SUPR3HardenedVerify.cpp@ 13073

Last change on this file since 13073 was 12175, checked in by vboxsync, 16 years ago
VBoxDbg.so/dylib/dll -> VBoxDbg3.*
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 30.8 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 12175 2008-09-06 05:08:56Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39
40	#elif defined(RT_OS_WINDOWS)
41	# include <Windows.h>
42	# include <stdio.h>
43
44	#else /* UNIXes */
45	# include <sys/types.h>
46	# include <stdio.h>
47	# include <stdlib.h>
48	# include <dlfcn.h>
49	# include <fcntl.h>
50	# include <limits.h>
51	# include <errno.h>
52	# include <unistd.h>
53	# include <sys/stat.h>
54	# include <sys/time.h>
55	# include <sys/fcntl.h>
56	# include <stdio.h>
57	# include <pwd.h>
58	# ifdef RT_OS_DARWIN
59	# include <mach-o/dyld.h>
60	# endif
61
62	#endif
63
64	#include <VBox/sup.h>
65	#include <VBox/err.h>
66	#include <iprt/string.h>
67	#include <iprt/param.h>
68
69	#include "SUPLibInternal.h"
70
71
72
73
74	/*******************************************************************************
75	* Global Variables *
76	*******************************************************************************/
77	/**
78	* The files that gets verified.
79	*
80	* @todo This needs reviewing against the linux packages.
81	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
82	* the time being we're building the linux packages with SharedLib pointing to
83	* AppPrivArch (lazy bird).
84	*/
85	static SUPINSTFILE const g_aSupInstallFiles[] =
86	{
87	/* type, dir,fOptional, pszFile */
88	/* ---------------------------------------------------------------------- */
89	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
90	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
91	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
92
93	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
96
97	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
98	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
99	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
100	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
101	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
102	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
103
104	//#ifdef VBOX_WITH_DEBUGGER_GUI
105	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
106	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
107	//#endif
108
109	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
110	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
112
113	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxManage" SUPLIB_EXE_SUFF },
114
115	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
116	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxSettings" SUPLIB_DLL_SUFF },
117	#ifdef RT_OS_WINDOWS
118	/** @todo */
119	#else
120	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
121	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
122	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
123	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
124	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
125	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
126	#endif
127
128	//#ifdef VBOX_WITH_VRDP
129	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
130	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
131	//#endif
132
133	//#ifdef VBOX_WITH_HEADLESS
134	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
135	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
136	//#endif
137
138	//#ifdef VBOX_WITH_QT4GUI
139	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
140	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
141	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
142	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
143	# endif
144	//#endif
145
146	//#ifdef VBOX_WITH_QTGUI
147	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox3" SUPLIB_EXE_SUFF },
148	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox3" SUPLIB_DLL_SUFF },
149	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
150	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard3" SUPLIB_DLL_SUFF },
151	# endif
152	//#endif
153
154	//#ifdef VBOX_WITH_VBOXSDL
155	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
156	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
157	//#endif
158
159	//#ifdef VBOX_WITH_VBOXBFE
160	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
161	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
162	//#endif
163
164	//#ifdef VBOX_WITH_WEBSERVICES
165	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
166	//#endif
167
168	#ifdef RT_OS_LINUX
169	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
170	#endif
171	};
172
173
174	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
175	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
176
177	/** Array index by install directory specifier containing info about verified directories. */
178	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
179
180
181	/**
182	* Assembles the path to a dirtory.
183	*
184	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
185	* decides whether it returns or not).
186	*
187	* @param enmDir The directory.
188	* @param pszDst Where to assemble the path.
189	* @param cchDst The size of the buffer.
190	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
191	*/
192	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
193	{
194	int rc;
195	switch (enmDir)
196	{
197	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
198	case kSupID_Bin:
199	rc = supR3HardenedPathProgram(pszDst, cchDst);
200	break;
201	case kSupID_SharedLib:
202	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
203	break;
204	case kSupID_AppPrivArch:
205	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
206	break;
207	case kSupID_AppPrivArchComp:
208	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
209	if (RT_SUCCESS(rc))
210	{
211	size_t off = strlen(pszDst);
212	if (cchDst - off >= sizeof("/components"))
213	memcpy(&pszDst[off], "/components", sizeof("/components"));
214	else
215	rc = VERR_BUFFER_OVERFLOW;
216	}
217	break;
218	case kSupID_AppPrivNoArch:
219	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
220	break;
221	default:
222	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
223	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
224	}
225	if (RT_FAILURE(rc))
226	supR3HardenedError(rc, fFatal,
227	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
228	return rc;
229	}
230
231
232
233	/**
234	* Assembles the path to a file table entry, with or without the actual filename.
235	*
236	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
237	* decides whether it returns or not).
238	*
239	* @param pFile The file table entry.
240	* @param pszDst Where to assemble the path.
241	* @param cchDst The size of the buffer.
242	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
243	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
244	*/
245	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
246	{
247	/*
248	* Combine supR3HardenedMakePath and the filename.
249	*/
250	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
251	if (RT_SUCCESS(rc))
252	{
253	size_t cchFile = strlen(pFile->pszFile);
254	size_t off = strlen(pszDst);
255	if (cchDst - off >= cchFile + 2)
256	{
257	pszDst[off++] = '/';
258	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
259	}
260	else
261	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
262	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
263	pFile->pszFile, (long)off);
264	}
265	return rc;
266	}
267
268
269	/**
270	* Verifies a directory.
271	*
272	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
273	* fFatal is clear and if it's set the function wont return.
274	* @param enmDir The directory specifier.
275	* @param fFatal Whether validation failures should be treated as
276	* fatal (true) or not (false).
277	*/
278	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
279	{
280	/*
281	* Validate the index just to be on the safe side...
282	*/
283	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
284	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
285	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
286
287	/*
288	* Already validated?
289	*/
290	if (g_aSupVerifiedDirs[enmDir].fValidated)
291	return VINF_SUCCESS; /** @todo revalidate? */
292
293	/* initialize the entry. */
294	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
295	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
296	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
297	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
298	g_aSupVerifiedDirs[enmDir].hDir = -1;
299	g_aSupVerifiedDirs[enmDir].fValidated = false;
300
301	/*
302	* Make the path and open the directory.
303	*/
304	char szPath[RTPATH_MAX];
305	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
306	if (RT_SUCCESS(rc))
307	{
308	#if defined(RT_OS_WINDOWS)
309	HANDLE hDir = CreateFile(szPath,
310	GENERIC_READ,
311	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
312	NULL,
313	OPEN_ALWAYS,
314	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
315	NULL);
316	if (hDir != INVALID_HANDLE_VALUE)
317	{
318	/** @todo check the type */
319	/* That's all on windows, for now at least... */
320	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
321	g_aSupVerifiedDirs[enmDir].fValidated = true;
322	}
323	else
324	{
325	int err = GetLastError();
326	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
327	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
328	szPath, err);
329	}
330	#else /* UNIXY */
331	int fd = open(szPath, O_RDONLY, 0);
332	if (fd >= 0)
333	{
334	/*
335	* On unixy systems we'll make sure the directory is owned by root
336	* and not writable by the group and user.
337	*/
338	struct stat st;
339	if (!fstat(fd, &st))
340	{
341
342	if ( st.st_uid == 0
343	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
344	&& S_ISDIR(st.st_mode))
345	{
346	g_aSupVerifiedDirs[enmDir].hDir = fd;
347	g_aSupVerifiedDirs[enmDir].fValidated = true;
348	}
349	else
350	{
351	if (!S_ISDIR(st.st_mode))
352	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
353	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
354	szPath, (long)st.st_uid);
355	else if (st.st_uid)
356	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
357	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
358	szPath, (long)st.st_uid);
359	else
360	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
361	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
362	szPath, (long)st.st_mode);
363	close(fd);
364	}
365	}
366	else
367	{
368	int err = errno;
369	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
370	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
371	szPath, strerror(err), err);
372	close(fd);
373	}
374	}
375	else
376	{
377	int err = errno;
378	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
379	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
380	szPath, strerror(err), err);
381	}
382	#endif /* UNIXY */
383	}
384
385	return rc;
386	}
387
388
389	/**
390	* Verifies a file entry.
391	*
392	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
393	* fFatal is clear and if it's set the function wont return.
394	*
395	* @param iFile The file table index of the file to be verified.
396	* @param fFatal Whether validation failures should be treated as
397	* fatal (true) or not (false).
398	* @param fLeaveFileOpen Whether the file should be left open.
399	*/
400	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
401	{
402	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
403	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
404
405	/*
406	* Already done?
407	*/
408	if (pVerified->fValidated)
409	return VINF_SUCCESS; /** @todo revalidate? */
410
411
412	/* initialize the entry. */
413	if (pVerified->hFile != 0)
414	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
415	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
416	(void *)pVerified->hFile, pFile->pszFile);
417	pVerified->hFile = -1;
418	pVerified->fValidated = false;
419
420	/*
421	* Verify the directory then proceed to open it.
422	* (This'll make sure the directory is opened and that we can (later)
423	* use openat if we wish.)
424	*/
425	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
426	if (RT_SUCCESS(rc))
427	{
428	char szPath[RTPATH_MAX];
429	int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
430	if (RT_SUCCESS(rc))
431	{
432	#if defined(RT_OS_WINDOWS)
433	HANDLE hFile = CreateFile(szPath,
434	GENERIC_READ,
435	FILE_SHARE_READ,
436	NULL,
437	OPEN_ALWAYS,
438	FILE_ATTRIBUTE_NORMAL,
439	NULL);
440	if (hFile != INVALID_HANDLE_VALUE)
441	{
442	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
443	{
444	/* it's valid. */
445	if (fLeaveFileOpen)
446	pVerified->hFile = (intptr_t)hFile;
447	else
448	CloseHandle(hFile);
449	pVerified->fValidated = true;
450	}
451	}
452	else
453	{
454	int err = GetLastError();
455	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
456	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
457	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
458	szPath, err);
459	}
460	#else /* UNIXY */
461	int fd = open(szPath, O_RDONLY, 0);
462	if (fd >= 0)
463	{
464	/*
465	* On unixy systems we'll make sure the directory is owned by root
466	* and not writable by the group and user.
467	*/
468	struct stat st;
469	if (!fstat(fd, &st))
470	{
471	if ( st.st_uid == 0
472	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
473	&& S_ISREG(st.st_mode))
474	{
475	/* it's valid. */
476	if (fLeaveFileOpen)
477	pVerified->hFile = fd;
478	else
479	close(fd);
480	pVerified->fValidated = true;
481	}
482	else
483	{
484	if (!S_ISREG(st.st_mode))
485	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
486	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
487	szPath, (long)st.st_uid);
488	else if (st.st_uid)
489	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
490	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
491	szPath, (long)st.st_uid);
492	else
493	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
494	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
495	szPath, (long)st.st_mode);
496	close(fd);
497	}
498	}
499	else
500	{
501	int err = errno;
502	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
503	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
504	szPath, strerror(err), err);
505	close(fd);
506	}
507	}
508	else
509	{
510	int err = errno;
511	if (!pFile->fOptional \|\| err != ENOENT)
512	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
513	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
514	szPath, strerror(err), err);
515	}
516	#endif /* UNIXY */
517	}
518	}
519
520	return rc;
521	}
522
523
524	/**
525	* Verifies that the specified table entry matches the given filename.
526	*
527	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
528	* error is returned or we terminate the application.
529	*
530	* @param iFile The file table index.
531	* @param pszFilename The filename.
532	* @param fFatal Whether validation failures should be treated as
533	* fatal (true) or not (false).
534	*/
535	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
536	{
537	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
538
539	/*
540	* Construct the full path for the file table entry
541	* and compare it with the specified file.
542	*/
543	char szName[RTPATH_MAX];
544	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
545	if (RT_FAILURE(rc))
546	return rc;
547	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
548	if (stricmp(szName, pszFilename))
549	#else
550	if (strcmp(szName, pszFilename))
551	#endif
552	{
553	/*
554	* Normalize the two paths and compare again.
555	*/
556	rc = VERR_NOT_SAME_DEVICE;
557	#if defined(RT_OS_WINDOWS)
558	LPSTR pszIgnored;
559	char szName2[RTPATH_MAX];
560	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
561	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
562	if (!stricmp(szName2, szName))
563	rc = VINF_SUCCESS;
564	#else
565	AssertCompile(RTPATH_MAX >= PATH_MAX);
566	char szName2[RTPATH_MAX];
567	if ( realpath(szName, szName2) != NULL
568	&& realpath(pszFilename, szName) != NULL)
569	if (!strcmp(szName2, szName))
570	rc = VINF_SUCCESS;
571	#endif
572
573	if (RT_FAILURE(rc))
574	{
575	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
576	return supR3HardenedError(rc, fFatal,
577	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
578	pszFilename, szName);
579	}
580	}
581
582	/*
583	* Check more stuff like the stat info if it's an already open file?
584	*/
585
586
587
588	return VINF_SUCCESS;
589	}
590
591
592	/**
593	* Verifies a file.
594	*
595	* @returns VINF_SUCCESS on success.
596	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
597	* On verfication failure, an error code will be returned when fFatal is clear,
598	* otherwise the program will be termindated.
599	*
600	* @param pszFilename The filename.
601	* @param fFatal Whether validation failures should be treated as
602	* fatal (true) or not (false).
603	*/
604	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
605	{
606	/*
607	* Lookup the file and check if it's the same file.
608	*/
609	const char *pszName = supR3HardenedPathFilename(pszFilename);
610	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
611	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
612	{
613	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
614	if (RT_SUCCESS(rc))
615	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
616	return rc;
617	}
618
619	return VERR_NOT_FOUND;
620	}
621
622
623	/**
624	* Verifies a program, worker for supR3HardenedVerifyAll.
625	*
626	* @returns See supR3HardenedVerifyAll.
627	* @param pszProgName See supR3HardenedVerifyAll.
628	* @param fFatal See supR3HardenedVerifyAll.
629	*/
630	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
631	{
632	/*
633	* Search the table looking for the executable and the DLL/DYLIB/SO.
634	*/
635	int rc = VINF_SUCCESS;
636	bool fExe = false;
637	bool fDll = false;
638	size_t const cchProgName = strlen(pszProgName);
639	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
640	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
641	{
642	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
643	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
644	{
645	/* This only has to be found (once). */
646	if (fDll)
647	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
648	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
649	fDll = true;
650	}
651	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
652	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
653	{
654	/* Here we'll have to check that the specific program is the same as the entry. */
655	if (fExe)
656	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
657	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
658	fExe = true;
659
660	char szFilename[RTPATH_MAX];
661	int rc2 = supR3HardenedPathProgram(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
662	if (RT_SUCCESS(rc2))
663	{
664	strcat(szFilename, "/");
665	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
666	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
667	}
668	else
669	rc = supR3HardenedError(rc2, fFatal,
670	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
671	}
672	}
673
674	/*
675	* Check the findings.
676	*/
677	if (!fDll && !fExe)
678	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
679	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
680	else if (!fExe)
681	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
682	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
683	else if (!fDll)
684	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
685	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
686	return rc;
687	}
688
689
690
691	/**
692	* Verifies all the known files.
693	*
694	* @returns VINF_SUCCESS on success.
695	* On verfication failure, an error code will be returned when fFatal is clear,
696	* otherwise the program will be termindated.
697	*
698	* @param fFatal Whether validation failures should be treated as
699	* fatal (true) or not (false).
700	* @param fLeaveFilesOpen If set, all the verfied files are left open.
701	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
702	* to verify that both the executable and corresponding
703	* DLL/DYLIB/SO are valid.
704	*/
705	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
706	{
707	/*
708	* The verify all the files.
709	*/
710	int rc = VINF_SUCCESS;
711	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
712	{
713	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
714	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
715	rc = rc2;
716	}
717
718	/*
719	* Verify the program name if specified, that is to say, just check that
720	* it's in the table (=> we've already verified it).
721	*/
722	if (pszProgName)
723	{
724	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
725	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
726	rc2 = rc;
727	}
728
729	return rc;
730	}
731
732
733	/**
734	* Gets the pre-init data for the hand-over to the other version
735	* of this code.
736	*
737	* The reason why we pass this information on is that it contains
738	* open directories and files. Later it may include even more info
739	* (int the verified arrays mostly).
740	*
741	* The receiver is supR3HardenedRecvPreInitData.
742	*
743	* @param pPreInitData Where to store it.
744	*/
745	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
746	{
747	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
748	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
749	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
750
751	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
752	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
753	}
754
755
756	/**
757	* Receives the pre-init data from the static executable stub.
758	*
759	* @returns VBox status code. Will not bitch on failure since the
760	* runtime isn't ready for it, so that is left to the exe stub.
761	*
762	* @param pPreInitData The hand-over data.
763	*/
764	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
765	{
766	/*
767	* Compare the array lengths and the contents of g_aSupInstallFiles.
768	*/
769	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
770	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
771	return VERR_VERSION_MISMATCH;
772	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
773	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
774	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
775	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
776	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
777	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
778	return VERR_VERSION_MISMATCH;
779
780	/*
781	* Check that we're not called out of order.
782	* If dynamic linking it screwed up, we may end up here.
783	*/
784	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
785	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
786	return VERR_WRONG_ORDER;
787
788	/*
789	* Copy the verification data over.
790	*/
791	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
792	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
793	return VINF_SUCCESS;
794	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 13073

Download in other formats: