setresuid, but the setreuid interface is BSD
752	compatible and will set the saved uid to euid when we pass it a ruid
753	that isn't -1 (which we do). */
754	setregid(g_gid, g_gid);
755	setreuid(g_uid, g_uid);
756	euid = geteuid();
757	ruid = suid = getuid();
758	egid = getegid();
759	rgid = sgid = getgid();
760
761	# else
762	/* This is the preferred one, full control no questions about semantics.
763	PORTME: If this isn't work, try join one of two other gangs above. */
764	setresgid(g_gid, g_gid, g_gid);
765	setresuid(g_uid, g_uid, g_uid);
766	if (getresuid(&ruid, &euid, &suid) != 0)
767	{
768	euid = geteuid();
769	ruid = suid = getuid();
770	}
771	if (getresgid(&rgid, &egid, &sgid) != 0)
772	{
773	egid = getegid();
774	rgid = sgid = getgid();
775	}
776	# endif
777
778
779	/* Check that it worked out all right. */
780	if ( euid != g_uid
781	\|\| ruid != g_uid
782	\|\| suid != g_uid
783	\|\| egid != g_gid
784	\|\| rgid != g_gid
785	\|\| sgid != g_gid)
786	supR3HardenedFatal("SUPR3HardenedMain: failed to drop root privileges!"
787	" (euid=%d ruid=%d suid=%d egid=%d rgid=%d sgid=%d; wanted uid=%d and gid=%d)\n",
788	euid, ruid, suid, egid, rgid, sgid, g_uid, g_gid);
789
790	# if RT_OS_LINUX
791	/*
792	* Re-enable the cap_net_raw capability which was disabled during setresuid.
793	*/
794	if (g_uCaps != 0)
795	{
796	# ifdef USE_LIB_PCAP
797	/** @todo Warn if that does not work? */
798	/* XXX cap_net_bind_service */
799	cap_set_proc(cap_from_text("cap_net_raw+ep"));
800	# else
801	cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
802	cap_user_data_t cap = (cap_user_data_t)alloca(sizeof(*cap));
803	memset(hdr, 0, sizeof(*hdr));
804	hdr->version = _LINUX_CAPABILITY_VERSION;
805	memset(cap, 0, sizeof(*cap));
806	cap->effective = g_uCaps;
807	cap->permitted = g_uCaps;
808	/** @todo Warn if that does not work? */
809	capset(hdr, cap);
810	# endif /* !USE_LIB_PCAP */
811	}
812	# endif
813	}
814
815	#endif /* SUP_HARDENED_SUID */
816
817	/**
818	* Loads the VBoxRT DLL/SO/DYLIB, hands it the open driver,
819	* and calls RTR3Init.
820	*
821	* @param fFlags The SUPR3HardenedMain fFlags argument, passed to supR3PreInit.
822	*
823	* @remarks VBoxRT contains both IPRT and SUPR3.
824	* @remarks This function will not return on failure.
825	*/
826	static void supR3HardenedMainInitRuntime(uint32_t fFlags)
827	{
828	/*
829	* Construct the name.
830	*/
831	char szPath[RTPATH_MAX];
832	supR3HardenedPathSharedLibs(szPath, sizeof(szPath) - sizeof("/VBoxRT" SUPLIB_DLL_SUFF));
833	strcat(szPath, "/VBoxRT" SUPLIB_DLL_SUFF);
834
835	/*
836	* Open it and resolve the symbols.
837	*/
838	#if defined(RT_OS_WINDOWS)
839	/** @todo consider using LOAD_WITH_ALTERED_SEARCH_PATH here! */
840	HMODULE hMod = LoadLibraryEx(szPath, NULL /hFile/, 0 /* dwFlags */);
841	if (!hMod)
842	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
843	"LoadLibraryEx(\"%s\",,) failed (rc=%d)",
844	szPath, GetLastError());
845	PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)GetProcAddress(hMod, SUP_HARDENED_SYM("RTR3InitEx"));
846	if (!pfnRTInitEx)
847	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
848	"Entrypoint \"RTR3InitEx\" not found in \"%s\" (rc=%d)",
849	szPath, GetLastError());
850
851	PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)GetProcAddress(hMod, SUP_HARDENED_SYM("supR3PreInit"));
852	if (!pfnSUPPreInit)
853	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
854	"Entrypoint \"supR3PreInit\" not found in \"%s\" (rc=%d)",
855	szPath, GetLastError());
856
857	#else
858	/* the dlopen crowd */
859	void *pvMod = dlopen(szPath, RTLD_NOW \| RTLD_GLOBAL);
860	if (!pvMod)
861	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
862	"dlopen(\"%s\",) failed: %s",
863	szPath, dlerror());
864	PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("RTR3InitEx"));
865	if (!pfnRTInitEx)
866	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
867	"Entrypoint \"RTR3InitEx\" not found in \"%s\"!\ndlerror: %s",
868	szPath, dlerror());
869	PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("supR3PreInit"));
870	if (!pfnSUPPreInit)
871	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
872	"Entrypoint \"supR3PreInit\" not found in \"%s\"!\ndlerror: %s",
873	szPath, dlerror());
874	#endif
875
876	/*
877	* Make the calls.
878	*/
879	supR3HardenedGetPreInitData(&g_SupPreInitData);
880	int rc = pfnSUPPreInit(&g_SupPreInitData, fFlags);
881	if (RT_FAILURE(rc))
882	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
883	"supR3PreInit failed with rc=%d", rc);
884	const char *pszExePath = NULL;
885	#ifdef RT_OS_LINUX
886	if (!supR3HardenedMainIsProcSelfExeAccssible())
887	pszExePath = g_szSupLibHardenedExePath;
888	#endif
889	rc = pfnRTInitEx(0, pszExePath, !(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV));
890	if (RT_FAILURE(rc))
891	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
892	"RTR3Init failed with rc=%d", rc);
893	}
894
895
896	/**
897	* Loads the DLL/SO/DYLIB containing the actual program and
898	* resolves the TrustedError symbol.
899	*
900	* This is very similar to supR3HardenedMainGetTrustedMain().
901	*
902	* @returns Pointer to the trusted error symbol if it is exported, NULL
903	* and no error messages otherwise.
904	* @param pszProgName The program name.
905	*/
906	static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName)
907	{
908	/*
909	* Construct the name.
910	*/
911	char szPath[RTPATH_MAX];
912	supR3HardenedPathAppPrivateArch(szPath, sizeof(szPath) - 10);
913	size_t cch = strlen(szPath);
914	supR3HardenedStrPrintf(&szPath[cch], sizeof(szPath) - cch, "/%s%s", pszProgName, SUPLIB_DLL_SUFF);
915
916	/*
917	* Open it and resolve the symbol.
918	*/
919	#if defined(RT_OS_WINDOWS)
920	/** @todo consider using LOAD_WITH_ALTERED_SEARCH_PATH here! */
921	HMODULE hMod = LoadLibraryEx(szPath, NULL /hFile/, 0 /* dwFlags */);
922	if (!hMod)
923	return NULL;
924	FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedError"));
925	if (!pfn)
926	return NULL;
927	return (PFNSUPTRUSTEDERROR)pfn;
928
929	#else
930	/* the dlopen crowd */
931	void *pvMod = dlopen(szPath, RTLD_NOW \| RTLD_GLOBAL);
932	if (!pvMod)
933	return NULL;
934	void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedError"));
935	if (!pvSym)
936	return NULL;
937	return (PFNSUPTRUSTEDERROR)(uintptr_t)pvSym;
938	#endif
939	}
940
941
942	/**
943	* Loads the DLL/SO/DYLIB containing the actual program and
944	* resolves the TrustedMain symbol.
945	*
946	* @returns Pointer to the trusted main of the actual program.
947	* @param pszProgName The program name.
948	* @remarks This function will not return on failure.
949	*/
950	static PFNSUPTRUSTEDMAIN supR3HardenedMainGetTrustedMain(const char *pszProgName)
951	{
952	/*
953	* Construct the name.
954	*/
955	char szPath[RTPATH_MAX];
956	supR3HardenedPathAppPrivateArch(szPath, sizeof(szPath) - 10);
957	size_t cch = strlen(szPath);
958	supR3HardenedStrPrintf(&szPath[cch], sizeof(szPath) - cch, "/%s%s", pszProgName, SUPLIB_DLL_SUFF);
959
960	/*
961	* Open it and resolve the symbol.
962	*/
963	#if defined(RT_OS_WINDOWS)
964	/** @todo consider using LOAD_WITH_ALTERED_SEARCH_PATH here! */
965	HMODULE hMod = LoadLibraryEx(szPath, NULL /hFile/, 0 /* dwFlags */);
966	if (!hMod)
967	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: LoadLibraryEx(\"%s\",,) failed, rc=%d\n",
968	szPath, GetLastError());
969	FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedMain"));
970	if (!pfn)
971	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\" (rc=%d)\n",
972	szPath, GetLastError());
973	return (PFNSUPTRUSTEDMAIN)pfn;
974
975	#else
976	/* the dlopen crowd */
977	void *pvMod = dlopen(szPath, RTLD_NOW \| RTLD_GLOBAL);
978	if (!pvMod)
979	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: dlopen(\"%s\",) failed: %s\n",
980	szPath, dlerror());
981	void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedMain"));
982	if (!pvSym)
983	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\"!\ndlerror: %s\n",
984	szPath, dlerror());
985	return (PFNSUPTRUSTEDMAIN)(uintptr_t)pvSym;
986	#endif
987	}
988
989
990	/**
991	* Secure main.
992	*
993	* This is used for the set-user-ID-on-execute binaries on unixy systems
994	* and when using the open-vboxdrv-via-root-service setup on Windows.
995	*
996	* This function will perform the integrity checks of the VirtualBox
997	* installation, open the support driver, open the root service (later),
998	* and load the DLL corresponding to \a pszProgName and execute its main
999	* function.
1000	*
1001	* @returns Return code appropriate for main().
1002	*
1003	* @param pszProgName The program name. This will be used to figure out which
1004	* DLL/SO/DYLIB to load and execute.
1005	* @param fFlags Flags.
1006	* @param argc The argument count.
1007	* @param argv The argument vector.
1008	* @param envp The environment vector.
1009	*/
1010	DECLHIDDEN(int) SUPR3HardenedMain(const char pszProgName, uint32_t fFlags, int argc, char argv, char *envp)
1011	{
1012	/*
1013	* Note! At this point there is no IPRT, so we will have to stick
1014	* to basic CRT functions that everyone agree upon.
1015	*/
1016	g_pszSupLibHardenedProgName = pszProgName;
1017	g_SupPreInitData.u32Magic = SUPPREINITDATA_MAGIC;
1018	g_SupPreInitData.Data.hDevice = NIL_RTFILE;
1019	g_SupPreInitData.u32EndMagic = SUPPREINITDATA_MAGIC;
1020
1021	#ifdef SUP_HARDENED_SUID
1022	# ifdef RT_OS_LINUX
1023	/*
1024	* On linux we have to make sure the path is initialized because we
1025	* might not be able to access /proc/self/exe after the seteuid call.
1026	*/
1027	supR3HardenedGetFullExePath();
1028
1029	# endif
1030
1031	/*
1032	* Grab any options from the environment.
1033	*/
1034	supR3GrabOptions();
1035
1036	/*
1037	* Check that we're root, if we aren't then the installation is butchered.
1038	*/
1039	g_uid = getuid();
1040	g_gid = getgid();
1041	if (geteuid() != 0 /* root */)
1042	supR3HardenedFatalMsg("SUPR3HardenedMain", kSupInitOp_RootCheck, VERR_PERMISSION_DENIED,
1043	"Effective UID is not root (euid=%d egid=%d uid=%d gid=%d)",
1044	geteuid(), getegid(), g_uid, g_gid);
1045	#endif
1046
1047	/*
1048	* Validate the installation.
1049	*/
1050	supR3HardenedVerifyAll(true /* fFatal /, false / fLeaveFilesOpen */, pszProgName);
1051
1052	/*
1053	* Open the vboxdrv device.
1054	*/
1055	if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
1056	supR3HardenedMainOpenDevice();
1057
1058	/*
1059	* Open the root service connection.
1060	*/
1061	//if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_SVC))
1062	//supR3HardenedMainOpenService(&g_SupPreInitData, true /* fFatal */);
1063
1064	#ifdef SUP_HARDENED_SUID
1065	/*
1066	* Grab additional capabilities / privileges.
1067	*/
1068	supR3HardenedMainGrabCapabilites();
1069
1070	/*
1071	* Drop any root privileges we might be holding (won't return on failure)
1072	*/
1073	supR3HardenedMainDropPrivileges();
1074	#endif
1075
1076	/*
1077	* Load the IPRT, hand the SUPLib part the open driver and
1078	* call RTR3Init.
1079	*/
1080	supR3HardenedMainInitRuntime(fFlags);
1081
1082	/*
1083	* Load the DLL/SO/DYLIB containing the actual program
1084	* and pass control to it.
1085	*/
1086	PFNSUPTRUSTEDMAIN pfnTrustedMain = supR3HardenedMainGetTrustedMain(pszProgName);
1087	return pfnTrustedMain(argc, argv, envp);
1088	}
1089

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp@ 27877

Download in other formats: