SUPR3HardenedMain.cpp@ 63674

Last change on this file since 63674 was 63674, checked in by vboxsync, 8 years ago
build fix
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 87.3 KB

Line
1	/* $Id: SUPR3HardenedMain.cpp 63674 2016-08-31 11:17:32Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Hardened main().
4	*/
5
6	/*
7	* Copyright (C) 2006-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/** @page pg_hardening %VirtualBox %VM Process Hardening
28	*
29	* The %VM process hardening is to prevent malicious software from using
30	* %VirtualBox as a vehicle to obtain kernel level access.
31	*
32	* The %VirtualBox %VMM requires supervisor (kernel) level access to the CPU.
33	* For both practical and historical reasons, part of the %VMM is realized in
34	* ring-3, with a rich interface to the kernel part. While the device
35	* emulations can be executed exclusively in ring-3, we have performance
36	* optimizations that loads device emulation code into ring-0 and our special
37	* raw-mode execution context (none VT-x/AMD-V mode) for handling frequent
38	* operations a lot more efficiently. These share data between all three
39	* context (ring-3, ring-0 and raw-mode). All this poses a rather broad attack
40	* surface, which the hardening protects.
41	*
42	* The hardening focuses primarily on restricting access to the support driver,
43	* VBoxDrv or vboxdrv depending on the OS, as it is ultimately the link and
44	* instigator of the communication between ring-3 and the ring-0 and raw-mode
45	* contexts. A secondary focus is to make sure malicious code cannot be loaded
46	* and executed in the %VM process. Exactly how we go about this depends a lot
47	* on the host OS.
48	*
49	* @section sec_hardening_supdrv The Support Driver Interfaces
50	*
51	* The support driver has several interfaces thru which it can be accessed:
52	* - /dev/vboxdrv (win: \\Device\\VBoxDrv) for full unrestricted access.
53	* Offers a rich I/O control interface, which needs protecting.
54	* - /dev/vboxdrvu (win: \\Device\\VBoxDrvU) for restricted access, which
55	* VBoxSVC uses to query VT-x and AMD-V capabilities. This does not
56	* require protecting, though we limit it to the vboxgroup on some
57	* systems.
58	* - \\Device\\VBoxDrvStub on Windows for protecting the second stub
59	* process and its child, the %VM process. This is an open+close
60	* interface, only available to partially verified stub processes.
61	* - \\Device\\VBoxDrvErrorInfo on Windows for obtaining detailed error
62	* information on a previous attempt to open \\Device\\VBoxDrv or
63	* \\Device\\VBoxDrvStub. Open, read and close only interface.
64	*
65	* The rest of VBox accesses the device interface thru the support library,
66	* @ref grp_sup "SUPR3" / sup.h.
67	*
68	* The support driver also exposes a set of functions and data that other VBox
69	* ring-0 modules can import from. This includes much of the IPRT we need in
70	* the ring-0 part of the %VMM and device emulations.
71	*
72	* The ring-0 part of the %VMM and device emulations are loaded via the
73	* #SUPR3LoadModule and #SUPR3LoadServiceModule support library function, which
74	* both translates to a sequence of I/O controls against /dev/vboxdrv. On
75	* Windows we use the native kernel loader to load the module, while on the
76	* other systems ring-3 prepares the bits with help from the IPRT loader code.
77	*
78	*
79	* @section sec_hardening_unix Hardening on UNIX-like OSes
80	*
81	* On UNIX-like systems (Solaris, Linux, darwin, freebsd, ...) we put our trust
82	* in root and that root knows what he/she/it is doing.
83	*
84	* We only allow root to get full unrestricted access to the support driver.
85	* The device node corresponding to unrestricted access (/dev/vboxdrv) is own by
86	* root and has a 0600 access mode (i.e. only accessible to the owner, root). In
87	* addition to this file system level restriction, the support driver also
88	* checks that the effective user ID (EUID) is root when it is being opened.
89	*
90	* The %VM processes temporarily assume root privileges using the set-uid-bit on
91	* the executable with root as owner. In fact, all the files and directories we
92	* install are owned by root and the wheel (or equivalent gid = 0) group,
93	* including extension pack files.
94	*
95	* The executable with the set-uid-to-root-bit set is a stub binary that has no
96	* unnecessary library dependencies (only libc, pthreads, dynamic linker) and
97	* simply calls #SUPR3HardenedMain. It does the following:
98	* 1. Validate the VirtualBox installation (#supR3HardenedVerifyAll):
99	* - Check that the executable file of the process is one of the known
100	* VirtualBox executables.
101	* - Check that all mandatory files are present.
102	* - Check that all installed files and directories (both optional and
103	* mandatory ones) are owned by root:wheel and are not writable by
104	* anyone except root.
105	* - Check that all the parent directories, all the way up to the root
106	* if possible, only permits root (or system admin) to change them.
107	* This is that to rule out unintentional rename races.
108	* - On some systems we may also validate the cryptographic signtures
109	* of executable images.
110	*
111	* 2. Open a file descriptor for the support device driver
112	* (#supR3HardenedMainOpenDevice).
113	*
114	* 3. Grab ICMP capabilities for NAT ping support, if required by the OS
115	* (#supR3HardenedMainGrabCapabilites).
116	*
117	* 4. Correctly drop the root privileges
118	* (#supR3HardenedMainDropPrivileges).
119	*
120	* 5. Load the VBoxRT dynamic link library and hand over the file
121	* descriptor to the support library code in it
122	* (#supR3HardenedMainInitRuntime).
123	*
124	* 6. Load the dynamic library containing the actual %VM front end code and
125	* run it (tail of #SUPR3HardenedMain).
126	*
127	* The set-uid-to-root stub executable is paired with a dynamic link library
128	* which export one TrustedMain entry point (see #FNSUPTRUSTEDMAIN) that we
129	* call. In case of error reporting, the library may also export a TrustedError
130	* function (#FNSUPTRUSTEDERROR).
131	*
132	* That the set-uid-to-root-bit modifies the dynamic linker behavior on all
133	* systems, even after we've dropped back to the real user ID, is something we
134	* take advantage of. The dynamic linkers takes special care to prevent users
135	* from using clever tricks to inject their own code into set-uid processes and
136	* causing privilege escalation issues. This is the exact help we need.
137	*
138	* The VirtualBox installation location is hardcoded, which means the any
139	* dynamic linker paths embedded or inferred from the executable and dynamic
140	* libraries are also hardcoded. This helps eliminating search path attack
141	* vectors at the cost of being inflexible regarding installation location.
142	*
143	* In addition to what the dynamic linker does for us, the VirtualBox code will
144	* not directly be calling either RTLdrLoad or dlopen to load dynamic link
145	* libraries into the process. Instead it will call #SUPR3HardenedLdrLoad,
146	* #SUPR3HardenedLdrLoadAppPriv and #SUPR3HardenedLdrLoadPlugIn to do the
147	* loading. These functions will perform the same validations on the file being
148	* loaded as #SUPR3HardenedMain did in its validation step. So, anything we
149	* load must be installed with root/wheel as owner/group, the directory we load
150	* it from must also be owned by root:wheel and now allow for renaming the file.
151	* Similar ownership restrictions applies to all the parent directories (except
152	* on darwin).
153	*
154	* So, we place the responsibility of not installing malicious software on the
155	* root user on UNIX-like systems. Which is fair enough, in our opinion.
156	*
157	*
158	* @section sec_hardening_win Hardening on Windows
159	*
160	* On Windows we cannot put the same level or trust in the Administrator user(s)
161	* (equivalent of root/wheel on unix) as on the UNIX-like systems, which
162	* complicates things greatly.
163	*
164	* Some of the blame for this can be given to Windows being a descendant /
165	* replacement for a set of single user systems: DOS, Windows 1.0-3.11 Windows
166	* 95-ME, and OS/2. Users of NT 3.1 and later was inclined to want to always
167	* run it with full root/administrator privileges like they had done on the
168	* predecessors, while Microsoft didn't provide much incentive for more secure
169	* alternatives. Bad idea, security wise, but execellent for the security
170	* software industry. For this reason using a set-uid-to-root approach is
171	* pointless, even if Windows had one.
172	*
173	* So, in order to protect access to the support driver and protect the %VM
174	* process while it's running we have to do a lot more work. A keystone in the
175	* defences is cryptographic code signing. Here's the short version of what we
176	* do:
177	* - Minimal stub executable, signed with the same certificate as the
178	* kernel driver.
179	*
180	* - The stub executable respawns itself twice, hooking the NTDLL init
181	* routine to perform protection tasks as early as possible. The parent
182	* stub helps keep in the child clean for verification as does the
183	* support driver.
184	*
185	* - In order to protect against loading unwanted code into the process,
186	* the stub processes installs DLL load hooks with NTDLL as well as
187	* directly intercepting the LdrLoadDll and NtCreateSection APIs.
188	*
189	* - The support driver will verify all but the initial process very
190	* thoroughly before allowing them protection and in the final case full
191	* unrestricted access.
192	*
193	*
194	* @subsection sec_hardening_win_protsoft 3rd Party "Protection" Software
195	*
196	* What makes our life REALLY difficult on Windows is this 3rd party "security"
197	* software which is more or less required to keep a Windows system safe for
198	* normal users and all corporate IT departments rightly insists on installing.
199	* After the kernel patching clampdown in Vista, anti-* software has to do a
200	* lot more mucking about in user mode to get their job (kind of) done. So, it
201	* is common practice to patch a lot of NTDLL, KERNEL32, the executable import
202	* table, load extra DLLs into the process, allocate executable memory in the
203	* process (classic code injection) and more.
204	*
205	* The BIG problem with all this is that it is indistinguishable from what
206	* malicious software would be doing in order to intercept process activity
207	* (network sniffing, maybe password snooping) or gain a level of kernel access
208	* via the support driver. So, the "protection" software is what is currently
209	* forcing us to do the pre-NTDLL initialization.
210	*
211	*
212	* @subsection sec_hardening_win_1st_stub The Initial Stub Process
213	*
214	* We share the stub executable approach with the UNIX-like systems, so there's
215	* the #SUPR3HardenedMain calling stub executable with its partner DLL exporting
216	* TrustedMain and TrustedError. However, the stub executable does a lot more,
217	* while doing it in a more bare metal fashion:
218	* - It does not use the Microsoft CRT, what we need of CRT functions comes
219	* from IPRT.
220	* - It does not statically import anything. This is to avoid having an
221	* import table that can be patched to intercept our calls or extended to
222	* load additional DLLs.
223	* - Direct NT system calls. System calls normally going thru NTDLL, but
224	* since there is so much software out there which wants to patch known
225	* NTDLL entry points to control our software (either for good or
226	* malicious reasons), we do it ourselves.
227	*
228	* The initial stub process is not really to be trusted, though we try our best
229	* to limit potential harm (user mode debugger checks, disable thread creation).
230	* So, when it enters #SUPR3HardenedMain we only call #supR3HardenedVerifyAll to
231	* verify the installation (known executables and DLLs, checking their code
232	* signing signatures, keeping them all open to deny deletion and replacing) and
233	* does a respawn via #supR3HardenedWinReSpawn.
234	*
235	*
236	* @subsection sec_hardening_win_2nd_stub The Second Stub Process
237	*
238	* The second stub process will be created in suspended state, i.e. the main
239	* thread is suspended before it executes a single instruction. It is also
240	* created with a less generous ACLs, though this doesn't protect us from admin
241	* users. In order for #SUPR3HardenedMain to figure that it is the second stub
242	* process, the zeroth command line argument has been replaced by a known magic
243	* string (UUID).
244	*
245	* Now, before the process starts executing, the parent (initial stub) will
246	* patch the LdrInitializeThunk entry point in NTDLL to call
247	* #supR3HardenedEarlyProcessInit via #supR3HardenedEarlyProcessInitThunk. The
248	* parent will also plant some synchronization stuff via #g_ProcParams (NTDLL
249	* location, inherited event handles and associated ping-pong equipment).
250	*
251	* The LdrInitializeThunk entry point of NTDLL is where the kernel sets up
252	* process execution to start executing (via a user alert, so it is not subject
253	* to SetThreadContext). LdrInitializeThunk performs process, NTDLL and
254	* sub-system client (kernel32) initialization. A lot of "protection" software
255	* uses triggers in this initialization sequence (like the KERNEL32.DLL load
256	* event), so we avoid quite a bit of problems by getting our stuff done early
257	* on.
258	*
259	* However, there are also those that uses events that triggers immediately when
260	* the process is created or/and starts executing the first instruction. But we
261	* can easily counter these as we have a known process state we can restore. So,
262	* the first thing that #supR3HardenedEarlyProcessInit does is to signal the
263	* parent to perform a child purification, so the potentially evil influences
264	* can be exorcised.
265	*
266	* What the parent does during the purification is very similar to what the
267	* kernel driver will do later on when verifying the second stub and the %VM
268	* processes, except that instead of failing when encountering an shortcoming it
269	* will take corrective actions:
270	* - Executable memory regions not belonging to a DLL mapping will be
271	* attempted freed, and we'll only fail if we can't evict them.
272	* - All pages in the executable images in the process (should be just the
273	* stub executable and NTDLL) will be compared to the pristine fixed-up
274	* copy prepared by the IPRT PE loader code, restoring any bytes which
275	* appears differently in the child. (#g_ProcParams is exempted,
276	* LdrInitializeThunk is set to call NtTerminateThread.)
277	* - Unwanted DLLs will be unloaded (we have a set of DLLs we like).
278	*
279	* Before signalling the second stub process that it has been purified and should
280	* get on with it, the parent will close all handles with unrestricted access to
281	* the process and thread so that the initial stub process no longer can
282	* influence the child in any really harmful way. (The caller of CreateProcess
283	* usually receives handles with unrestricted access to the child process and
284	* its main thread. These could in theory be used with DuplicateHandle or
285	* WriteProcessMemory to get at the %VM process if we're not careful.)
286	*
287	* #supR3HardenedEarlyProcessInit will continue with opening the log file
288	* (requires command line parsing). It will continue to initialize a bunch of
289	* global variables, system calls and trustworthy/harmless NTDLL imports.
290	* #supR3HardenedWinInit is then called to setup image verification, that is:
291	* - Hook the NtCreateSection entry point in NTDLL so we can check all
292	* executable mappings before they're created and can be mapped. The
293	* NtCreateSection code jumps to #supR3HardenedMonitor_NtCreateSection.
294	* - Hook (ditto) the LdrLoadDll entry point in NTDLL so we can
295	* pre-validate all images that gets loaded the normal way (partly
296	* because the NtCreateSection context is restrictive because the NTDLL
297	* loader lock is usually held, which prevents us from safely calling
298	* WinVerityTrust). The LdrLoadDll code jumps to
299	* #supR3HardenedMonitor_LdrLoadDll.
300	*
301	* The image/DLL verification hooks are at this point able to verify DLLs
302	* containing embedded code signing signatures, and will restrict the locations
303	* from which DLLs will be loaded. When #SUPR3HardenedMain gets going later on,
304	* they will start insisting on everything having valid signatures, either
305	* embedded or in a signed installer catalog file.
306	*
307	* The function also irrevocably disables debug notifications related to the
308	* current thread, just to make attaching a debugging that much more difficult
309	* and less useful.
310	*
311	* Now, the second stub process will open the so called stub device
312	* (\\Device\\VBoxDrvStub), that is a special support driver device node that
313	* tells the support driver to:
314	* - Protect the process against the OpenProcess and OpenThread attack
315	* vectors by stripping risky access rights.
316	* - Check that the process isn't being debugged.
317	* - Check that the process contains exactly one thread.
318	* - Check that the process doesn't have any unknown DLLs loaded into it.
319	* - Check that the process doesn't have any executable memory (other than
320	* DLL sections) in it.
321	* - Check that the process executable is a known VBox executable which may
322	* access the support driver.
323	* - Check that the process executable is signed with the same code signing
324	* certificate as the driver and that the on disk image is valid
325	* according to its embedded signature.
326	* - Check all the signature of all DLLs in the process (NTDLL) if they are
327	* signed, and only accept unsigned ones in versions where they are known
328	* not to be signed.
329	* - Check that the code and readonly parts of the executable and DLLs
330	* mapped into the process matches the on disk content (no patches other
331	* than our own two in NTDLL are allowed).
332	*
333	* Once granted access to the stub device, #supR3HardenedEarlyProcessInit will
334	* restore the LdrInitializeThunk code and let the process perform normal
335	* initialization. Leading us to #SUPR3HardenedMain where we detect that this
336	* is the 2nd stub process and does another respawn.
337	*
338	*
339	* @subsection sec_hardening_win_3rd_stub The Final Stub / VM Process
340	*
341	* The third stub process is what becomes the %VM process. Because the parent
342	* has opened \\Device\\VBoxDrvSub, it is protected from malicious OpenProcess &
343	* OpenThread calls from the moment of inception, practically speaking.
344	*
345	* It goes thru the same suspended creation, patching, purification and such as
346	* its parent (the second stub process). However, instead of opening
347	* \\Device\\VBoxDrvStub from #supR3HardenedEarlyProcessInit, it opens the
348	* support driver for full unrestricted access, i.e. \\Device\\VBoxDrv.
349	*
350	* The support driver will perform the same checks as it did when
351	* \\Device\\VBoxDrvStub was opened, but in addition it will:
352	* - Check that the process is the first child of a process that opened
353	* \\Device\\VBoxDrvStub.
354	* - Check that the parent process is still alive.
355	* - Scan all open handles in the system for potentially harmful ones to
356	* the process or the primary thread.
357	*
358	* Knowing that the process is genuinly signed with the same certificate as the
359	* kernel driver, and the exectuable code in the process is either shipped by us
360	* or Microsoft, the support driver will trust it with full access and to keep
361	* the handle secure.
362	*
363	* We also trust the protection the support driver gives the process to keep out
364	* malicious ring-3 code, and therefore any code, patching or other mysterious
365	* stuff that enteres the process must be from kernel mode and that we can trust
366	* it (the alternative interpretation is that the kernel has been breanched
367	* already, which isn't our responsibility). This means that, the anti-software
368	* products can do whatever they like from this point on. However, should they
369	* do unrevertable changes to the process before this point, VirtualBox won't
370	* work.
371	*
372	* As in the second stub process, we'll now do normal process initialization and
373	* #SUPR3HardenedMain will take control. It will detect that it is being called
374	* by the 3rd stub process because of a different magic string starting the
375	* command line, and not respawn itself any more. #SUPR3HardenedMain will
376	* recheck the VirtualBox installation, keeping all known files open just like
377	* in two previous stub processes.
378	*
379	* It will then load the Windows cryptographic API and load the trusted root
380	* certificates from the Windows store. The API enables using installation
381	* catalog files for signature checking as well as providing a second
382	* verification in addition to our own implementation (IPRT). The certificates
383	* allows our signature validation implementation to validate all embedded
384	* signatures, not just the microsoft ones and the one signed by our own
385	* certificate.
386	*
387	*/
388
389
390	/*********************************************************************************************************************************
391	* Header Files *
392	*********************************************************************************************************************************/
393	#if defined(RT_OS_OS2)
394	# define INCL_BASE
395	# define INCL_ERRORS
396	# include <os2.h>
397	# include <stdio.h>
398	# include <stdlib.h>
399	# include <dlfcn.h>
400	# include <unistd.h>
401
402	#elif RT_OS_WINDOWS
403	# include <iprt/nt/nt-and-windows.h>
404
405	#else /* UNIXes */
406	# include <iprt/types.h> /* stdint fun on darwin. */
407
408	# include <stdio.h>
409	# include <stdlib.h>
410	# include <dlfcn.h>
411	# include <limits.h>
412	# include <errno.h>
413	# include <unistd.h>
414	# include <sys/stat.h>
415	# include <sys/time.h>
416	# include <sys/types.h>
417	# if defined(RT_OS_LINUX)
418	# undef USE_LIB_PCAP /* don't depend on libcap as we had to depend on either
419	libcap1 or libcap2 */
420
421	# undef _POSIX_SOURCE
422	# include <linux/types.h> /* sys/capabilities from uek-headers require this */
423	# include <sys/capability.h>
424	# include <sys/prctl.h>
425	# ifndef CAP_TO_MASK
426	# define CAP_TO_MASK(cap) RT_BIT(cap)
427	# endif
428	# elif defined(RT_OS_FREEBSD)
429	# include <sys/param.h>
430	# include <sys/sysctl.h>
431	# elif defined(RT_OS_SOLARIS)
432	# include <priv.h>
433	# endif
434	# include <pwd.h>
435	# ifdef RT_OS_DARWIN
436	# include <mach-o/dyld.h>
437	# endif
438
439	#endif
440
441	#include <VBox/sup.h>
442	#include <VBox/err.h>
443	#ifdef RT_OS_WINDOWS
444	# include <VBox/version.h>
445	#endif
446	#include <iprt/ctype.h>
447	#include <iprt/string.h>
448	#include <iprt/initterm.h>
449	#include <iprt/param.h>
450
451	#include "SUPLibInternal.h"
452
453
454	/*********************************************************************************************************************************
455	* Defined Constants And Macros *
456	*********************************************************************************************************************************/
457	/** @def SUP_HARDENED_SUID
458	* Whether we're employing set-user-ID-on-execute in the hardening.
459	*/
460	#if !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_L4)
461	# define SUP_HARDENED_SUID
462	#else
463	# undef SUP_HARDENED_SUID
464	#endif
465
466	/** @def SUP_HARDENED_SYM
467	* Decorate a symbol that's resolved dynamically.
468	*/
469	#ifdef RT_OS_OS2
470	# define SUP_HARDENED_SYM(sym) "_" sym
471	#else
472	# define SUP_HARDENED_SYM(sym) sym
473	#endif
474
475
476	/*********************************************************************************************************************************
477	* Structures and Typedefs *
478	*********************************************************************************************************************************/
479	/** @see RTR3InitEx */
480	typedef DECLCALLBACK(int) FNRTR3INITEX(uint32_t iVersion, uint32_t fFlags, int cArgs,
481	char *papszArgs, const char pszProgramPath);
482	typedef FNRTR3INITEX *PFNRTR3INITEX;
483
484	/** @see RTLogRelPrintf */
485	typedef DECLCALLBACK(void) FNRTLOGRELPRINTF(const char *pszFormat, ...);
486	typedef FNRTLOGRELPRINTF *PFNRTLOGRELPRINTF;
487
488
489	/*********************************************************************************************************************************
490	* Global Variables *
491	*********************************************************************************************************************************/
492	/** The pre-init data we pass on to SUPR3 (residing in VBoxRT). */
493	static SUPPREINITDATA g_SupPreInitData;
494	/** The program executable path. */
495	#ifndef RT_OS_WINDOWS
496	static
497	#endif
498	char g_szSupLibHardenedExePath[RTPATH_MAX];
499	/** The application bin directory path. */
500	static char g_szSupLibHardenedAppBinPath[RTPATH_MAX];
501
502	/** The program name. */
503	static const char *g_pszSupLibHardenedProgName;
504	/** The flags passed to SUPR3HardenedMain. */
505	static uint32_t g_fSupHardenedMain;
506
507	#ifdef SUP_HARDENED_SUID
508	/** The real UID at startup. */
509	static uid_t g_uid;
510	/** The real GID at startup. */
511	static gid_t g_gid;
512	# ifdef RT_OS_LINUX
513	static uint32_t g_uCaps;
514	static uint32_t g_uCapsVersion;
515	# endif
516	#endif
517
518	/** The startup log file. */
519	#ifdef RT_OS_WINDOWS
520	static HANDLE g_hStartupLog = NULL;
521	#else
522	static int g_hStartupLog = -1;
523	#endif
524	/** The number of bytes we've written to the startup log. */
525	static uint32_t volatile g_cbStartupLog = 0;
526
527	/** The current SUPR3HardenedMain state / location. */
528	SUPR3HARDENEDMAINSTATE g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED;
529	AssertCompileSize(g_enmSupR3HardenedMainState, sizeof(uint32_t));
530
531	#ifdef RT_OS_WINDOWS
532	/** Pointer to VBoxRT's RTLogRelPrintf function so we can write errors to the
533	* release log at runtime. */
534	static PFNRTLOGRELPRINTF g_pfnRTLogRelPrintf = NULL;
535	/** Log volume name (for attempting volume flush). */
536	static RTUTF16 g_wszStartupLogVol[16];
537	#endif
538
539
540	/*********************************************************************************************************************************
541	* Internal Functions *
542	*********************************************************************************************************************************/
543	#ifdef SUP_HARDENED_SUID
544	static void supR3HardenedMainDropPrivileges(void);
545	#endif
546	static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName);
547
548
549	/**
550	* Safely copy one or more strings into the given buffer.
551	*
552	* @returns VINF_SUCCESS or VERR_BUFFER_OVERFLOW.
553	* @param pszDst The destionation buffer.
554	* @param cbDst The size of the destination buffer.
555	* @param ... One or more zero terminated strings, ending with
556	* a NULL.
557	*/
558	static int suplibHardenedStrCopyEx(char *pszDst, size_t cbDst, ...)
559	{
560	int rc = VINF_SUCCESS;
561
562	if (cbDst == 0)
563	return VERR_BUFFER_OVERFLOW;
564
565	va_list va;
566	va_start(va, cbDst);
567	for (;;)
568	{
569	const char pszSrc = va_arg(va, const char );
570	if (!pszSrc)
571	break;
572
573	size_t cchSrc = suplibHardenedStrLen(pszSrc);
574	if (cchSrc < cbDst)
575	{
576	suplibHardenedMemCopy(pszDst, pszSrc, cchSrc);
577	pszDst += cchSrc;
578	cbDst -= cchSrc;
579	}
580	else
581	{
582	rc = VERR_BUFFER_OVERFLOW;
583	if (cbDst > 1)
584	{
585	suplibHardenedMemCopy(pszDst, pszSrc, cbDst - 1);
586	pszDst += cbDst - 1;
587	cbDst = 1;
588	}
589	}
590	*pszDst = '\0';
591	}
592	va_end(va);
593
594	return rc;
595	}
596
597
598	/**
599	* Exit current process in the quickest possible fashion.
600	*
601	* @param rcExit The exit code.
602	*/
603	DECLNORETURN(void) suplibHardenedExit(RTEXITCODE rcExit)
604	{
605	for (;;)
606	{
607	#ifdef RT_OS_WINDOWS
608	if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
609	ExitProcess(rcExit);
610	if (RtlExitUserProcess != NULL)
611	RtlExitUserProcess(rcExit);
612	NtTerminateProcess(NtCurrentProcess(), rcExit);
613	#else
614	_Exit(rcExit);
615	#endif
616	}
617	}
618
619
620	/**
621	* Writes a substring to standard error.
622	*
623	* @param pch The start of the substring.
624	* @param cch The length of the substring.
625	*/
626	static void suplibHardenedPrintStrN(const char *pch, size_t cch)
627	{
628	#ifdef RT_OS_WINDOWS
629	HANDLE hStdOut = NtCurrentPeb()->ProcessParameters->StandardOutput;
630	if (hStdOut != NULL)
631	{
632	if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
633	{
634	DWORD cbWritten;
635	WriteFile(hStdOut, pch, (DWORD)cch, &cbWritten, NULL);
636	}
637	/* Windows 7 and earlier uses fake handles, with the last two bits set ((hStdOut & 3) == 3). */
638	else if (NtWriteFile != NULL && ((uintptr_t)hStdOut & 3) == 0)
639	{
640	IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
641	NtWriteFile(hStdOut, NULL /Event/, NULL /ApcRoutine/, NULL /ApcContext/,
642	&Ios, (PVOID)pch, (ULONG)cch, NULL /ByteOffset/, NULL /Key/);
643	}
644	}
645	#else
646	int res = write(2, pch, cch);
647	NOREF(res);
648	#endif
649	}
650
651
652	/**
653	* Writes a string to standard error.
654	*
655	* @param psz The string.
656	*/
657	static void suplibHardenedPrintStr(const char *psz)
658	{
659	suplibHardenedPrintStrN(psz, suplibHardenedStrLen(psz));
660	}
661
662
663	/**
664	* Writes a char to standard error.
665	*
666	* @param ch The character value to write.
667	*/
668	static void suplibHardenedPrintChr(char ch)
669	{
670	suplibHardenedPrintStrN(&ch, 1);
671	}
672
673	#ifndef IPRT_NO_CRT
674
675	/**
676	* Writes a decimal number to stdard error.
677	*
678	* @param uValue The value.
679	*/
680	static void suplibHardenedPrintDecimal(uint64_t uValue)
681	{
682	char szBuf[64];
683	char *pszEnd = &szBuf[sizeof(szBuf) - 1];
684	char *psz = pszEnd;
685
686	*psz-- = '\0';
687
688	do
689	{
690	*psz-- = '0' + (uValue % 10);
691	uValue /= 10;
692	} while (uValue > 0);
693
694	psz++;
695	suplibHardenedPrintStrN(psz, pszEnd - psz);
696	}
697
698
699	/**
700	* Writes a hexadecimal or octal number to standard error.
701	*
702	* @param uValue The value.
703	* @param uBase The base (16 or 8).
704	* @param fFlags Format flags.
705	*/
706	static void suplibHardenedPrintHexOctal(uint64_t uValue, unsigned uBase, uint32_t fFlags)
707	{
708	static char const s_achDigitsLower[17] = "0123456789abcdef";
709	static char const s_achDigitsUpper[17] = "0123456789ABCDEF";
710	const char *pchDigits = !(fFlags & RTSTR_F_CAPITAL) ? s_achDigitsLower : s_achDigitsUpper;
711	unsigned cShift = uBase == 16 ? 4 : 3;
712	unsigned fDigitMask = uBase == 16 ? 0xf : 7;
713	char szBuf[64];
714	char *pszEnd = &szBuf[sizeof(szBuf) - 1];
715	char *psz = pszEnd;
716
717	*psz-- = '\0';
718
719	do
720	{
721	*psz-- = pchDigits[uValue & fDigitMask];
722	uValue >>= cShift;
723	} while (uValue > 0);
724
725	if ((fFlags & RTSTR_F_SPECIAL) && uBase == 16)
726	{
727	*psz-- = !(fFlags & RTSTR_F_CAPITAL) ? 'x' : 'X';
728	*psz-- = '0';
729	}
730
731	psz++;
732	suplibHardenedPrintStrN(psz, pszEnd - psz);
733	}
734
735
736	/**
737	* Writes a wide character string to standard error.
738	*
739	* @param pwsz The string.
740	*/
741	static void suplibHardenedPrintWideStr(PCRTUTF16 pwsz)
742	{
743	for (;;)
744	{
745	RTUTF16 wc = *pwsz++;
746	if (!wc)
747	return;
748	if ( (wc < 0x7f && wc >= 0x20)
749	\|\| wc == '\n'
750	\|\| wc == '\r')
751	suplibHardenedPrintChr((char)wc);
752	else
753	{
754	suplibHardenedPrintStrN(RT_STR_TUPLE("\\x"));
755	suplibHardenedPrintHexOctal(wc, 16, 0);
756	}
757	}
758	}
759
760	#else /* IPRT_NO_CRT */
761
762	/** Buffer structure used by suplibHardenedOutput. */
763	struct SUPLIBHARDENEDOUTPUTBUF
764	{
765	size_t off;
766	char szBuf[2048];
767	};
768
769	/** Callback for RTStrFormatV, see FNRTSTROUTPUT. */
770	static DECLCALLBACK(size_t) suplibHardenedOutput(void pvArg, const char pachChars, size_t cbChars)
771	{
772	SUPLIBHARDENEDOUTPUTBUF pBuf = (SUPLIBHARDENEDOUTPUTBUF )pvArg;
773	size_t cbTodo = cbChars;
774	for (;;)
775	{
776	size_t cbSpace = sizeof(pBuf->szBuf) - pBuf->off - 1;
777
778	/* Flush the buffer? */
779	if ( cbSpace == 0
780	\|\| (cbTodo == 0 && pBuf->off))
781	{
782	suplibHardenedPrintStrN(pBuf->szBuf, pBuf->off);
783	# ifdef RT_OS_WINDOWS
784	if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
785	OutputDebugString(pBuf->szBuf);
786	# endif
787	pBuf->off = 0;
788	cbSpace = sizeof(pBuf->szBuf) - 1;
789	}
790
791	/* Copy the string into the buffer. */
792	if (cbTodo == 1)
793	{
794	pBuf->szBuf[pBuf->off++] = *pachChars;
795	break;
796	}
797	if (cbSpace >= cbTodo)
798	{
799	memcpy(&pBuf->szBuf[pBuf->off], pachChars, cbTodo);
800	pBuf->off += cbTodo;
801	break;
802	}
803	memcpy(&pBuf->szBuf[pBuf->off], pachChars, cbSpace);
804	pBuf->off += cbSpace;
805	cbTodo -= cbSpace;
806	}
807	pBuf->szBuf[pBuf->off] = '\0';
808
809	return cbChars;
810	}
811
812	#endif /* IPRT_NO_CRT */
813
814	/**
815	* Simple printf to standard error.
816	*
817	* @param pszFormat The format string.
818	* @param va Arguments to format.
819	*/
820	DECLHIDDEN(void) suplibHardenedPrintFV(const char *pszFormat, va_list va)
821	{
822	#ifdef IPRT_NO_CRT
823	/*
824	* Use buffered output here to avoid character mixing on the windows
825	* console and to enable us to use OutputDebugString.
826	*/
827	SUPLIBHARDENEDOUTPUTBUF Buf;
828	Buf.off = 0;
829	Buf.szBuf[0] = '\0';
830	RTStrFormatV(suplibHardenedOutput, &Buf, NULL, NULL, pszFormat, va);
831
832	#else /* !IPRT_NO_CRT */
833	/*
834	* Format loop.
835	*/
836	char ch;
837	const char *pszLast = pszFormat;
838	for (;;)
839	{
840	ch = *pszFormat;
841	if (!ch)
842	break;
843	pszFormat++;
844
845	if (ch == '%')
846	{
847	/*
848	* Format argument.
849	*/
850
851	/* Flush unwritten bits. */
852	if (pszLast != pszFormat - 1)
853	suplibHardenedPrintStrN(pszLast, pszFormat - pszLast - 1);
854	pszLast = pszFormat;
855	ch = *pszFormat++;
856
857	/* flags. */
858	uint32_t fFlags = 0;
859	for (;;)
860	{
861	if (ch == '#') fFlags \|= RTSTR_F_SPECIAL;
862	else if (ch == '-') fFlags \|= RTSTR_F_LEFT;
863	else if (ch == '+') fFlags \|= RTSTR_F_PLUS;
864	else if (ch == ' ') fFlags \|= RTSTR_F_BLANK;
865	else if (ch == '0') fFlags \|= RTSTR_F_ZEROPAD;
866	else if (ch == '\'') fFlags \|= RTSTR_F_THOUSAND_SEP;
867	else break;
868	ch = *pszFormat++;
869	}
870
871	/* Width and precision - ignored. */
872	while (RT_C_IS_DIGIT(ch))
873	ch = *pszFormat++;
874	if (ch == '*')
875	va_arg(va, int);
876	if (ch == '.')
877	{
878	do ch = *pszFormat++;
879	while (RT_C_IS_DIGIT(ch));
880	if (ch == '*')
881	va_arg(va, int);
882	}
883
884	/* Size. */
885	char chArgSize = 0;
886	switch (ch)
887	{
888	case 'z':
889	case 'L':
890	case 'j':
891	case 't':
892	chArgSize = ch;
893	ch = *pszFormat++;
894	break;
895
896	case 'l':
897	chArgSize = ch;
898	ch = *pszFormat++;
899	if (ch == 'l')
900	{
901	chArgSize = 'L';
902	ch = *pszFormat++;
903	}
904	break;
905
906	case 'h':
907	chArgSize = ch;
908	ch = *pszFormat++;
909	if (ch == 'h')
910	{
911	chArgSize = 'H';
912	ch = *pszFormat++;
913	}
914	break;
915	}
916
917	/*
918	* Do type specific formatting.
919	*/
920	switch (ch)
921	{
922	case 'c':
923	ch = (char)va_arg(va, int);
924	suplibHardenedPrintChr(ch);
925	break;
926
927	case 's':
928	if (chArgSize == 'l')
929	{
930	PCRTUTF16 pwszStr = va_arg(va, PCRTUTF16 );
931	if (RT_VALID_PTR(pwszStr))
932	suplibHardenedPrintWideStr(pwszStr);
933	else
934	suplibHardenedPrintStr("<NULL>");
935	}
936	else
937	{
938	const char pszStr = va_arg(va, const char );
939	if (!RT_VALID_PTR(pszStr))
940	pszStr = "<NULL>";
941	suplibHardenedPrintStr(pszStr);
942	}
943	break;
944
945	case 'd':
946	case 'i':
947	{
948	int64_t iValue;
949	if (chArgSize == 'L' \|\| chArgSize == 'j')
950	iValue = va_arg(va, int64_t);
951	else if (chArgSize == 'l')
952	iValue = va_arg(va, signed long);
953	else if (chArgSize == 'z' \|\| chArgSize == 't')
954	iValue = va_arg(va, intptr_t);
955	else
956	iValue = va_arg(va, signed int);
957	if (iValue < 0)
958	{
959	suplibHardenedPrintChr('-');
960	iValue = -iValue;
961	}
962	suplibHardenedPrintDecimal(iValue);
963	break;
964	}
965
966	case 'p':
967	case 'x':
968	case 'X':
969	case 'u':
970	case 'o':
971	{
972	unsigned uBase = 10;
973	uint64_t uValue;
974
975	switch (ch)
976	{
977	case 'p':
978	fFlags \|= RTSTR_F_ZEROPAD; /* Note not standard behaviour (but I like it this way!) */
979	uBase = 16;
980	break;
981	case 'X':
982	fFlags \|= RTSTR_F_CAPITAL;
983	case 'x':
984	uBase = 16;
985	break;
986	case 'u':
987	uBase = 10;
988	break;
989	case 'o':
990	uBase = 8;
991	break;
992	}
993
994	if (ch == 'p' \|\| chArgSize == 'z' \|\| chArgSize == 't')
995	uValue = va_arg(va, uintptr_t);
996	else if (chArgSize == 'L' \|\| chArgSize == 'j')
997	uValue = va_arg(va, uint64_t);
998	else if (chArgSize == 'l')
999	uValue = va_arg(va, unsigned long);
1000	else
1001	uValue = va_arg(va, unsigned int);
1002
1003	if (uBase == 10)
1004	suplibHardenedPrintDecimal(uValue);
1005	else
1006	suplibHardenedPrintHexOctal(uValue, uBase, fFlags);
1007	break;
1008	}
1009
1010	case 'R':
1011	if (pszFormat[0] == 'r' && pszFormat[1] == 'c')
1012	{
1013	int iValue = va_arg(va, int);
1014	if (iValue < 0)
1015	{
1016	suplibHardenedPrintChr('-');
1017	iValue = -iValue;
1018	}
1019	suplibHardenedPrintDecimal(iValue);
1020	pszFormat += 2;
1021	break;
1022	}
1023	/* fall thru */
1024
1025	/*
1026	* Custom format.
1027	*/
1028	default:
1029	suplibHardenedPrintStr("[bad format: ");
1030	suplibHardenedPrintStrN(pszLast, pszFormat - pszLast);
1031	suplibHardenedPrintChr(']');
1032	break;
1033	}
1034
1035	/* continue */
1036	pszLast = pszFormat;
1037	}
1038	}
1039
1040	/* Flush the last bits of the string. */
1041	if (pszLast != pszFormat)
1042	suplibHardenedPrintStrN(pszLast, pszFormat - pszLast);
1043	#endif /* !IPRT_NO_CRT */
1044	}
1045
1046
1047	/**
1048	* Prints to standard error.
1049	*
1050	* @param pszFormat The format string.
1051	* @param ... Arguments to format.
1052	*/
1053	DECLHIDDEN(void) suplibHardenedPrintF(const char *pszFormat, ...)
1054	{
1055	va_list va;
1056	va_start(va, pszFormat);
1057	suplibHardenedPrintFV(pszFormat, va);
1058	va_end(va);
1059	}
1060
1061
1062	/**
1063	* @copydoc RTPathStripFilename
1064	*/
1065	static void suplibHardenedPathStripFilename(char *pszPath)
1066	{
1067	char *psz = pszPath;
1068	char *pszLastSep = pszPath;
1069
1070	for (;; psz++)
1071	{
1072	switch (*psz)
1073	{
1074	/* handle separators. */
1075	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
1076	case ':':
1077	pszLastSep = psz + 1;
1078	break;
1079
1080	case '\\':
1081	#endif
1082	case '/':
1083	pszLastSep = psz;
1084	break;
1085
1086	/* the end */
1087	case '\0':
1088	if (pszLastSep == pszPath)
1089	*pszLastSep++ = '.';
1090	*pszLastSep = '\0';
1091	return;
1092	}
1093	}
1094	/* will never get here */
1095	}
1096
1097
1098	/**
1099	* @copydoc RTPathFilename
1100	*/
1101	DECLHIDDEN(char ) supR3HardenedPathFilename(const char pszPath)
1102	{
1103	const char *psz = pszPath;
1104	const char *pszLastComp = pszPath;
1105
1106	for (;; psz++)
1107	{
1108	switch (*psz)
1109	{
1110	/* handle separators. */
1111	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
1112	case ':':
1113	pszLastComp = psz + 1;
1114	break;
1115
1116	case '\\':
1117	#endif
1118	case '/':
1119	pszLastComp = psz + 1;
1120	break;
1121
1122	/* the end */
1123	case '\0':
1124	if (*pszLastComp)
1125	return (char )(void )pszLastComp;
1126	return NULL;
1127	}
1128	}
1129
1130	/* will never get here */
1131	}
1132
1133
1134	/**
1135	* @copydoc RTPathAppPrivateNoArch
1136	*/
1137	DECLHIDDEN(int) supR3HardenedPathAppPrivateNoArch(char *pszPath, size_t cchPath)
1138	{
1139	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE)
1140	const char *pszSrcPath = RTPATH_APP_PRIVATE;
1141	size_t cchPathPrivateNoArch = suplibHardenedStrLen(pszSrcPath);
1142	if (cchPathPrivateNoArch >= cchPath)
1143	supR3HardenedFatal("supR3HardenedPathAppPrivateNoArch: Buffer overflow, %zu >= %zu\n", cchPathPrivateNoArch, cchPath);
1144	suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathPrivateNoArch + 1);
1145	return VINF_SUCCESS;
1146
1147	#else
1148	return supR3HardenedPathAppBin(pszPath, cchPath);
1149	#endif
1150	}
1151
1152
1153	/**
1154	* @copydoc RTPathAppPrivateArch
1155	*/
1156	DECLHIDDEN(int) supR3HardenedPathAppPrivateArch(char *pszPath, size_t cchPath)
1157	{
1158	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE_ARCH)
1159	const char *pszSrcPath = RTPATH_APP_PRIVATE_ARCH;
1160	size_t cchPathPrivateArch = suplibHardenedStrLen(pszSrcPath);
1161	if (cchPathPrivateArch >= cchPath)
1162	supR3HardenedFatal("supR3HardenedPathAppPrivateArch: Buffer overflow, %zu >= %zu\n", cchPathPrivateArch, cchPath);
1163	suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathPrivateArch + 1);
1164	return VINF_SUCCESS;
1165
1166	#else
1167	return supR3HardenedPathAppBin(pszPath, cchPath);
1168	#endif
1169	}
1170
1171
1172	/**
1173	* @copydoc RTPathSharedLibs
1174	*/
1175	DECLHIDDEN(int) supR3HardenedPathAppSharedLibs(char *pszPath, size_t cchPath)
1176	{
1177	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_SHARED_LIBS)
1178	const char *pszSrcPath = RTPATH_SHARED_LIBS;
1179	size_t cchPathSharedLibs = suplibHardenedStrLen(pszSrcPath);
1180	if (cchPathSharedLibs >= cchPath)
1181	supR3HardenedFatal("supR3HardenedPathAppSharedLibs: Buffer overflow, %zu >= %zu\n", cchPathSharedLibs, cchPath);
1182	suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathSharedLibs + 1);
1183	return VINF_SUCCESS;
1184
1185	#else
1186	return supR3HardenedPathAppBin(pszPath, cchPath);
1187	#endif
1188	}
1189
1190
1191	/**
1192	* @copydoc RTPathAppDocs
1193	*/
1194	DECLHIDDEN(int) supR3HardenedPathAppDocs(char *pszPath, size_t cchPath)
1195	{
1196	#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_DOCS)
1197	const char *pszSrcPath = RTPATH_APP_DOCS;
1198	size_t cchPathAppDocs = suplibHardenedStrLen(pszSrcPath);
1199	if (cchPathAppDocs >= cchPath)
1200	supR3HardenedFatal("supR3HardenedPathAppDocs: Buffer overflow, %zu >= %zu\n", cchPathAppDocs, cchPath);
1201	suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathAppDocs + 1);
1202	return VINF_SUCCESS;
1203
1204	#else
1205	return supR3HardenedPathAppBin(pszPath, cchPath);
1206	#endif
1207	}
1208
1209
1210	/**
1211	* Returns the full path to the executable in g_szSupLibHardenedExePath.
1212	*
1213	* @returns IPRT status code.
1214	*/
1215	static void supR3HardenedGetFullExePath(void)
1216	{
1217	/*
1218	* Get the program filename.
1219	*
1220	* Most UNIXes have no API for obtaining the executable path, but provides a symbolic
1221	* link in the proc file system that tells who was exec'ed. The bad thing about this
1222	* is that we have to use readlink, one of the weirder UNIX APIs.
1223	*
1224	* Darwin, OS/2 and Windows all have proper APIs for getting the program file name.
1225	*/
1226	#if defined(RT_OS_LINUX) \|\| defined(RT_OS_FREEBSD) \|\| defined(RT_OS_SOLARIS)
1227	# ifdef RT_OS_LINUX
1228	int cchLink = readlink("/proc/self/exe", &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
1229
1230	# elif defined(RT_OS_SOLARIS)
1231	char szFileBuf[PATH_MAX + 1];
1232	sprintf(szFileBuf, "/proc/%ld/path/a.out", (long)getpid());
1233	int cchLink = readlink(szFileBuf, &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
1234
1235	# else /* RT_OS_FREEBSD */
1236	int aiName[4];
1237	aiName[0] = CTL_KERN;
1238	aiName[1] = KERN_PROC;
1239	aiName[2] = KERN_PROC_PATHNAME;
1240	aiName[3] = getpid();
1241
1242	size_t cbPath = sizeof(g_szSupLibHardenedExePath);
1243	if (sysctl(aiName, RT_ELEMENTS(aiName), g_szSupLibHardenedExePath, &cbPath, NULL, 0) < 0)
1244	supR3HardenedFatal("supR3HardenedExecDir: sysctl failed\n");
1245	g_szSupLibHardenedExePath[sizeof(g_szSupLibHardenedExePath) - 1] = '\0';
1246	int cchLink = suplibHardenedStrLen(g_szSupLibHardenedExePath); /* paranoid? can't we use cbPath? */
1247
1248	# endif
1249	if (cchLink < 0 \|\| cchLink == sizeof(g_szSupLibHardenedExePath) - 1)
1250	supR3HardenedFatal("supR3HardenedExecDir: couldn't read \"%s\", errno=%d cchLink=%d\n",
1251	g_szSupLibHardenedExePath, errno, cchLink);
1252	g_szSupLibHardenedExePath[cchLink] = '\0';
1253
1254	#elif defined(RT_OS_OS2) \|\| defined(RT_OS_L4)
1255	_execname(g_szSupLibHardenedExePath, sizeof(g_szSupLibHardenedExePath));
1256
1257	#elif defined(RT_OS_DARWIN)
1258	const char *pszImageName = _dyld_get_image_name(0);
1259	if (!pszImageName)
1260	supR3HardenedFatal("supR3HardenedExecDir: _dyld_get_image_name(0) failed\n");
1261	size_t cchImageName = suplibHardenedStrLen(pszImageName);
1262	if (!cchImageName \|\| cchImageName >= sizeof(g_szSupLibHardenedExePath))
1263	supR3HardenedFatal("supR3HardenedExecDir: _dyld_get_image_name(0) failed, cchImageName=%d\n", cchImageName);
1264	suplibHardenedMemCopy(g_szSupLibHardenedExePath, pszImageName, cchImageName + 1);
1265
1266	#elif defined(RT_OS_WINDOWS)
1267	char *pszDst = g_szSupLibHardenedExePath;
1268	int rc = RTUtf16ToUtf8Ex(g_wszSupLibHardenedExePath, RTSTR_MAX, &pszDst, sizeof(g_szSupLibHardenedExePath), NULL);
1269	if (RT_FAILURE(rc))
1270	supR3HardenedFatal("supR3HardenedExecDir: RTUtf16ToUtf8Ex failed, rc=%Rrc\n", rc);
1271	#else
1272	# error needs porting.
1273	#endif
1274
1275	/*
1276	* Determine the application binary directory location.
1277	*/
1278	suplibHardenedStrCopy(g_szSupLibHardenedAppBinPath, g_szSupLibHardenedExePath);
1279	suplibHardenedPathStripFilename(g_szSupLibHardenedAppBinPath);
1280
1281	if (g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_HARDENED_MAIN_CALLED)
1282	supR3HardenedFatal("supR3HardenedExecDir: Called before SUPR3HardenedMain! (%d)\n", g_enmSupR3HardenedMainState);
1283	switch (g_fSupHardenedMain & SUPSECMAIN_FLAGS_LOC_MASK)
1284	{
1285	case SUPSECMAIN_FLAGS_LOC_APP_BIN:
1286	break;
1287	case SUPSECMAIN_FLAGS_LOC_TESTCASE:
1288	suplibHardenedPathStripFilename(g_szSupLibHardenedAppBinPath);
1289	break;
1290	default:
1291	supR3HardenedFatal("supR3HardenedExecDir: Unknown program binary location: %#x\n", g_fSupHardenedMain);
1292	}
1293	}
1294
1295
1296	#ifdef RT_OS_LINUX
1297	/**
1298	* Checks if we can read /proc/self/exe.
1299	*
1300	* This is used on linux to see if we have to call init
1301	* with program path or not.
1302	*
1303	* @returns true / false.
1304	*/
1305	static bool supR3HardenedMainIsProcSelfExeAccssible(void)
1306	{
1307	char szPath[RTPATH_MAX];
1308	int cchLink = readlink("/proc/self/exe", szPath, sizeof(szPath));
1309	return cchLink != -1;
1310	}
1311	#endif /* RT_OS_LINUX */
1312
1313
1314
1315	/**
1316	* @copydoc RTPathExecDir
1317	* @remarks not quite like RTPathExecDir actually...
1318	*/
1319	DECLHIDDEN(int) supR3HardenedPathAppBin(char *pszPath, size_t cchPath)
1320	{
1321	/*
1322	* Lazy init (probably not required).
1323	*/
1324	if (!g_szSupLibHardenedAppBinPath[0])
1325	supR3HardenedGetFullExePath();
1326
1327	/*
1328	* Calc the length and check if there is space before copying.
1329	*/
1330	size_t cch = suplibHardenedStrLen(g_szSupLibHardenedAppBinPath) + 1;
1331	if (cch <= cchPath)
1332	{
1333	suplibHardenedMemCopy(pszPath, g_szSupLibHardenedAppBinPath, cch + 1);
1334	return VINF_SUCCESS;
1335	}
1336
1337	supR3HardenedFatal("supR3HardenedPathAppBin: Buffer too small (%u < %u)\n", cchPath, cch);
1338	/* not reached */
1339	}
1340
1341
1342	#ifdef RT_OS_WINDOWS
1343	extern "C" uint32_t g_uNtVerCombined;
1344	#endif
1345
1346	DECLHIDDEN(void) supR3HardenedOpenLog(int pcArgs, char *papszArgs)
1347	{
1348	static const char s_szLogOption[] = "--sup-hardening-log=";
1349
1350	/*
1351	* Scan the argument vector.
1352	*/
1353	int cArgs = *pcArgs;
1354	for (int iArg = 1; iArg < cArgs; iArg++)
1355	if (strncmp(papszArgs[iArg], s_szLogOption, sizeof(s_szLogOption) - 1) == 0)
1356	{
1357	#ifdef RT_OS_WINDOWS
1358	const char *pszLogFile = &papszArgs[iArg][sizeof(s_szLogOption) - 1];
1359	#endif
1360
1361	/*
1362	* Drop the argument from the vector (has trailing NULL entry).
1363	*/
1364	memmove(&papszArgs[iArg], &papszArgs[iArg + 1], (cArgs - iArg) * sizeof(papszArgs[0]));
1365	*pcArgs -= 1;
1366	cArgs -= 1;
1367
1368	/*
1369	* Open the log file, unless we've already opened one.
1370	* First argument takes precedence
1371	*/
1372	#ifdef RT_OS_WINDOWS
1373	if (g_hStartupLog == NULL)
1374	{
1375	int rc = RTNtPathOpen(pszLogFile,
1376	GENERIC_WRITE \| SYNCHRONIZE,
1377	FILE_ATTRIBUTE_NORMAL,
1378	FILE_SHARE_READ \| FILE_SHARE_WRITE,
1379	FILE_OPEN_IF,
1380	FILE_NON_DIRECTORY_FILE \| FILE_SYNCHRONOUS_IO_NONALERT,
1381	OBJ_CASE_INSENSITIVE,
1382	&g_hStartupLog,
1383	NULL);
1384	if (RT_SUCCESS(rc))
1385	{
1386	SUP_DPRINTF(("Log file opened: " VBOX_VERSION_STRING "r%u g_hStartupLog=%p g_uNtVerCombined=%#x\n",
1387	VBOX_SVN_REV, g_hStartupLog, g_uNtVerCombined));
1388
1389	/*
1390	* If the path contains a drive volume, save it so we can
1391	* use it to flush the volume containing the log file.
1392	*/
1393	if (RT_C_IS_ALPHA(pszLogFile[0]) && pszLogFile[1] == ':')
1394	{
1395	RTUtf16CopyAscii(g_wszStartupLogVol, RT_ELEMENTS(g_wszStartupLogVol), "\\??\\");
1396	g_wszStartupLogVol[sizeof("\\??\\") - 1] = RT_C_TO_UPPER(pszLogFile[0]);
1397	g_wszStartupLogVol[sizeof("\\??\\") + 0] = ':';
1398	g_wszStartupLogVol[sizeof("\\??\\") + 1] = '\0';
1399	}
1400	}
1401	else
1402	g_hStartupLog = NULL;
1403	}
1404	#else
1405	/* Just some mumbo jumbo to shut up the compiler. */
1406	g_hStartupLog -= 1;
1407	g_cbStartupLog += 1;
1408	//g_hStartupLog = open()
1409	#endif
1410	}
1411	}
1412
1413
1414	DECLHIDDEN(void) supR3HardenedLogV(const char *pszFormat, va_list va)
1415	{
1416	#ifdef RT_OS_WINDOWS
1417	if ( g_hStartupLog != NULL
1418	&& g_cbStartupLog < 16*_1M)
1419	{
1420	char szBuf[5120];
1421	PCLIENT_ID pSelfId = &((PTEB)NtCurrentTeb())->ClientId;
1422	size_t cchPrefix = RTStrPrintf(szBuf, sizeof(szBuf), "%x.%x: ", pSelfId->UniqueProcess, pSelfId->UniqueThread);
1423	size_t cch = RTStrPrintfV(&szBuf[cchPrefix], sizeof(szBuf) - cchPrefix, pszFormat, va) + cchPrefix;
1424
1425	if ((size_t)cch >= sizeof(szBuf))
1426	cch = sizeof(szBuf) - 1;
1427
1428	if (!cch \|\| szBuf[cch - 1] != '\n')
1429	szBuf[cch++] = '\n';
1430
1431	ASMAtomicAddU32(&g_cbStartupLog, (uint32_t)cch);
1432
1433	IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
1434	LARGE_INTEGER Offset;
1435	Offset.QuadPart = -1; /* Write to end of file. */
1436	NtWriteFile(g_hStartupLog, NULL /Event/, NULL /ApcRoutine/, NULL /ApcContext/,
1437	&Ios, szBuf, (ULONG)cch, &Offset, NULL /Key/);
1438	}
1439	#else
1440	RT_NOREF(pszFormat, va);
1441	/* later */
1442	#endif
1443	}
1444
1445
1446	DECLHIDDEN(void) supR3HardenedLog(const char *pszFormat, ...)
1447	{
1448	va_list va;
1449	va_start(va, pszFormat);
1450	supR3HardenedLogV(pszFormat, va);
1451	va_end(va);
1452	}
1453
1454
1455	DECLHIDDEN(void) supR3HardenedLogFlush(void)
1456	{
1457	#ifdef RT_OS_WINDOWS
1458	if ( g_hStartupLog != NULL
1459	&& g_cbStartupLog < 16*_1M)
1460	{
1461	IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
1462	NTSTATUS rcNt = NtFlushBuffersFile(g_hStartupLog, &Ios);
1463
1464	/*
1465	* Try flush the volume containing the log file too.
1466	*/
1467	if (g_wszStartupLogVol[0])
1468	{
1469	HANDLE hLogVol = RTNT_INVALID_HANDLE_VALUE;
1470	UNICODE_STRING NtName;
1471	NtName.Buffer = g_wszStartupLogVol;
1472	NtName.Length = (USHORT)(RTUtf16Len(g_wszStartupLogVol) * sizeof(RTUTF16));
1473	NtName.MaximumLength = NtName.Length + 1;
1474	OBJECT_ATTRIBUTES ObjAttr;
1475	InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /hRootDir/, NULL /pSecDesc/);
1476	RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
1477	rcNt = NtCreateFile(&hLogVol,
1478	GENERIC_WRITE \| GENERIC_READ \| SYNCHRONIZE \| FILE_READ_ATTRIBUTES,
1479	&ObjAttr,
1480	&Ios,
1481	NULL /* Allocation Size*/,
1482	0 /FileAttributes/,
1483	FILE_SHARE_READ \| FILE_SHARE_WRITE \| FILE_SHARE_DELETE,
1484	FILE_OPEN,
1485	FILE_NON_DIRECTORY_FILE \| FILE_SYNCHRONOUS_IO_NONALERT,
1486	NULL /EaBuffer/,
1487	0 /EaLength/);
1488	if (NT_SUCCESS(rcNt))
1489	rcNt = Ios.Status;
1490	if (NT_SUCCESS(rcNt))
1491	{
1492	RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
1493	rcNt = NtFlushBuffersFile(hLogVol, &Ios);
1494	NtClose(hLogVol);
1495	}
1496	else
1497	{
1498	/* This may have sideeffects similar to what we want... */
1499	hLogVol = RTNT_INVALID_HANDLE_VALUE;
1500	RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
1501	rcNt = NtCreateFile(&hLogVol,
1502	GENERIC_READ \| SYNCHRONIZE \| FILE_READ_ATTRIBUTES,
1503	&ObjAttr,
1504	&Ios,
1505	NULL /* Allocation Size*/,
1506	0 /FileAttributes/,
1507	FILE_SHARE_READ \| FILE_SHARE_WRITE \| FILE_SHARE_DELETE,
1508	FILE_OPEN,
1509	FILE_NON_DIRECTORY_FILE \| FILE_SYNCHRONOUS_IO_NONALERT,
1510	NULL /EaBuffer/,
1511	0 /EaLength/);
1512	if (NT_SUCCESS(rcNt) && NT_SUCCESS(Ios.Status))
1513	NtClose(hLogVol);
1514	}
1515	}
1516	}
1517	#else
1518	/* later */
1519	#endif
1520	}
1521
1522
1523	/**
1524	* Prints the message prefix.
1525	*/
1526	static void suplibHardenedPrintPrefix(void)
1527	{
1528	if (g_pszSupLibHardenedProgName)
1529	suplibHardenedPrintStr(g_pszSupLibHardenedProgName);
1530	suplibHardenedPrintStr(": ");
1531	}
1532
1533
1534	DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatalMsgV(const char *pszWhere, SUPINITOP enmWhat, int rc,
1535	const char *pszMsgFmt, va_list va)
1536	{
1537	/*
1538	* First to the log.
1539	*/
1540	supR3HardenedLog("Error %d in %s! (enmWhat=%d)\n", rc, pszWhere, enmWhat);
1541	va_list vaCopy;
1542	va_copy(vaCopy, va);
1543	supR3HardenedLogV(pszMsgFmt, vaCopy);
1544	va_end(vaCopy);
1545
1546	#ifdef RT_OS_WINDOWS
1547	/*
1548	* The release log.
1549	*/
1550	if (g_pfnRTLogRelPrintf)
1551	{
1552	va_copy(vaCopy, va);
1553	g_pfnRTLogRelPrintf("supR3HardenedFatalMsgV: %s enmWhat=%d rc=%Rrc (%#x)\n", pszWhere, enmWhat, rc);
1554	g_pfnRTLogRelPrintf("supR3HardenedFatalMsgV: %N\n", pszMsgFmt, &vaCopy);
1555	va_end(vaCopy);
1556	}
1557	#endif
1558
1559	/*
1560	* Then to the console.
1561	*/
1562	suplibHardenedPrintPrefix();
1563	suplibHardenedPrintF("Error %d in %s!\n", rc, pszWhere);
1564
1565	suplibHardenedPrintPrefix();
1566	va_copy(vaCopy, va);
1567	suplibHardenedPrintFV(pszMsgFmt, vaCopy);
1568	va_end(vaCopy);
1569	suplibHardenedPrintChr('\n');
1570
1571	switch (enmWhat)
1572	{
1573	case kSupInitOp_Driver:
1574	suplibHardenedPrintChr('\n');
1575	suplibHardenedPrintPrefix();
1576	suplibHardenedPrintStr("Tip! Make sure the kernel module is loaded. It may also help to reinstall VirtualBox.\n");
1577	break;
1578
1579	case kSupInitOp_Misc:
1580	case kSupInitOp_IPRT:
1581	case kSupInitOp_Integrity:
1582	case kSupInitOp_RootCheck:
1583	suplibHardenedPrintChr('\n');
1584	suplibHardenedPrintPrefix();
1585	suplibHardenedPrintStr("Tip! It may help to reinstall VirtualBox.\n");
1586	break;
1587
1588	default:
1589	/* no hints here */
1590	break;
1591	}
1592
1593	/*
1594	* Finally, TrustedError if appropriate.
1595	*/
1596	if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
1597	{
1598	#ifdef SUP_HARDENED_SUID
1599	/*
1600	* Drop any root privileges we might be holding, this won't return
1601	* if it fails but end up calling supR3HardenedFatal[V].
1602	*/
1603	supR3HardenedMainDropPrivileges();
1604	#endif
1605
1606	/*
1607	* Now try resolve and call the TrustedError entry point if we can
1608	* find it. We'll fork before we attempt this because that way the
1609	* session management in main will see us exiting immediately (if
1610	* it's involved with us).
1611	*/
1612	#if !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
1613	int pid = fork();
1614	if (pid <= 0)
1615	#endif
1616	{
1617	static volatile bool s_fRecursive = false; /* Loader hooks may cause recursion. */
1618	if (!s_fRecursive)
1619	{
1620	s_fRecursive = true;
1621
1622	PFNSUPTRUSTEDERROR pfnTrustedError = supR3HardenedMainGetTrustedError(g_pszSupLibHardenedProgName);
1623	if (pfnTrustedError)
1624	pfnTrustedError(pszWhere, enmWhat, rc, pszMsgFmt, va);
1625
1626	s_fRecursive = false;
1627	}
1628	}
1629	}
1630	#if defined(RT_OS_WINDOWS)
1631	/*
1632	* Report the error to the parent if this happens during early VM init.
1633	*/
1634	else if ( g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED
1635	&& g_enmSupR3HardenedMainState != SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED)
1636	supR3HardenedWinReportErrorToParent(pszWhere, enmWhat, rc, pszMsgFmt, va);
1637	#endif
1638
1639	/*
1640	* Quit
1641	*/
1642	suplibHardenedExit(RTEXITCODE_FAILURE);
1643	}
1644
1645
1646	DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatalMsg(const char *pszWhere, SUPINITOP enmWhat, int rc,
1647	const char *pszMsgFmt, ...)
1648	{
1649	va_list va;
1650	va_start(va, pszMsgFmt);
1651	supR3HardenedFatalMsgV(pszWhere, enmWhat, rc, pszMsgFmt, va);
1652	/* not reached */
1653	}
1654
1655
1656	DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatalV(const char *pszFormat, va_list va)
1657	{
1658	supR3HardenedLog("Fatal error:\n");
1659	va_list vaCopy;
1660	va_copy(vaCopy, va);
1661	supR3HardenedLogV(pszFormat, vaCopy);
1662	va_end(vaCopy);
1663
1664	#if defined(RT_OS_WINDOWS)
1665	/*
1666	* Report the error to the parent if this happens during early VM init.
1667	*/
1668	if ( g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED
1669	&& g_enmSupR3HardenedMainState != SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED)
1670	supR3HardenedWinReportErrorToParent(NULL, kSupInitOp_Invalid, VERR_INTERNAL_ERROR, pszFormat, va);
1671	else
1672	#endif
1673	{
1674	#ifdef RT_OS_WINDOWS
1675	if (g_pfnRTLogRelPrintf)
1676	{
1677	va_copy(vaCopy, va);
1678	g_pfnRTLogRelPrintf("supR3HardenedFatalV: %N", pszFormat, &vaCopy);
1679	va_end(vaCopy);
1680	}
1681	#endif
1682
1683	suplibHardenedPrintPrefix();
1684	suplibHardenedPrintFV(pszFormat, va);
1685	}
1686
1687	suplibHardenedExit(RTEXITCODE_FAILURE);
1688	}
1689
1690
1691	DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatal(const char *pszFormat, ...)
1692	{
1693	va_list va;
1694	va_start(va, pszFormat);
1695	supR3HardenedFatalV(pszFormat, va);
1696	/* not reached */
1697	}
1698
1699
1700	DECLHIDDEN(int) supR3HardenedErrorV(int rc, bool fFatal, const char *pszFormat, va_list va)
1701	{
1702	if (fFatal)
1703	supR3HardenedFatalV(pszFormat, va);
1704
1705	supR3HardenedLog("Error (rc=%d):\n", rc);
1706	va_list vaCopy;
1707	va_copy(vaCopy, va);
1708	supR3HardenedLogV(pszFormat, vaCopy);
1709	va_end(vaCopy);
1710
1711	#ifdef RT_OS_WINDOWS
1712	if (g_pfnRTLogRelPrintf)
1713	{
1714	va_copy(vaCopy, va);
1715	g_pfnRTLogRelPrintf("supR3HardenedErrorV: %N", pszFormat, &vaCopy);
1716	va_end(vaCopy);
1717	}
1718	#endif
1719
1720	suplibHardenedPrintPrefix();
1721	suplibHardenedPrintFV(pszFormat, va);
1722
1723	return rc;
1724	}
1725
1726
1727	DECLHIDDEN(int) supR3HardenedError(int rc, bool fFatal, const char *pszFormat, ...)
1728	{
1729	va_list va;
1730	va_start(va, pszFormat);
1731	supR3HardenedErrorV(rc, fFatal, pszFormat, va);
1732	va_end(va);
1733	return rc;
1734	}
1735
1736
1737
1738	/**
1739	* Attempts to open /dev/vboxdrv (or equvivalent).
1740	*
1741	* @remarks This function will not return on failure.
1742	*/
1743	DECLHIDDEN(void) supR3HardenedMainOpenDevice(void)
1744	{
1745	RTERRINFOSTATIC ErrInfo;
1746	SUPINITOP enmWhat = kSupInitOp_Driver;
1747	int rc = suplibOsInit(&g_SupPreInitData.Data, false /fPreInit/, true /fUnrestricted/,
1748	&enmWhat, RTErrInfoInitStatic(&ErrInfo));
1749	if (RT_SUCCESS(rc))
1750	return;
1751
1752	if (RTErrInfoIsSet(&ErrInfo.Core))
1753	supR3HardenedFatalMsg("suplibOsInit", enmWhat, rc, "%s", ErrInfo.szMsg);
1754
1755	switch (rc)
1756	{
1757	/** @todo better messages! */
1758	case VERR_VM_DRIVER_NOT_INSTALLED:
1759	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel driver not installed");
1760	case VERR_VM_DRIVER_NOT_ACCESSIBLE:
1761	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel driver not accessible");
1762	case VERR_VM_DRIVER_LOAD_ERROR:
1763	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "VERR_VM_DRIVER_LOAD_ERROR");
1764	case VERR_VM_DRIVER_OPEN_ERROR:
1765	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "VERR_VM_DRIVER_OPEN_ERROR");
1766	case VERR_VM_DRIVER_VERSION_MISMATCH:
1767	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel driver version mismatch");
1768	case VERR_ACCESS_DENIED:
1769	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "VERR_ACCESS_DENIED");
1770	case VERR_NO_MEMORY:
1771	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel memory allocation/mapping failed");
1772	case VERR_SUPDRV_HARDENING_EVIL_HANDLE:
1773	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPDRV_HARDENING_EVIL_HANDLE");
1774	case VERR_SUPLIB_NT_PROCESS_UNTRUSTED_0:
1775	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPLIB_NT_PROCESS_UNTRUSTED_0");
1776	case VERR_SUPLIB_NT_PROCESS_UNTRUSTED_1:
1777	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPLIB_NT_PROCESS_UNTRUSTED_1");
1778	case VERR_SUPLIB_NT_PROCESS_UNTRUSTED_2:
1779	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPLIB_NT_PROCESS_UNTRUSTED_2");
1780	default:
1781	supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Unknown rc=%d (%Rrc)", rc, rc);
1782	}
1783	}
1784
1785
1786	#ifdef SUP_HARDENED_SUID
1787
1788	/**
1789	* Grabs extra non-root capabilities / privileges that we might require.
1790	*
1791	* This is currently only used for being able to do ICMP from the NAT engine.
1792	*
1793	* @note We still have root privileges at the time of this call.
1794	*/
1795	static void supR3HardenedMainGrabCapabilites(void)
1796	{
1797	# if defined(RT_OS_LINUX)
1798	/*
1799	* We are about to drop all our privileges. Remove all capabilities but
1800	* keep the cap_net_raw capability for ICMP sockets for the NAT stack.
1801	*/
1802	if (g_uCaps != 0)
1803	{
1804	# ifdef USE_LIB_PCAP
1805	/* XXX cap_net_bind_service */
1806	if (!cap_set_proc(cap_from_text("all-eip cap_net_raw+ep")))
1807	prctl(PR_SET_KEEPCAPS, 1 /keep=/, 0, 0, 0);
1808	prctl(PR_SET_DUMPABLE, 1 /dump/, 0, 0, 0);
1809	# else
1810	cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
1811	cap_user_data_t cap = (cap_user_data_t)alloca(2 /_LINUX_CAPABILITY_U32S_3/ * sizeof(*cap));
1812	memset(hdr, 0, sizeof(*hdr));
1813	capget(hdr, NULL);
1814	if ( hdr->version != 0x19980330 /* _LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_U32S_1 = 1 */
1815	&& hdr->version != 0x20071026 /* _LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_U32S_2 = 2 */
1816	&& hdr->version != 0x20080522 /* _LINUX_CAPABILITY_VERSION_3, _LINUX_CAPABILITY_U32S_3 = 2 */)
1817	hdr->version = _LINUX_CAPABILITY_VERSION;
1818	g_uCapsVersion = hdr->version;
1819	memset(cap, 0, 2 /* _LINUX_CAPABILITY_U32S_3 / sizeof(*cap));
1820	cap->effective = g_uCaps;
1821	cap->permitted = g_uCaps;
1822	if (!capset(hdr, cap))
1823	prctl(PR_SET_KEEPCAPS, 1 /keep/, 0, 0, 0);
1824	prctl(PR_SET_DUMPABLE, 1 /dump/, 0, 0, 0);
1825	# endif /* !USE_LIB_PCAP */
1826	}
1827
1828	# elif defined(RT_OS_SOLARIS)
1829	/*
1830	* Add net_icmpaccess privilege to effective privileges and limit
1831	* permitted privileges before completely dropping root privileges.
1832	* This requires dropping root privileges temporarily to get the normal
1833	* user's privileges.
1834	*/
1835	seteuid(g_uid);
1836	priv_set_t *pPrivEffective = priv_allocset();
1837	priv_set_t *pPrivNew = priv_allocset();
1838	if (pPrivEffective && pPrivNew)
1839	{
1840	int rc = getppriv(PRIV_EFFECTIVE, pPrivEffective);
1841	seteuid(0);
1842	if (!rc)
1843	{
1844	priv_copyset(pPrivEffective, pPrivNew);
1845	rc = priv_addset(pPrivNew, PRIV_NET_ICMPACCESS);
1846	if (!rc)
1847	{
1848	/* Order is important, as one can't set a privilege which is
1849	* not in the permitted privilege set. */
1850	rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivNew);
1851	if (rc)
1852	supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
1853	rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivNew);
1854	if (rc)
1855	supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
1856	}
1857	else
1858	supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to add NET_ICMPACCESS privilege.\n");
1859	}
1860	}
1861	else
1862	{
1863	/* for memory allocation failures just continue */
1864	seteuid(0);
1865	}
1866
1867	if (pPrivEffective)
1868	priv_freeset(pPrivEffective);
1869	if (pPrivNew)
1870	priv_freeset(pPrivNew);
1871	# endif
1872	}
1873
1874	/*
1875	* Look at the environment for some special options.
1876	*/
1877	static void supR3GrabOptions(void)
1878	{
1879	# ifdef RT_OS_LINUX
1880	g_uCaps = 0;
1881
1882	/*
1883	* Do _not_ perform any capability-related system calls for root processes
1884	* (leaving g_uCaps at 0).
1885	* (Hint: getuid gets the real user id, not the effective.)
1886	*/
1887	if (getuid() != 0)
1888	{
1889	/*
1890	* CAP_NET_RAW.
1891	* Default: enabled.
1892	* Can be disabled with 'export VBOX_HARD_CAP_NET_RAW=0'.
1893	*/
1894	const char *pszOpt = getenv("VBOX_HARD_CAP_NET_RAW");
1895	if ( !pszOpt
1896	\|\| memcmp(pszOpt, "0", sizeof("0")) != 0)
1897	g_uCaps = CAP_TO_MASK(CAP_NET_RAW);
1898
1899	/*
1900	* CAP_NET_BIND_SERVICE.
1901	* Default: disabled.
1902	* Can be enabled with 'export VBOX_HARD_CAP_NET_BIND_SERVICE=1'.
1903	*/
1904	pszOpt = getenv("VBOX_HARD_CAP_NET_BIND_SERVICE");
1905	if ( pszOpt
1906	&& memcmp(pszOpt, "0", sizeof("0")) != 0)
1907	g_uCaps \|= CAP_TO_MASK(CAP_NET_BIND_SERVICE);
1908	}
1909	# endif
1910	}
1911
1912	/**
1913	* Drop any root privileges we might be holding.
1914	*/
1915	static void supR3HardenedMainDropPrivileges(void)
1916	{
1917	/*
1918	* Try use setre[ug]id since this will clear the save uid/gid and thus
1919	* leave fewer traces behind that libs like GTK+ may pick up.
1920	*/
1921	uid_t euid, ruid, suid;
1922	gid_t egid, rgid, sgid;
1923	# if defined(RT_OS_DARWIN)
1924	/* The really great thing here is that setreuid isn't available on
1925	OS X 10.4, libc emulates it. While 10.4 have a slightly different and
1926	non-standard setuid implementation compared to 10.5, the following
1927	works the same way with both version since we're super user (10.5 req).
1928	The following will set all three variants of the group and user IDs. */
1929	setgid(g_gid);
1930	setuid(g_uid);
1931	euid = geteuid();
1932	ruid = suid = getuid();
1933	egid = getegid();
1934	rgid = sgid = getgid();
1935
1936	# elif defined(RT_OS_SOLARIS)
1937	/* Solaris doesn't have setresuid, but the setreuid interface is BSD
1938	compatible and will set the saved uid to euid when we pass it a ruid
1939	that isn't -1 (which we do). */
1940	setregid(g_gid, g_gid);
1941	setreuid(g_uid, g_uid);
1942	euid = geteuid();
1943	ruid = suid = getuid();
1944	egid = getegid();
1945	rgid = sgid = getgid();
1946
1947	# else
1948	/* This is the preferred one, full control no questions about semantics.
1949	PORTME: If this isn't work, try join one of two other gangs above. */
1950	int res = setresgid(g_gid, g_gid, g_gid);
1951	NOREF(res);
1952	res = setresuid(g_uid, g_uid, g_uid);
1953	NOREF(res);
1954	if (getresuid(&ruid, &euid, &suid) != 0)
1955	{
1956	euid = geteuid();
1957	ruid = suid = getuid();
1958	}
1959	if (getresgid(&rgid, &egid, &sgid) != 0)
1960	{
1961	egid = getegid();
1962	rgid = sgid = getgid();
1963	}
1964	# endif
1965
1966
1967	/* Check that it worked out all right. */
1968	if ( euid != g_uid
1969	\|\| ruid != g_uid
1970	\|\| suid != g_uid
1971	\|\| egid != g_gid
1972	\|\| rgid != g_gid
1973	\|\| sgid != g_gid)
1974	supR3HardenedFatal("SUPR3HardenedMain: failed to drop root privileges!"
1975	" (euid=%d ruid=%d suid=%d egid=%d rgid=%d sgid=%d; wanted uid=%d and gid=%d)\n",
1976	euid, ruid, suid, egid, rgid, sgid, g_uid, g_gid);
1977
1978	# if RT_OS_LINUX
1979	/*
1980	* Re-enable the cap_net_raw capability which was disabled during setresuid.
1981	*/
1982	if (g_uCaps != 0)
1983	{
1984	# ifdef USE_LIB_PCAP
1985	/** @todo Warn if that does not work? */
1986	/* XXX cap_net_bind_service */
1987	cap_set_proc(cap_from_text("cap_net_raw+ep"));
1988	# else
1989	cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
1990	cap_user_data_t cap = (cap_user_data_t)alloca(2 /* _LINUX_CAPABILITY_U32S_3 / sizeof(*cap));
1991	memset(hdr, 0, sizeof(*hdr));
1992	hdr->version = g_uCapsVersion;
1993	memset(cap, 0, 2 /* _LINUX_CAPABILITY_U32S_3 / sizeof(*cap));
1994	cap->effective = g_uCaps;
1995	cap->permitted = g_uCaps;
1996	/** @todo Warn if that does not work? */
1997	capset(hdr, cap);
1998	# endif /* !USE_LIB_PCAP */
1999	}
2000	# endif
2001	}
2002
2003	#endif /* SUP_HARDENED_SUID */
2004
2005	/**
2006	* Loads the VBoxRT DLL/SO/DYLIB, hands it the open driver,
2007	* and calls RTR3InitEx.
2008	*
2009	* @param fFlags The SUPR3HardenedMain fFlags argument, passed to supR3PreInit.
2010	*
2011	* @remarks VBoxRT contains both IPRT and SUPR3.
2012	* @remarks This function will not return on failure.
2013	*/
2014	static void supR3HardenedMainInitRuntime(uint32_t fFlags)
2015	{
2016	/*
2017	* Construct the name.
2018	*/
2019	char szPath[RTPATH_MAX];
2020	supR3HardenedPathAppSharedLibs(szPath, sizeof(szPath) - sizeof("/VBoxRT" SUPLIB_DLL_SUFF));
2021	suplibHardenedStrCat(szPath, "/VBoxRT" SUPLIB_DLL_SUFF);
2022
2023	/*
2024	* Open it and resolve the symbols.
2025	*/
2026	#if defined(RT_OS_WINDOWS)
2027	HMODULE hMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, false /fSystem32Only/, g_fSupHardenedMain);
2028	if (!hMod)
2029	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
2030	"LoadLibrary \"%s\" failed (rc=%d)",
2031	szPath, RtlGetLastWin32Error());
2032	PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)GetProcAddress(hMod, SUP_HARDENED_SYM("RTR3InitEx"));
2033	if (!pfnRTInitEx)
2034	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2035	"Entrypoint \"RTR3InitEx\" not found in \"%s\" (rc=%d)",
2036	szPath, RtlGetLastWin32Error());
2037
2038	PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)GetProcAddress(hMod, SUP_HARDENED_SYM("supR3PreInit"));
2039	if (!pfnSUPPreInit)
2040	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2041	"Entrypoint \"supR3PreInit\" not found in \"%s\" (rc=%d)",
2042	szPath, RtlGetLastWin32Error());
2043
2044	g_pfnRTLogRelPrintf = (PFNRTLOGRELPRINTF)GetProcAddress(hMod, SUP_HARDENED_SYM("RTLogRelPrintf"));
2045	Assert(g_pfnRTLogRelPrintf); /* Not fatal in non-strict builds. */
2046
2047	#else
2048	/* the dlopen crowd */
2049	void *pvMod = dlopen(szPath, RTLD_NOW \| RTLD_GLOBAL);
2050	if (!pvMod)
2051	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
2052	"dlopen(\"%s\",) failed: %s",
2053	szPath, dlerror());
2054	PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("RTR3InitEx"));
2055	if (!pfnRTInitEx)
2056	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2057	"Entrypoint \"RTR3InitEx\" not found in \"%s\"!\ndlerror: %s",
2058	szPath, dlerror());
2059	PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("supR3PreInit"));
2060	if (!pfnSUPPreInit)
2061	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2062	"Entrypoint \"supR3PreInit\" not found in \"%s\"!\ndlerror: %s",
2063	szPath, dlerror());
2064	#endif
2065
2066	/*
2067	* Make the calls.
2068	*/
2069	supR3HardenedGetPreInitData(&g_SupPreInitData);
2070	int rc = pfnSUPPreInit(&g_SupPreInitData, fFlags);
2071	if (RT_FAILURE(rc))
2072	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
2073	"supR3PreInit failed with rc=%d", rc);
2074	const char *pszExePath = NULL;
2075	#ifdef RT_OS_LINUX
2076	if (!supR3HardenedMainIsProcSelfExeAccssible())
2077	pszExePath = g_szSupLibHardenedExePath;
2078	#endif
2079	rc = pfnRTInitEx(RTR3INIT_VER_1,
2080	fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV ? 0 : RTR3INIT_FLAGS_SUPLIB,
2081	0 /cArgs/, NULL /papszArgs/, pszExePath);
2082	if (RT_FAILURE(rc))
2083	supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
2084	"RTR3InitEx failed with rc=%d", rc);
2085
2086	#if defined(RT_OS_WINDOWS)
2087	/*
2088	* Windows: Create thread that terminates the process when the parent stub
2089	* process terminates (VBoxNetDHCP, Ctrl-C, etc).
2090	*/
2091	if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
2092	supR3HardenedWinCreateParentWatcherThread(hMod);
2093	#endif
2094	}
2095
2096
2097	/**
2098	* Construct the path to the DLL/SO/DYLIB containing the actual program.
2099	*
2100	* @returns VBox status code.
2101	* @param pszProgName The program name.
2102	* @param fMainFlags The flags passed to SUPR3HardenedMain.
2103	* @param pszPath The output buffer.
2104	* @param cbPath The size of the output buffer, in bytes. Must be at
2105	* least 128 bytes!
2106	*/
2107	static int supR3HardenedMainGetTrustedLib(const char pszProgName, uint32_t fMainFlags, char pszPath, size_t cbPath)
2108	{
2109	supR3HardenedPathAppPrivateArch(pszPath, sizeof(cbPath) - 10);
2110	const char *pszSubDirSlash;
2111	switch (g_fSupHardenedMain & SUPSECMAIN_FLAGS_LOC_MASK)
2112	{
2113	case SUPSECMAIN_FLAGS_LOC_APP_BIN:
2114	pszSubDirSlash = "/";
2115	break;
2116	case SUPSECMAIN_FLAGS_LOC_TESTCASE:
2117	pszSubDirSlash = "/testcase/";
2118	break;
2119	default:
2120	pszSubDirSlash = "/";
2121	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Unknown program binary location: %#x\n", g_fSupHardenedMain);
2122	}
2123	#ifdef RT_OS_DARWIN
2124	if (fMainFlags & SUPSECMAIN_FLAGS_OSX_VM_APP)
2125	pszProgName = "VirtualBox";
2126	#else
2127	RT_NOREF1(fMainFlags);
2128	#endif
2129	size_t cch = suplibHardenedStrLen(pszPath);
2130	return suplibHardenedStrCopyEx(&pszPath[cch], cbPath - cch, pszSubDirSlash, pszProgName, SUPLIB_DLL_SUFF, NULL);
2131	}
2132
2133
2134	/**
2135	* Loads the DLL/SO/DYLIB containing the actual program and
2136	* resolves the TrustedError symbol.
2137	*
2138	* This is very similar to supR3HardenedMainGetTrustedMain().
2139	*
2140	* @returns Pointer to the trusted error symbol if it is exported, NULL
2141	* and no error messages otherwise.
2142	* @param pszProgName The program name.
2143	*/
2144	static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName)
2145	{
2146	/*
2147	* Don't bother if the main() function didn't advertise any TrustedError
2148	* export. It's both a waste of time and may trigger additional problems,
2149	* confusing or obscuring the original issue.
2150	*/
2151	if (!(g_fSupHardenedMain & SUPSECMAIN_FLAGS_TRUSTED_ERROR))
2152	return NULL;
2153
2154	/*
2155	* Construct the name.
2156	*/
2157	char szPath[RTPATH_MAX];
2158	supR3HardenedMainGetTrustedLib(pszProgName, g_fSupHardenedMain, szPath, sizeof(szPath));
2159
2160	/*
2161	* Open it and resolve the symbol.
2162	*/
2163	#if defined(RT_OS_WINDOWS)
2164	supR3HardenedWinEnableThreadCreation();
2165	HMODULE hMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, false /fSystem32Only/, 0 /fMainFlags/);
2166	if (!hMod)
2167	return NULL;
2168	FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedError"));
2169	if (!pfn)
2170	return NULL;
2171	return (PFNSUPTRUSTEDERROR)pfn;
2172
2173	#else
2174	/* the dlopen crowd */
2175	void *pvMod = dlopen(szPath, RTLD_NOW \| RTLD_GLOBAL);
2176	if (!pvMod)
2177	return NULL;
2178	void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedError"));
2179	if (!pvSym)
2180	return NULL;
2181	return (PFNSUPTRUSTEDERROR)(uintptr_t)pvSym;
2182	#endif
2183	}
2184
2185
2186	/**
2187	* Loads the DLL/SO/DYLIB containing the actual program and
2188	* resolves the TrustedMain symbol.
2189	*
2190	* @returns Pointer to the trusted main of the actual program.
2191	* @param pszProgName The program name.
2192	* @param fMainFlags The flags passed to SUPR3HardenedMain.
2193	* @remarks This function will not return on failure.
2194	*/
2195	static PFNSUPTRUSTEDMAIN supR3HardenedMainGetTrustedMain(const char *pszProgName, uint32_t fMainFlags)
2196	{
2197	/*
2198	* Construct the name.
2199	*/
2200	char szPath[RTPATH_MAX];
2201	supR3HardenedMainGetTrustedLib(pszProgName, fMainFlags, szPath, sizeof(szPath));
2202
2203	/*
2204	* Open it and resolve the symbol.
2205	*/
2206	#if defined(RT_OS_WINDOWS)
2207	HMODULE hMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, false /fSystem32Only/, 0 /fMainFlags/);
2208	if (!hMod)
2209	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: LoadLibrary \"%s\" failed, rc=%d\n",
2210	szPath, RtlGetLastWin32Error());
2211	FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedMain"));
2212	if (!pfn)
2213	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\" (rc=%d)\n",
2214	szPath, RtlGetLastWin32Error());
2215	return (PFNSUPTRUSTEDMAIN)pfn;
2216
2217	#else
2218	/* the dlopen crowd */
2219	void *pvMod = dlopen(szPath, RTLD_NOW \| RTLD_GLOBAL);
2220	if (!pvMod)
2221	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: dlopen(\"%s\",) failed: %s\n",
2222	szPath, dlerror());
2223	void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedMain"));
2224	if (!pvSym)
2225	supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\"!\ndlerror: %s\n",
2226	szPath, dlerror());
2227	return (PFNSUPTRUSTEDMAIN)(uintptr_t)pvSym;
2228	#endif
2229	}
2230
2231
2232	/**
2233	* Secure main.
2234	*
2235	* This is used for the set-user-ID-on-execute binaries on unixy systems
2236	* and when using the open-vboxdrv-via-root-service setup on Windows.
2237	*
2238	* This function will perform the integrity checks of the VirtualBox
2239	* installation, open the support driver, open the root service (later),
2240	* and load the DLL corresponding to \a pszProgName and execute its main
2241	* function.
2242	*
2243	* @returns Return code appropriate for main().
2244	*
2245	* @param pszProgName The program name. This will be used to figure out which
2246	* DLL/SO/DYLIB to load and execute.
2247	* @param fFlags Flags.
2248	* @param argc The argument count.
2249	* @param argv The argument vector.
2250	* @param envp The environment vector.
2251	*/
2252	DECLHIDDEN(int) SUPR3HardenedMain(const char pszProgName, uint32_t fFlags, int argc, char argv, char *envp)
2253	{
2254	SUP_DPRINTF(("SUPR3HardenedMain: pszProgName=%s fFlags=%#x\n", pszProgName, fFlags));
2255	g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_HARDENED_MAIN_CALLED;
2256
2257	/*
2258	* Note! At this point there is no IPRT, so we will have to stick
2259	* to basic CRT functions that everyone agree upon.
2260	*/
2261	g_pszSupLibHardenedProgName = pszProgName;
2262	g_fSupHardenedMain = fFlags;
2263	g_SupPreInitData.u32Magic = SUPPREINITDATA_MAGIC;
2264	g_SupPreInitData.u32EndMagic = SUPPREINITDATA_MAGIC;
2265	#ifdef RT_OS_WINDOWS
2266	if (!g_fSupEarlyProcessInit)
2267	#endif
2268	g_SupPreInitData.Data.hDevice = SUP_HDEVICE_NIL;
2269
2270	/*
2271	* Determine the full exe path as we'll be needing it for the verify all
2272	* call(s) below. (We have to do this early on Linux because we * might
2273	* not be able to access /proc/self/exe after the seteuid call.)
2274	*/
2275	supR3HardenedGetFullExePath();
2276	#ifdef RT_OS_WINDOWS
2277	supR3HardenedWinInitAppBin(fFlags);
2278	#endif
2279
2280	#ifdef SUP_HARDENED_SUID
2281	/*
2282	* Grab any options from the environment.
2283	*/
2284	supR3GrabOptions();
2285
2286	/*
2287	* Check that we're root, if we aren't then the installation is butchered.
2288	*/
2289	g_uid = getuid();
2290	g_gid = getgid();
2291	if (geteuid() != 0 /* root */)
2292	supR3HardenedFatalMsg("SUPR3HardenedMain", kSupInitOp_RootCheck, VERR_PERMISSION_DENIED,
2293	"Effective UID is not root (euid=%d egid=%d uid=%d gid=%d)",
2294	geteuid(), getegid(), g_uid, g_gid);
2295	#endif /* SUP_HARDENED_SUID */
2296
2297	#ifdef RT_OS_WINDOWS
2298	/*
2299	* Windows: First respawn. On Windows we will respawn the process twice to establish
2300	* something we can put some kind of reliable trust in. The first respawning aims
2301	* at dropping compatibility layers and process "security" solutions.
2302	*/
2303	if ( !g_fSupEarlyProcessInit
2304	&& !(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV)
2305	&& supR3HardenedWinIsReSpawnNeeded(1 /iWhich/, argc, argv))
2306	{
2307	SUP_DPRINTF(("SUPR3HardenedMain: Respawn #1\n"));
2308	supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV, false /fAvastKludge/);
2309	supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
2310	return supR3HardenedWinReSpawn(1 /iWhich/);
2311	}
2312
2313	/*
2314	* Windows: Initialize the image verification global data so we can verify the
2315	* signature of the process image and hook the core of the DLL loader API so we
2316	* can check the signature of all DLLs mapped into the process. (Already done
2317	* by early VM process init.)
2318	*/
2319	if (!g_fSupEarlyProcessInit)
2320	supR3HardenedWinInit(fFlags, true /fAvastKludge/);
2321	#endif /* RT_OS_WINDOWS */
2322
2323	/*
2324	* Validate the installation.
2325	*/
2326	supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
2327
2328	/*
2329	* The next steps are only taken if we actually need to access the support
2330	* driver. (Already done by early process init.)
2331	*/
2332	if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
2333	{
2334	#ifdef RT_OS_WINDOWS
2335	/*
2336	* Windows: Must have done early process init if we get here.
2337	*/
2338	if (!g_fSupEarlyProcessInit)
2339	supR3HardenedFatalMsg("SUPR3HardenedMain", kSupInitOp_Integrity, VERR_WRONG_ORDER,
2340	"Early process init was somehow skipped.");
2341
2342	/*
2343	* Windows: The second respawn. This time we make a special arrangement
2344	* with vboxdrv to monitor access to the new process from its inception.
2345	*/
2346	if (supR3HardenedWinIsReSpawnNeeded(2 /* iWhich*/, argc, argv))
2347	{
2348	SUP_DPRINTF(("SUPR3HardenedMain: Respawn #2\n"));
2349	return supR3HardenedWinReSpawn(2 /* iWhich*/);
2350	}
2351	SUP_DPRINTF(("SUPR3HardenedMain: Final process, opening VBoxDrv...\n"));
2352	supR3HardenedWinFlushLoaderCache();
2353
2354	#else
2355	/*
2356	* Open the vboxdrv device.
2357	*/
2358	supR3HardenedMainOpenDevice();
2359	#endif /* !RT_OS_WINDOWS */
2360	}
2361
2362	#ifdef RT_OS_WINDOWS
2363	/*
2364	* Windows: Enable the use of windows APIs to verify images at load time.
2365	*/
2366	supR3HardenedWinEnableThreadCreation();
2367	supR3HardenedWinFlushLoaderCache();
2368	supR3HardenedWinResolveVerifyTrustApiAndHookThreadCreation(g_pszSupLibHardenedProgName);
2369	g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_WIN_VERIFY_TRUST_READY;
2370	#endif
2371
2372	#ifdef SUP_HARDENED_SUID
2373	/*
2374	* Grab additional capabilities / privileges.
2375	*/
2376	supR3HardenedMainGrabCapabilites();
2377
2378	/*
2379	* Drop any root privileges we might be holding (won't return on failure)
2380	*/
2381	supR3HardenedMainDropPrivileges();
2382	#endif
2383
2384	/*
2385	* Load the IPRT, hand the SUPLib part the open driver and
2386	* call RTR3InitEx.
2387	*/
2388	SUP_DPRINTF(("SUPR3HardenedMain: Load Runtime...\n"));
2389	g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_INIT_RUNTIME;
2390	supR3HardenedMainInitRuntime(fFlags);
2391	#ifdef RT_OS_WINDOWS
2392	supR3HardenedWinModifyDllSearchPath(fFlags, g_szSupLibHardenedAppBinPath);
2393	#endif
2394
2395	/*
2396	* Load the DLL/SO/DYLIB containing the actual program
2397	* and pass control to it.
2398	*/
2399	SUP_DPRINTF(("SUPR3HardenedMain: Load TrustedMain...\n"));
2400	g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_GET_TRUSTED_MAIN;
2401	PFNSUPTRUSTEDMAIN pfnTrustedMain = supR3HardenedMainGetTrustedMain(pszProgName, fFlags);
2402
2403	SUP_DPRINTF(("SUPR3HardenedMain: Calling TrustedMain (%p)...\n", pfnTrustedMain));
2404	g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN;
2405	return pfnTrustedMain(argc, argv, envp);
2406	}
2407

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp@ 63674

Download in other formats: