SUPR3HardenedVerify.cpp@ 15239

Last change on this file since 15239 was 14443, checked in by vboxsync, 16 years ago
OpenGL installer fix
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 31.5 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 14443 2008-11-21 07:36:42Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39	# include <stdlib.h>
40	# include <unistd.h>
41	# include <sys/fcntl.h>
42	# include <sys/errno.h>
43	# include <sys/syslimits.h>
44
45	#elif defined(RT_OS_WINDOWS)
46	# include <Windows.h>
47	# include <stdio.h>
48
49	#else /* UNIXes */
50	# include <sys/types.h>
51	# include <stdio.h>
52	# include <stdlib.h>
53	# include <dlfcn.h>
54	# include <fcntl.h>
55	# include <limits.h>
56	# include <errno.h>
57	# include <unistd.h>
58	# include <sys/stat.h>
59	# include <sys/time.h>
60	# include <sys/fcntl.h>
61	# include <stdio.h>
62	# include <pwd.h>
63	# ifdef RT_OS_DARWIN
64	# include <mach-o/dyld.h>
65	# endif
66
67	#endif
68
69	#include <VBox/sup.h>
70	#include <VBox/err.h>
71	#include <iprt/string.h>
72	#include <iprt/param.h>
73
74	#include "SUPLibInternal.h"
75
76
77
78
79	/*******************************************************************************
80	* Global Variables *
81	*******************************************************************************/
82	/**
83	* The files that gets verified.
84	*
85	* @todo This needs reviewing against the linux packages.
86	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
87	* the time being we're building the linux packages with SharedLib pointing to
88	* AppPrivArch (lazy bird).
89	*/
90	static SUPINSTFILE const g_aSupInstallFiles[] =
91	{
92	/* type, dir,fOptional, pszFile */
93	/* ---------------------------------------------------------------------- */
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
96	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
97
98	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
99	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
100	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
101
102	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
103	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
104	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
105	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
106	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
107	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
108
109	//#ifdef VBOX_WITH_DEBUGGER_GUI
110	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
112	//#endif
113
114	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
115	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
116	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
117	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
118
119	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
120	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
121	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
122	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
123
124	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxManage" SUPLIB_EXE_SUFF },
125
126	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
127	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxSettings" SUPLIB_DLL_SUFF },
128	#ifdef RT_OS_WINDOWS
129	/** @todo */
130	#else
131	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
132	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
133	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
134	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
135	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
136	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
137	#endif
138
139	//#ifdef VBOX_WITH_VRDP
140	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
141	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
142	//#endif
143
144	//#ifdef VBOX_WITH_HEADLESS
145	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
146	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
147	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
148	//#endif
149
150	//#ifdef VBOX_WITH_QT4GUI
151	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
152	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
153	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
154	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
155	# endif
156	//#endif
157
158	//#ifdef VBOX_WITH_QTGUI
159	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox3" SUPLIB_EXE_SUFF },
160	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox3" SUPLIB_DLL_SUFF },
161	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
162	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard3" SUPLIB_DLL_SUFF },
163	# endif
164	//#endif
165
166	//#ifdef VBOX_WITH_VBOXSDL
167	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
168	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
169	//#endif
170
171	//#ifdef VBOX_WITH_VBOXBFE
172	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
173	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
174	//#endif
175
176	//#ifdef VBOX_WITH_WEBSERVICES
177	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
178	//#endif
179
180	#ifdef RT_OS_LINUX
181	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
182	#endif
183	};
184
185
186	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
187	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
188
189	/** Array index by install directory specifier containing info about verified directories. */
190	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
191
192
193	/**
194	* Assembles the path to a dirtory.
195	*
196	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
197	* decides whether it returns or not).
198	*
199	* @param enmDir The directory.
200	* @param pszDst Where to assemble the path.
201	* @param cchDst The size of the buffer.
202	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
203	*/
204	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
205	{
206	int rc;
207	switch (enmDir)
208	{
209	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
210	case kSupID_Bin:
211	rc = supR3HardenedPathProgram(pszDst, cchDst);
212	break;
213	case kSupID_SharedLib:
214	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
215	break;
216	case kSupID_AppPrivArch:
217	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
218	break;
219	case kSupID_AppPrivArchComp:
220	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
221	if (RT_SUCCESS(rc))
222	{
223	size_t off = strlen(pszDst);
224	if (cchDst - off >= sizeof("/components"))
225	memcpy(&pszDst[off], "/components", sizeof("/components"));
226	else
227	rc = VERR_BUFFER_OVERFLOW;
228	}
229	break;
230	case kSupID_AppPrivNoArch:
231	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
232	break;
233	default:
234	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
235	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
236	}
237	if (RT_FAILURE(rc))
238	supR3HardenedError(rc, fFatal,
239	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
240	return rc;
241	}
242
243
244
245	/**
246	* Assembles the path to a file table entry, with or without the actual filename.
247	*
248	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
249	* decides whether it returns or not).
250	*
251	* @param pFile The file table entry.
252	* @param pszDst Where to assemble the path.
253	* @param cchDst The size of the buffer.
254	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
255	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
256	*/
257	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
258	{
259	/*
260	* Combine supR3HardenedMakePath and the filename.
261	*/
262	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
263	if (RT_SUCCESS(rc))
264	{
265	size_t cchFile = strlen(pFile->pszFile);
266	size_t off = strlen(pszDst);
267	if (cchDst - off >= cchFile + 2)
268	{
269	pszDst[off++] = '/';
270	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
271	}
272	else
273	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
274	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
275	pFile->pszFile, (long)off);
276	}
277	return rc;
278	}
279
280
281	/**
282	* Verifies a directory.
283	*
284	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
285	* fFatal is clear and if it's set the function wont return.
286	* @param enmDir The directory specifier.
287	* @param fFatal Whether validation failures should be treated as
288	* fatal (true) or not (false).
289	*/
290	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
291	{
292	/*
293	* Validate the index just to be on the safe side...
294	*/
295	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
296	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
297	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
298
299	/*
300	* Already validated?
301	*/
302	if (g_aSupVerifiedDirs[enmDir].fValidated)
303	return VINF_SUCCESS; /** @todo revalidate? */
304
305	/* initialize the entry. */
306	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
307	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
308	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
309	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
310	g_aSupVerifiedDirs[enmDir].hDir = -1;
311	g_aSupVerifiedDirs[enmDir].fValidated = false;
312
313	/*
314	* Make the path and open the directory.
315	*/
316	char szPath[RTPATH_MAX];
317	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
318	if (RT_SUCCESS(rc))
319	{
320	#if defined(RT_OS_WINDOWS)
321	HANDLE hDir = CreateFile(szPath,
322	GENERIC_READ,
323	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
324	NULL,
325	OPEN_ALWAYS,
326	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
327	NULL);
328	if (hDir != INVALID_HANDLE_VALUE)
329	{
330	/** @todo check the type */
331	/* That's all on windows, for now at least... */
332	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
333	g_aSupVerifiedDirs[enmDir].fValidated = true;
334	}
335	else
336	{
337	int err = GetLastError();
338	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
339	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
340	szPath, err);
341	}
342	#else /* UNIXY */
343	int fd = open(szPath, O_RDONLY, 0);
344	if (fd >= 0)
345	{
346	/*
347	* On unixy systems we'll make sure the directory is owned by root
348	* and not writable by the group and user.
349	*/
350	struct stat st;
351	if (!fstat(fd, &st))
352	{
353
354	if ( st.st_uid == 0
355	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
356	&& S_ISDIR(st.st_mode))
357	{
358	g_aSupVerifiedDirs[enmDir].hDir = fd;
359	g_aSupVerifiedDirs[enmDir].fValidated = true;
360	}
361	else
362	{
363	if (!S_ISDIR(st.st_mode))
364	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
365	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
366	szPath, (long)st.st_uid);
367	else if (st.st_uid)
368	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
369	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
370	szPath, (long)st.st_uid);
371	else
372	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
373	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
374	szPath, (long)st.st_mode);
375	close(fd);
376	}
377	}
378	else
379	{
380	int err = errno;
381	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
382	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
383	szPath, strerror(err), err);
384	close(fd);
385	}
386	}
387	else
388	{
389	int err = errno;
390	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
391	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
392	szPath, strerror(err), err);
393	}
394	#endif /* UNIXY */
395	}
396
397	return rc;
398	}
399
400
401	/**
402	* Verifies a file entry.
403	*
404	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
405	* fFatal is clear and if it's set the function wont return.
406	*
407	* @param iFile The file table index of the file to be verified.
408	* @param fFatal Whether validation failures should be treated as
409	* fatal (true) or not (false).
410	* @param fLeaveFileOpen Whether the file should be left open.
411	*/
412	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
413	{
414	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
415	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
416
417	/*
418	* Already done?
419	*/
420	if (pVerified->fValidated)
421	return VINF_SUCCESS; /** @todo revalidate? */
422
423
424	/* initialize the entry. */
425	if (pVerified->hFile != 0)
426	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
427	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
428	(void *)pVerified->hFile, pFile->pszFile);
429	pVerified->hFile = -1;
430	pVerified->fValidated = false;
431
432	/*
433	* Verify the directory then proceed to open it.
434	* (This'll make sure the directory is opened and that we can (later)
435	* use openat if we wish.)
436	*/
437	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
438	if (RT_SUCCESS(rc))
439	{
440	char szPath[RTPATH_MAX];
441	int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
442	if (RT_SUCCESS(rc))
443	{
444	#if defined(RT_OS_WINDOWS)
445	HANDLE hFile = CreateFile(szPath,
446	GENERIC_READ,
447	FILE_SHARE_READ,
448	NULL,
449	OPEN_ALWAYS,
450	FILE_ATTRIBUTE_NORMAL,
451	NULL);
452	if (hFile != INVALID_HANDLE_VALUE)
453	{
454	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
455	{
456	/* it's valid. */
457	if (fLeaveFileOpen)
458	pVerified->hFile = (intptr_t)hFile;
459	else
460	CloseHandle(hFile);
461	pVerified->fValidated = true;
462	}
463	}
464	else
465	{
466	int err = GetLastError();
467	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
468	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
469	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
470	szPath, err);
471	}
472	#else /* UNIXY */
473	int fd = open(szPath, O_RDONLY, 0);
474	if (fd >= 0)
475	{
476	/*
477	* On unixy systems we'll make sure the directory is owned by root
478	* and not writable by the group and user.
479	*/
480	struct stat st;
481	if (!fstat(fd, &st))
482	{
483	if ( st.st_uid == 0
484	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
485	&& S_ISREG(st.st_mode))
486	{
487	/* it's valid. */
488	if (fLeaveFileOpen)
489	pVerified->hFile = fd;
490	else
491	close(fd);
492	pVerified->fValidated = true;
493	}
494	else
495	{
496	if (!S_ISREG(st.st_mode))
497	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
498	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
499	szPath, (long)st.st_uid);
500	else if (st.st_uid)
501	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
502	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
503	szPath, (long)st.st_uid);
504	else
505	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
506	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
507	szPath, (long)st.st_mode);
508	close(fd);
509	}
510	}
511	else
512	{
513	int err = errno;
514	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
515	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
516	szPath, strerror(err), err);
517	close(fd);
518	}
519	}
520	else
521	{
522	int err = errno;
523	if (!pFile->fOptional \|\| err != ENOENT)
524	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
525	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
526	szPath, strerror(err), err);
527	}
528	#endif /* UNIXY */
529	}
530	}
531
532	return rc;
533	}
534
535
536	/**
537	* Verifies that the specified table entry matches the given filename.
538	*
539	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
540	* error is returned or we terminate the application.
541	*
542	* @param iFile The file table index.
543	* @param pszFilename The filename.
544	* @param fFatal Whether validation failures should be treated as
545	* fatal (true) or not (false).
546	*/
547	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
548	{
549	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
550
551	/*
552	* Construct the full path for the file table entry
553	* and compare it with the specified file.
554	*/
555	char szName[RTPATH_MAX];
556	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
557	if (RT_FAILURE(rc))
558	return rc;
559	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
560	if (stricmp(szName, pszFilename))
561	#else
562	if (strcmp(szName, pszFilename))
563	#endif
564	{
565	/*
566	* Normalize the two paths and compare again.
567	*/
568	rc = VERR_NOT_SAME_DEVICE;
569	#if defined(RT_OS_WINDOWS)
570	LPSTR pszIgnored;
571	char szName2[RTPATH_MAX];
572	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
573	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
574	if (!stricmp(szName2, szName))
575	rc = VINF_SUCCESS;
576	#else
577	AssertCompile(RTPATH_MAX >= PATH_MAX);
578	char szName2[RTPATH_MAX];
579	if ( realpath(szName, szName2) != NULL
580	&& realpath(pszFilename, szName) != NULL)
581	if (!strcmp(szName2, szName))
582	rc = VINF_SUCCESS;
583	#endif
584
585	if (RT_FAILURE(rc))
586	{
587	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
588	return supR3HardenedError(rc, fFatal,
589	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
590	pszFilename, szName);
591	}
592	}
593
594	/*
595	* Check more stuff like the stat info if it's an already open file?
596	*/
597
598
599
600	return VINF_SUCCESS;
601	}
602
603
604	/**
605	* Verifies a file.
606	*
607	* @returns VINF_SUCCESS on success.
608	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
609	* On verfication failure, an error code will be returned when fFatal is clear,
610	* otherwise the program will be termindated.
611	*
612	* @param pszFilename The filename.
613	* @param fFatal Whether validation failures should be treated as
614	* fatal (true) or not (false).
615	*/
616	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
617	{
618	/*
619	* Lookup the file and check if it's the same file.
620	*/
621	const char *pszName = supR3HardenedPathFilename(pszFilename);
622	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
623	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
624	{
625	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
626	if (RT_SUCCESS(rc))
627	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
628	return rc;
629	}
630
631	return VERR_NOT_FOUND;
632	}
633
634
635	/**
636	* Verifies a program, worker for supR3HardenedVerifyAll.
637	*
638	* @returns See supR3HardenedVerifyAll.
639	* @param pszProgName See supR3HardenedVerifyAll.
640	* @param fFatal See supR3HardenedVerifyAll.
641	*/
642	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
643	{
644	/*
645	* Search the table looking for the executable and the DLL/DYLIB/SO.
646	*/
647	int rc = VINF_SUCCESS;
648	bool fExe = false;
649	bool fDll = false;
650	size_t const cchProgName = strlen(pszProgName);
651	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
652	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
653	{
654	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
655	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
656	{
657	/* This only has to be found (once). */
658	if (fDll)
659	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
660	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
661	fDll = true;
662	}
663	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
664	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
665	{
666	/* Here we'll have to check that the specific program is the same as the entry. */
667	if (fExe)
668	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
669	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
670	fExe = true;
671
672	char szFilename[RTPATH_MAX];
673	int rc2 = supR3HardenedPathProgram(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
674	if (RT_SUCCESS(rc2))
675	{
676	strcat(szFilename, "/");
677	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
678	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
679	}
680	else
681	rc = supR3HardenedError(rc2, fFatal,
682	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
683	}
684	}
685
686	/*
687	* Check the findings.
688	*/
689	if (!fDll && !fExe)
690	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
691	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
692	else if (!fExe)
693	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
694	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
695	else if (!fDll)
696	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
697	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
698	return rc;
699	}
700
701
702
703	/**
704	* Verifies all the known files.
705	*
706	* @returns VINF_SUCCESS on success.
707	* On verfication failure, an error code will be returned when fFatal is clear,
708	* otherwise the program will be termindated.
709	*
710	* @param fFatal Whether validation failures should be treated as
711	* fatal (true) or not (false).
712	* @param fLeaveFilesOpen If set, all the verfied files are left open.
713	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
714	* to verify that both the executable and corresponding
715	* DLL/DYLIB/SO are valid.
716	*/
717	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
718	{
719	/*
720	* The verify all the files.
721	*/
722	int rc = VINF_SUCCESS;
723	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
724	{
725	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
726	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
727	rc = rc2;
728	}
729
730	/*
731	* Verify the program name if specified, that is to say, just check that
732	* it's in the table (=> we've already verified it).
733	*/
734	if (pszProgName)
735	{
736	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
737	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
738	rc2 = rc;
739	}
740
741	return rc;
742	}
743
744
745	/**
746	* Gets the pre-init data for the hand-over to the other version
747	* of this code.
748	*
749	* The reason why we pass this information on is that it contains
750	* open directories and files. Later it may include even more info
751	* (int the verified arrays mostly).
752	*
753	* The receiver is supR3HardenedRecvPreInitData.
754	*
755	* @param pPreInitData Where to store it.
756	*/
757	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
758	{
759	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
760	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
761	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
762
763	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
764	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
765	}
766
767
768	/**
769	* Receives the pre-init data from the static executable stub.
770	*
771	* @returns VBox status code. Will not bitch on failure since the
772	* runtime isn't ready for it, so that is left to the exe stub.
773	*
774	* @param pPreInitData The hand-over data.
775	*/
776	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
777	{
778	/*
779	* Compare the array lengths and the contents of g_aSupInstallFiles.
780	*/
781	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
782	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
783	return VERR_VERSION_MISMATCH;
784	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
785	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
786	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
787	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
788	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
789	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
790	return VERR_VERSION_MISMATCH;
791
792	/*
793	* Check that we're not called out of order.
794	* If dynamic linking it screwed up, we may end up here.
795	*/
796	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
797	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
798	return VERR_WRONG_ORDER;
799
800	/*
801	* Copy the verification data over.
802	*/
803	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
804	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
805	return VINF_SUCCESS;
806	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 15239

Download in other formats: