SUPR3HardenedVerify.cpp@ 15531

Last change on this file since 15531 was 15353, checked in by vboxsync, 16 years ago
g_aSupInstallFiles: It's HC_ARCH_BITS not RT_ARCH_BITS, baka.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 31.7 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 15353 2008-12-12 06:10:39Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39	# include <stdlib.h>
40	# include <unistd.h>
41	# include <sys/fcntl.h>
42	# include <sys/errno.h>
43	# include <sys/syslimits.h>
44
45	#elif defined(RT_OS_WINDOWS)
46	# include <Windows.h>
47	# include <stdio.h>
48
49	#else /* UNIXes */
50	# include <sys/types.h>
51	# include <stdio.h>
52	# include <stdlib.h>
53	# include <dlfcn.h>
54	# include <fcntl.h>
55	# include <limits.h>
56	# include <errno.h>
57	# include <unistd.h>
58	# include <sys/stat.h>
59	# include <sys/time.h>
60	# include <sys/fcntl.h>
61	# include <stdio.h>
62	# include <pwd.h>
63	# ifdef RT_OS_DARWIN
64	# include <mach-o/dyld.h>
65	# endif
66
67	#endif
68
69	#include <VBox/sup.h>
70	#include <VBox/err.h>
71	#include <iprt/string.h>
72	#include <iprt/param.h>
73
74	#include "SUPLibInternal.h"
75
76
77
78
79	/*******************************************************************************
80	* Global Variables *
81	*******************************************************************************/
82	/**
83	* The files that gets verified.
84	*
85	* @todo This needs reviewing against the linux packages.
86	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
87	* the time being we're building the linux packages with SharedLib pointing to
88	* AppPrivArch (lazy bird).
89	*/
90	static SUPINSTFILE const g_aSupInstallFiles[] =
91	{
92	/* type, dir,fOptional, pszFile */
93	/* ---------------------------------------------------------------------- */
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
96	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
97
98	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
99	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
100	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
101
102	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
103	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
104	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
105	#if HC_ARCH_BITS == 32
106	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
107	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
108	#endif
109	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
110	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
112
113	//#ifdef VBOX_WITH_DEBUGGER_GUI
114	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
115	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
116	//#endif
117
118	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
119	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
120	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
121	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
122
123	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
124	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
125	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
126	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
127
128	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxManage" SUPLIB_EXE_SUFF },
129
130	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
131	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxSettings" SUPLIB_DLL_SUFF },
132	#ifdef RT_OS_WINDOWS
133	/** @todo */
134	#else
135	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
136	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
137	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
138	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
139	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
140	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
141	#endif
142
143	//#ifdef VBOX_WITH_VRDP
144	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
145	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
146	//#endif
147
148	//#ifdef VBOX_WITH_HEADLESS
149	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
150	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
151	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
152	//#endif
153
154	//#ifdef VBOX_WITH_QT4GUI
155	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
156	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
157	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
158	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
159	# endif
160	//#endif
161
162	//#ifdef VBOX_WITH_QTGUI
163	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox3" SUPLIB_EXE_SUFF },
164	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox3" SUPLIB_DLL_SUFF },
165	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
166	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard3" SUPLIB_DLL_SUFF },
167	# endif
168	//#endif
169
170	//#ifdef VBOX_WITH_VBOXSDL
171	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
172	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
173	//#endif
174
175	//#ifdef VBOX_WITH_VBOXBFE
176	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
177	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
178	//#endif
179
180	//#ifdef VBOX_WITH_WEBSERVICES
181	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
182	//#endif
183
184	#ifdef RT_OS_LINUX
185	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
186	#endif
187	};
188
189
190	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
191	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
192
193	/** Array index by install directory specifier containing info about verified directories. */
194	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
195
196
197	/**
198	* Assembles the path to a dirtory.
199	*
200	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
201	* decides whether it returns or not).
202	*
203	* @param enmDir The directory.
204	* @param pszDst Where to assemble the path.
205	* @param cchDst The size of the buffer.
206	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
207	*/
208	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
209	{
210	int rc;
211	switch (enmDir)
212	{
213	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
214	case kSupID_Bin:
215	rc = supR3HardenedPathProgram(pszDst, cchDst);
216	break;
217	case kSupID_SharedLib:
218	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
219	break;
220	case kSupID_AppPrivArch:
221	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
222	break;
223	case kSupID_AppPrivArchComp:
224	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
225	if (RT_SUCCESS(rc))
226	{
227	size_t off = strlen(pszDst);
228	if (cchDst - off >= sizeof("/components"))
229	memcpy(&pszDst[off], "/components", sizeof("/components"));
230	else
231	rc = VERR_BUFFER_OVERFLOW;
232	}
233	break;
234	case kSupID_AppPrivNoArch:
235	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
236	break;
237	default:
238	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
239	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
240	}
241	if (RT_FAILURE(rc))
242	supR3HardenedError(rc, fFatal,
243	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
244	return rc;
245	}
246
247
248
249	/**
250	* Assembles the path to a file table entry, with or without the actual filename.
251	*
252	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
253	* decides whether it returns or not).
254	*
255	* @param pFile The file table entry.
256	* @param pszDst Where to assemble the path.
257	* @param cchDst The size of the buffer.
258	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
259	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
260	*/
261	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
262	{
263	/*
264	* Combine supR3HardenedMakePath and the filename.
265	*/
266	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
267	if (RT_SUCCESS(rc))
268	{
269	size_t cchFile = strlen(pFile->pszFile);
270	size_t off = strlen(pszDst);
271	if (cchDst - off >= cchFile + 2)
272	{
273	pszDst[off++] = '/';
274	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
275	}
276	else
277	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
278	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
279	pFile->pszFile, (long)off);
280	}
281	return rc;
282	}
283
284
285	/**
286	* Verifies a directory.
287	*
288	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
289	* fFatal is clear and if it's set the function wont return.
290	* @param enmDir The directory specifier.
291	* @param fFatal Whether validation failures should be treated as
292	* fatal (true) or not (false).
293	*/
294	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
295	{
296	/*
297	* Validate the index just to be on the safe side...
298	*/
299	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
300	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
301	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
302
303	/*
304	* Already validated?
305	*/
306	if (g_aSupVerifiedDirs[enmDir].fValidated)
307	return VINF_SUCCESS; /** @todo revalidate? */
308
309	/* initialize the entry. */
310	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
311	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
312	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
313	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
314	g_aSupVerifiedDirs[enmDir].hDir = -1;
315	g_aSupVerifiedDirs[enmDir].fValidated = false;
316
317	/*
318	* Make the path and open the directory.
319	*/
320	char szPath[RTPATH_MAX];
321	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
322	if (RT_SUCCESS(rc))
323	{
324	#if defined(RT_OS_WINDOWS)
325	HANDLE hDir = CreateFile(szPath,
326	GENERIC_READ,
327	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
328	NULL,
329	OPEN_ALWAYS,
330	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
331	NULL);
332	if (hDir != INVALID_HANDLE_VALUE)
333	{
334	/** @todo check the type */
335	/* That's all on windows, for now at least... */
336	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
337	g_aSupVerifiedDirs[enmDir].fValidated = true;
338	}
339	else
340	{
341	int err = GetLastError();
342	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
343	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
344	szPath, err);
345	}
346	#else /* UNIXY */
347	int fd = open(szPath, O_RDONLY, 0);
348	if (fd >= 0)
349	{
350	/*
351	* On unixy systems we'll make sure the directory is owned by root
352	* and not writable by the group and user.
353	*/
354	struct stat st;
355	if (!fstat(fd, &st))
356	{
357
358	if ( st.st_uid == 0
359	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
360	&& S_ISDIR(st.st_mode))
361	{
362	g_aSupVerifiedDirs[enmDir].hDir = fd;
363	g_aSupVerifiedDirs[enmDir].fValidated = true;
364	}
365	else
366	{
367	if (!S_ISDIR(st.st_mode))
368	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
369	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
370	szPath, (long)st.st_uid);
371	else if (st.st_uid)
372	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
373	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
374	szPath, (long)st.st_uid);
375	else
376	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
377	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
378	szPath, (long)st.st_mode);
379	close(fd);
380	}
381	}
382	else
383	{
384	int err = errno;
385	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
386	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
387	szPath, strerror(err), err);
388	close(fd);
389	}
390	}
391	else
392	{
393	int err = errno;
394	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
395	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
396	szPath, strerror(err), err);
397	}
398	#endif /* UNIXY */
399	}
400
401	return rc;
402	}
403
404
405	/**
406	* Verifies a file entry.
407	*
408	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
409	* fFatal is clear and if it's set the function wont return.
410	*
411	* @param iFile The file table index of the file to be verified.
412	* @param fFatal Whether validation failures should be treated as
413	* fatal (true) or not (false).
414	* @param fLeaveFileOpen Whether the file should be left open.
415	*/
416	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
417	{
418	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
419	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
420
421	/*
422	* Already done?
423	*/
424	if (pVerified->fValidated)
425	return VINF_SUCCESS; /** @todo revalidate? */
426
427
428	/* initialize the entry. */
429	if (pVerified->hFile != 0)
430	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
431	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
432	(void *)pVerified->hFile, pFile->pszFile);
433	pVerified->hFile = -1;
434	pVerified->fValidated = false;
435
436	/*
437	* Verify the directory then proceed to open it.
438	* (This'll make sure the directory is opened and that we can (later)
439	* use openat if we wish.)
440	*/
441	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
442	if (RT_SUCCESS(rc))
443	{
444	char szPath[RTPATH_MAX];
445	int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
446	if (RT_SUCCESS(rc))
447	{
448	#if defined(RT_OS_WINDOWS)
449	HANDLE hFile = CreateFile(szPath,
450	GENERIC_READ,
451	FILE_SHARE_READ,
452	NULL,
453	OPEN_ALWAYS,
454	FILE_ATTRIBUTE_NORMAL,
455	NULL);
456	if (hFile != INVALID_HANDLE_VALUE)
457	{
458	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
459	{
460	/* it's valid. */
461	if (fLeaveFileOpen)
462	pVerified->hFile = (intptr_t)hFile;
463	else
464	CloseHandle(hFile);
465	pVerified->fValidated = true;
466	}
467	}
468	else
469	{
470	int err = GetLastError();
471	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
472	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
473	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
474	szPath, err);
475	}
476	#else /* UNIXY */
477	int fd = open(szPath, O_RDONLY, 0);
478	if (fd >= 0)
479	{
480	/*
481	* On unixy systems we'll make sure the directory is owned by root
482	* and not writable by the group and user.
483	*/
484	struct stat st;
485	if (!fstat(fd, &st))
486	{
487	if ( st.st_uid == 0
488	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
489	&& S_ISREG(st.st_mode))
490	{
491	/* it's valid. */
492	if (fLeaveFileOpen)
493	pVerified->hFile = fd;
494	else
495	close(fd);
496	pVerified->fValidated = true;
497	}
498	else
499	{
500	if (!S_ISREG(st.st_mode))
501	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
502	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
503	szPath, (long)st.st_uid);
504	else if (st.st_uid)
505	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
506	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
507	szPath, (long)st.st_uid);
508	else
509	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
510	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
511	szPath, (long)st.st_mode);
512	close(fd);
513	}
514	}
515	else
516	{
517	int err = errno;
518	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
519	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
520	szPath, strerror(err), err);
521	close(fd);
522	}
523	}
524	else
525	{
526	int err = errno;
527	if (!pFile->fOptional \|\| err != ENOENT)
528	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
529	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
530	szPath, strerror(err), err);
531	}
532	#endif /* UNIXY */
533	}
534	}
535
536	return rc;
537	}
538
539
540	/**
541	* Verifies that the specified table entry matches the given filename.
542	*
543	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
544	* error is returned or we terminate the application.
545	*
546	* @param iFile The file table index.
547	* @param pszFilename The filename.
548	* @param fFatal Whether validation failures should be treated as
549	* fatal (true) or not (false).
550	*/
551	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
552	{
553	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
554
555	/*
556	* Construct the full path for the file table entry
557	* and compare it with the specified file.
558	*/
559	char szName[RTPATH_MAX];
560	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
561	if (RT_FAILURE(rc))
562	return rc;
563	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
564	if (stricmp(szName, pszFilename))
565	#else
566	if (strcmp(szName, pszFilename))
567	#endif
568	{
569	/*
570	* Normalize the two paths and compare again.
571	*/
572	rc = VERR_NOT_SAME_DEVICE;
573	#if defined(RT_OS_WINDOWS)
574	LPSTR pszIgnored;
575	char szName2[RTPATH_MAX];
576	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
577	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
578	if (!stricmp(szName2, szName))
579	rc = VINF_SUCCESS;
580	#else
581	AssertCompile(RTPATH_MAX >= PATH_MAX);
582	char szName2[RTPATH_MAX];
583	if ( realpath(szName, szName2) != NULL
584	&& realpath(pszFilename, szName) != NULL)
585	if (!strcmp(szName2, szName))
586	rc = VINF_SUCCESS;
587	#endif
588
589	if (RT_FAILURE(rc))
590	{
591	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
592	return supR3HardenedError(rc, fFatal,
593	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
594	pszFilename, szName);
595	}
596	}
597
598	/*
599	* Check more stuff like the stat info if it's an already open file?
600	*/
601
602
603
604	return VINF_SUCCESS;
605	}
606
607
608	/**
609	* Verifies a file.
610	*
611	* @returns VINF_SUCCESS on success.
612	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
613	* On verfication failure, an error code will be returned when fFatal is clear,
614	* otherwise the program will be termindated.
615	*
616	* @param pszFilename The filename.
617	* @param fFatal Whether validation failures should be treated as
618	* fatal (true) or not (false).
619	*/
620	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
621	{
622	/*
623	* Lookup the file and check if it's the same file.
624	*/
625	const char *pszName = supR3HardenedPathFilename(pszFilename);
626	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
627	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
628	{
629	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
630	if (RT_SUCCESS(rc))
631	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
632	return rc;
633	}
634
635	return VERR_NOT_FOUND;
636	}
637
638
639	/**
640	* Verifies a program, worker for supR3HardenedVerifyAll.
641	*
642	* @returns See supR3HardenedVerifyAll.
643	* @param pszProgName See supR3HardenedVerifyAll.
644	* @param fFatal See supR3HardenedVerifyAll.
645	*/
646	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
647	{
648	/*
649	* Search the table looking for the executable and the DLL/DYLIB/SO.
650	*/
651	int rc = VINF_SUCCESS;
652	bool fExe = false;
653	bool fDll = false;
654	size_t const cchProgName = strlen(pszProgName);
655	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
656	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
657	{
658	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
659	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
660	{
661	/* This only has to be found (once). */
662	if (fDll)
663	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
664	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
665	fDll = true;
666	}
667	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
668	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
669	{
670	/* Here we'll have to check that the specific program is the same as the entry. */
671	if (fExe)
672	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
673	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
674	fExe = true;
675
676	char szFilename[RTPATH_MAX];
677	int rc2 = supR3HardenedPathProgram(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
678	if (RT_SUCCESS(rc2))
679	{
680	strcat(szFilename, "/");
681	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
682	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
683	}
684	else
685	rc = supR3HardenedError(rc2, fFatal,
686	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
687	}
688	}
689
690	/*
691	* Check the findings.
692	*/
693	if (!fDll && !fExe)
694	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
695	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
696	else if (!fExe)
697	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
698	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
699	else if (!fDll)
700	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
701	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
702	return rc;
703	}
704
705
706
707	/**
708	* Verifies all the known files.
709	*
710	* @returns VINF_SUCCESS on success.
711	* On verfication failure, an error code will be returned when fFatal is clear,
712	* otherwise the program will be termindated.
713	*
714	* @param fFatal Whether validation failures should be treated as
715	* fatal (true) or not (false).
716	* @param fLeaveFilesOpen If set, all the verfied files are left open.
717	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
718	* to verify that both the executable and corresponding
719	* DLL/DYLIB/SO are valid.
720	*/
721	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
722	{
723	/*
724	* The verify all the files.
725	*/
726	int rc = VINF_SUCCESS;
727	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
728	{
729	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
730	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
731	rc = rc2;
732	}
733
734	/*
735	* Verify the program name if specified, that is to say, just check that
736	* it's in the table (=> we've already verified it).
737	*/
738	if (pszProgName)
739	{
740	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
741	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
742	rc2 = rc;
743	}
744
745	return rc;
746	}
747
748
749	/**
750	* Gets the pre-init data for the hand-over to the other version
751	* of this code.
752	*
753	* The reason why we pass this information on is that it contains
754	* open directories and files. Later it may include even more info
755	* (int the verified arrays mostly).
756	*
757	* The receiver is supR3HardenedRecvPreInitData.
758	*
759	* @param pPreInitData Where to store it.
760	*/
761	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
762	{
763	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
764	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
765	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
766
767	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
768	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
769	}
770
771
772	/**
773	* Receives the pre-init data from the static executable stub.
774	*
775	* @returns VBox status code. Will not bitch on failure since the
776	* runtime isn't ready for it, so that is left to the exe stub.
777	*
778	* @param pPreInitData The hand-over data.
779	*/
780	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
781	{
782	/*
783	* Compare the array lengths and the contents of g_aSupInstallFiles.
784	*/
785	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
786	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
787	return VERR_VERSION_MISMATCH;
788	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
789	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
790	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
791	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
792	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
793	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
794	return VERR_VERSION_MISMATCH;
795
796	/*
797	* Check that we're not called out of order.
798	* If dynamic linking it screwed up, we may end up here.
799	*/
800	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
801	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
802	return VERR_WRONG_ORDER;
803
804	/*
805	* Copy the verification data over.
806	*/
807	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
808	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
809	return VINF_SUCCESS;
810	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 15531

Download in other formats: