SUPR3HardenedVerify.cpp@ 28964

Last change on this file since 28964 was 28800, checked in by vboxsync, 15 years ago
Automated rebranding to Oracle copyright/license strings via filemuncher
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 31.5 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 28800 2010-04-27 08:22:32Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/*******************************************************************************
28	* Header Files *
29	*******************************************************************************/
30	#if defined(RT_OS_OS2)
31	# define INCL_BASE
32	# define INCL_ERRORS
33	# include <os2.h>
34	# include <stdio.h>
35	# include <stdlib.h>
36	# include <unistd.h>
37	# include <sys/fcntl.h>
38	# include <sys/errno.h>
39	# include <sys/syslimits.h>
40
41	#elif defined(RT_OS_WINDOWS)
42	# include <Windows.h>
43	# include <stdio.h>
44
45	#else /* UNIXes */
46	# include <sys/types.h>
47	# include <stdio.h>
48	# include <stdlib.h>
49	# include <dlfcn.h>
50	# include <fcntl.h>
51	# include <limits.h>
52	# include <errno.h>
53	# include <unistd.h>
54	# include <sys/stat.h>
55	# include <sys/time.h>
56	# include <sys/fcntl.h>
57	# include <stdio.h>
58	# include <pwd.h>
59	# ifdef RT_OS_DARWIN
60	# include <mach-o/dyld.h>
61	# endif
62
63	#endif
64
65	#include <VBox/sup.h>
66	#include <VBox/err.h>
67	#include <iprt/string.h>
68	#include <iprt/param.h>
69
70	#include "SUPLibInternal.h"
71
72
73
74
75	/*******************************************************************************
76	* Global Variables *
77	*******************************************************************************/
78	/**
79	* The files that gets verified.
80	*
81	* @todo This needs reviewing against the linux packages.
82	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
83	* the time being we're building the linux packages with SharedLib pointing to
84	* AppPrivArch (lazy bird).
85	*/
86	static SUPINSTFILE const g_aSupInstallFiles[] =
87	{
88	/* type, dir, fOpt, "pszFile" */
89	/* ---------------------------------------------------------------------- */
90	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
91	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
92	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
93
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
96	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
97
98	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
99	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
100	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
101	#if HC_ARCH_BITS == 32
102	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
103	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
104	#endif
105	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
106	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
107	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
108
109	//#ifdef VBOX_WITH_DEBUGGER_GUI
110	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
112	//#endif
113
114	//#ifdef VBOX_WITH_SHARED_CLIPBOARD
115	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
116	//#endif
117	//#ifdef VBOX_WITH_SHARED_FOLDERS
118	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
119	//#endif
120	//#ifdef VBOX_WITH_GUEST_PROPS
121	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
122	//#endif
123	//#ifdef VBOX_WITH_GUEST_CONTROL
124	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestControlSvc" SUPLIB_DLL_SUFF },
125	//#endif
126	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
127	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
128	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
129	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
130
131	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
132
133	#ifdef VBOX_WITH_MAIN
134	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
135	#ifdef RT_OS_WINDOWS
136	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
137	#else
138	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
139	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
140	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
141	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
142	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
143	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
144	#endif
145	#endif
146
147	//#ifdef VBOX_WITH_VRDP
148	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
149	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
150	//#endif
151
152	//#ifdef VBOX_WITH_HEADLESS
153	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
154	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
155	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
156	//#endif
157
158	//#ifdef VBOX_WITH_QTGUI
159	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
160	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
161	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
162	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
163	# endif
164	//#endif
165
166	//#ifdef VBOX_WITH_VBOXSDL
167	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
168	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
169	//#endif
170
171	//#ifdef VBOX_WITH_VBOXBFE
172	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
173	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
174	//#endif
175
176	//#ifdef VBOX_WITH_WEBSERVICES
177	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
178	//#endif
179
180	#ifdef RT_OS_LINUX
181	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
182	#endif
183
184	//#ifdef VBOX_WITH_NETFLT
185	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
186	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
187	//#endif
188	};
189
190
191	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
192	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
193
194	/** Array index by install directory specifier containing info about verified directories. */
195	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
196
197
198	/**
199	* Assembles the path to a dirtory.
200	*
201	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
202	* decides whether it returns or not).
203	*
204	* @param enmDir The directory.
205	* @param pszDst Where to assemble the path.
206	* @param cchDst The size of the buffer.
207	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
208	*/
209	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
210	{
211	int rc;
212	switch (enmDir)
213	{
214	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
215	case kSupID_Bin:
216	rc = supR3HardenedPathExecDir(pszDst, cchDst);
217	break;
218	case kSupID_SharedLib:
219	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
220	break;
221	case kSupID_AppPrivArch:
222	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
223	break;
224	case kSupID_AppPrivArchComp:
225	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
226	if (RT_SUCCESS(rc))
227	{
228	size_t off = strlen(pszDst);
229	if (cchDst - off >= sizeof("/components"))
230	memcpy(&pszDst[off], "/components", sizeof("/components"));
231	else
232	rc = VERR_BUFFER_OVERFLOW;
233	}
234	break;
235	case kSupID_AppPrivNoArch:
236	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
237	break;
238	default:
239	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
240	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
241	}
242	if (RT_FAILURE(rc))
243	supR3HardenedError(rc, fFatal,
244	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
245	return rc;
246	}
247
248
249
250	/**
251	* Assembles the path to a file table entry, with or without the actual filename.
252	*
253	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
254	* decides whether it returns or not).
255	*
256	* @param pFile The file table entry.
257	* @param pszDst Where to assemble the path.
258	* @param cchDst The size of the buffer.
259	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
260	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
261	*/
262	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
263	{
264	/*
265	* Combine supR3HardenedMakePath and the filename.
266	*/
267	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
268	if (RT_SUCCESS(rc))
269	{
270	size_t cchFile = strlen(pFile->pszFile);
271	size_t off = strlen(pszDst);
272	if (cchDst - off >= cchFile + 2)
273	{
274	pszDst[off++] = '/';
275	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
276	}
277	else
278	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
279	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
280	pFile->pszFile, (long)off);
281	}
282	return rc;
283	}
284
285
286	/**
287	* Verifies a directory.
288	*
289	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
290	* fFatal is clear and if it's set the function wont return.
291	* @param enmDir The directory specifier.
292	* @param fFatal Whether validation failures should be treated as
293	* fatal (true) or not (false).
294	*/
295	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
296	{
297	/*
298	* Validate the index just to be on the safe side...
299	*/
300	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
301	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
302	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
303
304	/*
305	* Already validated?
306	*/
307	if (g_aSupVerifiedDirs[enmDir].fValidated)
308	return VINF_SUCCESS; /** @todo revalidate? */
309
310	/* initialize the entry. */
311	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
312	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
313	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
314	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
315	g_aSupVerifiedDirs[enmDir].hDir = -1;
316	g_aSupVerifiedDirs[enmDir].fValidated = false;
317
318	/*
319	* Make the path and open the directory.
320	*/
321	char szPath[RTPATH_MAX];
322	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
323	if (RT_SUCCESS(rc))
324	{
325	#if defined(RT_OS_WINDOWS)
326	HANDLE hDir = CreateFile(szPath,
327	GENERIC_READ,
328	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
329	NULL,
330	OPEN_ALWAYS,
331	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
332	NULL);
333	if (hDir != INVALID_HANDLE_VALUE)
334	{
335	/** @todo check the type */
336	/* That's all on windows, for now at least... */
337	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
338	g_aSupVerifiedDirs[enmDir].fValidated = true;
339	}
340	else
341	{
342	int err = GetLastError();
343	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
344	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
345	szPath, err);
346	}
347	#else /* UNIXY */
348	int fd = open(szPath, O_RDONLY, 0);
349	if (fd >= 0)
350	{
351	/*
352	* On unixy systems we'll make sure the directory is owned by root
353	* and not writable by the group and user.
354	*/
355	struct stat st;
356	if (!fstat(fd, &st))
357	{
358
359	if ( st.st_uid == 0
360	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
361	&& S_ISDIR(st.st_mode))
362	{
363	g_aSupVerifiedDirs[enmDir].hDir = fd;
364	g_aSupVerifiedDirs[enmDir].fValidated = true;
365	}
366	else
367	{
368	if (!S_ISDIR(st.st_mode))
369	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
370	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
371	szPath, (long)st.st_uid);
372	else if (st.st_uid)
373	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
374	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
375	szPath, (long)st.st_uid);
376	else
377	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
378	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
379	szPath, (long)st.st_mode);
380	close(fd);
381	}
382	}
383	else
384	{
385	int err = errno;
386	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
387	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
388	szPath, strerror(err), err);
389	close(fd);
390	}
391	}
392	else
393	{
394	int err = errno;
395	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
396	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
397	szPath, strerror(err), err);
398	}
399	#endif /* UNIXY */
400	}
401
402	return rc;
403	}
404
405
406	/**
407	* Verifies a file entry.
408	*
409	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
410	* fFatal is clear and if it's set the function wont return.
411	*
412	* @param iFile The file table index of the file to be verified.
413	* @param fFatal Whether validation failures should be treated as
414	* fatal (true) or not (false).
415	* @param fLeaveFileOpen Whether the file should be left open.
416	*/
417	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
418	{
419	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
420	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
421
422	/*
423	* Already done?
424	*/
425	if (pVerified->fValidated)
426	return VINF_SUCCESS; /** @todo revalidate? */
427
428
429	/* initialize the entry. */
430	if (pVerified->hFile != 0)
431	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
432	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
433	(void *)pVerified->hFile, pFile->pszFile);
434	pVerified->hFile = -1;
435	pVerified->fValidated = false;
436
437	/*
438	* Verify the directory then proceed to open it.
439	* (This'll make sure the directory is opened and that we can (later)
440	* use openat if we wish.)
441	*/
442	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
443	if (RT_SUCCESS(rc))
444	{
445	char szPath[RTPATH_MAX];
446	rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
447	if (RT_SUCCESS(rc))
448	{
449	#if defined(RT_OS_WINDOWS)
450	HANDLE hFile = CreateFile(szPath,
451	GENERIC_READ,
452	FILE_SHARE_READ,
453	NULL,
454	OPEN_ALWAYS,
455	FILE_ATTRIBUTE_NORMAL,
456	NULL);
457	if (hFile != INVALID_HANDLE_VALUE)
458	{
459	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
460	{
461	/* it's valid. */
462	if (fLeaveFileOpen)
463	pVerified->hFile = (intptr_t)hFile;
464	else
465	CloseHandle(hFile);
466	pVerified->fValidated = true;
467	}
468	}
469	else
470	{
471	int err = GetLastError();
472	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
473	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
474	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
475	szPath, err);
476	}
477	#else /* UNIXY */
478	int fd = open(szPath, O_RDONLY, 0);
479	if (fd >= 0)
480	{
481	/*
482	* On unixy systems we'll make sure the directory is owned by root
483	* and not writable by the group and user.
484	*/
485	struct stat st;
486	if (!fstat(fd, &st))
487	{
488	if ( st.st_uid == 0
489	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
490	&& S_ISREG(st.st_mode))
491	{
492	/* it's valid. */
493	if (fLeaveFileOpen)
494	pVerified->hFile = fd;
495	else
496	close(fd);
497	pVerified->fValidated = true;
498	}
499	else
500	{
501	if (!S_ISREG(st.st_mode))
502	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
503	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
504	szPath, (long)st.st_uid);
505	else if (st.st_uid)
506	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
507	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
508	szPath, (long)st.st_uid);
509	else
510	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
511	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
512	szPath, (long)st.st_mode);
513	close(fd);
514	}
515	}
516	else
517	{
518	int err = errno;
519	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
520	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
521	szPath, strerror(err), err);
522	close(fd);
523	}
524	}
525	else
526	{
527	int err = errno;
528	if (!pFile->fOptional \|\| err != ENOENT)
529	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
530	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
531	szPath, strerror(err), err);
532	}
533	#endif /* UNIXY */
534	}
535	}
536
537	return rc;
538	}
539
540
541	/**
542	* Verifies that the specified table entry matches the given filename.
543	*
544	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
545	* error is returned or we terminate the application.
546	*
547	* @param iFile The file table index.
548	* @param pszFilename The filename.
549	* @param fFatal Whether validation failures should be treated as
550	* fatal (true) or not (false).
551	*/
552	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
553	{
554	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
555
556	/*
557	* Construct the full path for the file table entry
558	* and compare it with the specified file.
559	*/
560	char szName[RTPATH_MAX];
561	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
562	if (RT_FAILURE(rc))
563	return rc;
564	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
565	if (stricmp(szName, pszFilename))
566	#else
567	if (strcmp(szName, pszFilename))
568	#endif
569	{
570	/*
571	* Normalize the two paths and compare again.
572	*/
573	rc = VERR_NOT_SAME_DEVICE;
574	#if defined(RT_OS_WINDOWS)
575	LPSTR pszIgnored;
576	char szName2[RTPATH_MAX];
577	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
578	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
579	if (!stricmp(szName2, szName))
580	rc = VINF_SUCCESS;
581	#else
582	AssertCompile(RTPATH_MAX >= PATH_MAX);
583	char szName2[RTPATH_MAX];
584	if ( realpath(szName, szName2) != NULL
585	&& realpath(pszFilename, szName) != NULL)
586	if (!strcmp(szName2, szName))
587	rc = VINF_SUCCESS;
588	#endif
589
590	if (RT_FAILURE(rc))
591	{
592	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
593	return supR3HardenedError(rc, fFatal,
594	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
595	pszFilename, szName);
596	}
597	}
598
599	/*
600	* Check more stuff like the stat info if it's an already open file?
601	*/
602
603
604
605	return VINF_SUCCESS;
606	}
607
608
609	/**
610	* Verifies a file.
611	*
612	* @returns VINF_SUCCESS on success.
613	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
614	* On verfication failure, an error code will be returned when fFatal is clear,
615	* otherwise the program will be termindated.
616	*
617	* @param pszFilename The filename.
618	* @param fFatal Whether validation failures should be treated as
619	* fatal (true) or not (false).
620	*/
621	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
622	{
623	/*
624	* Lookup the file and check if it's the same file.
625	*/
626	const char *pszName = supR3HardenedPathFilename(pszFilename);
627	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
628	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
629	{
630	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
631	if (RT_SUCCESS(rc))
632	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
633	return rc;
634	}
635
636	return VERR_NOT_FOUND;
637	}
638
639
640	/**
641	* Verifies a program, worker for supR3HardenedVerifyAll.
642	*
643	* @returns See supR3HardenedVerifyAll.
644	* @param pszProgName See supR3HardenedVerifyAll.
645	* @param fFatal See supR3HardenedVerifyAll.
646	*/
647	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
648	{
649	/*
650	* Search the table looking for the executable and the DLL/DYLIB/SO.
651	*/
652	int rc = VINF_SUCCESS;
653	bool fExe = false;
654	bool fDll = false;
655	size_t const cchProgName = strlen(pszProgName);
656	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
657	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
658	{
659	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
660	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
661	{
662	/* This only has to be found (once). */
663	if (fDll)
664	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
665	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
666	fDll = true;
667	}
668	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
669	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
670	{
671	/* Here we'll have to check that the specific program is the same as the entry. */
672	if (fExe)
673	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
674	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
675	fExe = true;
676
677	char szFilename[RTPATH_MAX];
678	int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
679	if (RT_SUCCESS(rc2))
680	{
681	strcat(szFilename, "/");
682	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
683	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
684	}
685	else
686	rc = supR3HardenedError(rc2, fFatal,
687	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
688	}
689	}
690
691	/*
692	* Check the findings.
693	*/
694	if (!fDll && !fExe)
695	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
696	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
697	else if (!fExe)
698	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
699	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
700	else if (!fDll)
701	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
702	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
703	return rc;
704	}
705
706
707
708	/**
709	* Verifies all the known files.
710	*
711	* @returns VINF_SUCCESS on success.
712	* On verfication failure, an error code will be returned when fFatal is clear,
713	* otherwise the program will be termindated.
714	*
715	* @param fFatal Whether validation failures should be treated as
716	* fatal (true) or not (false).
717	* @param fLeaveFilesOpen If set, all the verfied files are left open.
718	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
719	* to verify that both the executable and corresponding
720	* DLL/DYLIB/SO are valid.
721	*/
722	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
723	{
724	/*
725	* The verify all the files.
726	*/
727	int rc = VINF_SUCCESS;
728	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
729	{
730	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
731	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
732	rc = rc2;
733	}
734
735	/*
736	* Verify the program name if specified, that is to say, just check that
737	* it's in the table (=> we've already verified it).
738	*/
739	if (pszProgName)
740	{
741	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
742	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
743	rc2 = rc;
744	}
745
746	return rc;
747	}
748
749
750	/**
751	* Gets the pre-init data for the hand-over to the other version
752	* of this code.
753	*
754	* The reason why we pass this information on is that it contains
755	* open directories and files. Later it may include even more info
756	* (int the verified arrays mostly).
757	*
758	* The receiver is supR3HardenedRecvPreInitData.
759	*
760	* @param pPreInitData Where to store it.
761	*/
762	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
763	{
764	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
765	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
766	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
767
768	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
769	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
770	}
771
772
773	/**
774	* Receives the pre-init data from the static executable stub.
775	*
776	* @returns VBox status code. Will not bitch on failure since the
777	* runtime isn't ready for it, so that is left to the exe stub.
778	*
779	* @param pPreInitData The hand-over data.
780	*/
781	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
782	{
783	/*
784	* Compare the array lengths and the contents of g_aSupInstallFiles.
785	*/
786	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
787	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
788	return VERR_VERSION_MISMATCH;
789	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
790	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
791	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
792	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
793	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
794	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
795	return VERR_VERSION_MISMATCH;
796
797	/*
798	* Check that we're not called out of order.
799	* If dynamic linking it screwed up, we may end up here.
800	*/
801	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
802	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
803	return VERR_WRONG_ORDER;
804
805	/*
806	* Copy the verification data over.
807	*/
808	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
809	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
810	return VINF_SUCCESS;
811	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 28964

Download in other formats: