SUPR3HardenedVerify.cpp@ 20504

Last change on this file since 20504 was 19924, checked in by vboxsync, 16 years ago
IPRT,SUP: Renamed RTPathProgram to RTPathExecDir to make it clear what it returns. Renamed hardened version of it as well.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 31.7 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 19924 2009-05-22 21:52:47Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39	# include <stdlib.h>
40	# include <unistd.h>
41	# include <sys/fcntl.h>
42	# include <sys/errno.h>
43	# include <sys/syslimits.h>
44
45	#elif defined(RT_OS_WINDOWS)
46	# include <Windows.h>
47	# include <stdio.h>
48
49	#else /* UNIXes */
50	# include <sys/types.h>
51	# include <stdio.h>
52	# include <stdlib.h>
53	# include <dlfcn.h>
54	# include <fcntl.h>
55	# include <limits.h>
56	# include <errno.h>
57	# include <unistd.h>
58	# include <sys/stat.h>
59	# include <sys/time.h>
60	# include <sys/fcntl.h>
61	# include <stdio.h>
62	# include <pwd.h>
63	# ifdef RT_OS_DARWIN
64	# include <mach-o/dyld.h>
65	# endif
66
67	#endif
68
69	#include <VBox/sup.h>
70	#include <VBox/err.h>
71	#include <iprt/string.h>
72	#include <iprt/param.h>
73
74	#include "SUPLibInternal.h"
75
76
77
78
79	/*******************************************************************************
80	* Global Variables *
81	*******************************************************************************/
82	/**
83	* The files that gets verified.
84	*
85	* @todo This needs reviewing against the linux packages.
86	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
87	* the time being we're building the linux packages with SharedLib pointing to
88	* AppPrivArch (lazy bird).
89	*/
90	static SUPINSTFILE const g_aSupInstallFiles[] =
91	{
92	/* type, dir, fOpt, "pszFile" */
93	/* ---------------------------------------------------------------------- */
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
96	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
97
98	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
99	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
100	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
101
102	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
103	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
104	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
105	#if HC_ARCH_BITS == 32
106	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
107	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
108	#endif
109	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
110	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
112
113	//#ifdef VBOX_WITH_DEBUGGER_GUI
114	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
115	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
116	//#endif
117
118	//#ifdef VBOX_WITH_SHARED_CLIPBOARD
119	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
120	//#endif
121	//#ifdef VBOX_WITH_SHARED_FOLDERS
122	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
123	//#endif
124	//#ifdef VBOX_WITH_GUEST_PROPS
125	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
126	//#endif
127	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
128	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
129	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
130	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
131
132	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
133
134	#ifdef VBOX_WITH_MAIN
135	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
136	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxSettings" SUPLIB_DLL_SUFF },
137	#ifdef RT_OS_WINDOWS
138	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
139	#else
140	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
141	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
142	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
143	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
144	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
145	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
146	#endif
147	#endif
148
149	//#ifdef VBOX_WITH_VRDP
150	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
151	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
152	//#endif
153
154	//#ifdef VBOX_WITH_HEADLESS
155	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
156	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
157	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
158	//#endif
159
160	//#ifdef VBOX_WITH_QTGUI
161	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
162	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
163	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
164	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
165	# endif
166	//#endif
167
168	//#ifdef VBOX_WITH_VBOXSDL
169	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
170	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
171	//#endif
172
173	//#ifdef VBOX_WITH_VBOXBFE
174	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
175	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
176	//#endif
177
178	//#ifdef VBOX_WITH_WEBSERVICES
179	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
180	//#endif
181
182	#ifdef RT_OS_LINUX
183	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
184	#endif
185
186	//#ifdef VBOX_WITH_NETFLT
187	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
188	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
189	//#endif
190	};
191
192
193	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
194	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
195
196	/** Array index by install directory specifier containing info about verified directories. */
197	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
198
199
200	/**
201	* Assembles the path to a dirtory.
202	*
203	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
204	* decides whether it returns or not).
205	*
206	* @param enmDir The directory.
207	* @param pszDst Where to assemble the path.
208	* @param cchDst The size of the buffer.
209	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
210	*/
211	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
212	{
213	int rc;
214	switch (enmDir)
215	{
216	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
217	case kSupID_Bin:
218	rc = supR3HardenedPathExecDir(pszDst, cchDst);
219	break;
220	case kSupID_SharedLib:
221	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
222	break;
223	case kSupID_AppPrivArch:
224	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
225	break;
226	case kSupID_AppPrivArchComp:
227	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
228	if (RT_SUCCESS(rc))
229	{
230	size_t off = strlen(pszDst);
231	if (cchDst - off >= sizeof("/components"))
232	memcpy(&pszDst[off], "/components", sizeof("/components"));
233	else
234	rc = VERR_BUFFER_OVERFLOW;
235	}
236	break;
237	case kSupID_AppPrivNoArch:
238	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
239	break;
240	default:
241	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
242	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
243	}
244	if (RT_FAILURE(rc))
245	supR3HardenedError(rc, fFatal,
246	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
247	return rc;
248	}
249
250
251
252	/**
253	* Assembles the path to a file table entry, with or without the actual filename.
254	*
255	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
256	* decides whether it returns or not).
257	*
258	* @param pFile The file table entry.
259	* @param pszDst Where to assemble the path.
260	* @param cchDst The size of the buffer.
261	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
262	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
263	*/
264	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
265	{
266	/*
267	* Combine supR3HardenedMakePath and the filename.
268	*/
269	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
270	if (RT_SUCCESS(rc))
271	{
272	size_t cchFile = strlen(pFile->pszFile);
273	size_t off = strlen(pszDst);
274	if (cchDst - off >= cchFile + 2)
275	{
276	pszDst[off++] = '/';
277	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
278	}
279	else
280	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
281	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
282	pFile->pszFile, (long)off);
283	}
284	return rc;
285	}
286
287
288	/**
289	* Verifies a directory.
290	*
291	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
292	* fFatal is clear and if it's set the function wont return.
293	* @param enmDir The directory specifier.
294	* @param fFatal Whether validation failures should be treated as
295	* fatal (true) or not (false).
296	*/
297	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
298	{
299	/*
300	* Validate the index just to be on the safe side...
301	*/
302	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
303	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
304	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
305
306	/*
307	* Already validated?
308	*/
309	if (g_aSupVerifiedDirs[enmDir].fValidated)
310	return VINF_SUCCESS; /** @todo revalidate? */
311
312	/* initialize the entry. */
313	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
314	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
315	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
316	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
317	g_aSupVerifiedDirs[enmDir].hDir = -1;
318	g_aSupVerifiedDirs[enmDir].fValidated = false;
319
320	/*
321	* Make the path and open the directory.
322	*/
323	char szPath[RTPATH_MAX];
324	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
325	if (RT_SUCCESS(rc))
326	{
327	#if defined(RT_OS_WINDOWS)
328	HANDLE hDir = CreateFile(szPath,
329	GENERIC_READ,
330	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
331	NULL,
332	OPEN_ALWAYS,
333	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
334	NULL);
335	if (hDir != INVALID_HANDLE_VALUE)
336	{
337	/** @todo check the type */
338	/* That's all on windows, for now at least... */
339	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
340	g_aSupVerifiedDirs[enmDir].fValidated = true;
341	}
342	else
343	{
344	int err = GetLastError();
345	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
346	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
347	szPath, err);
348	}
349	#else /* UNIXY */
350	int fd = open(szPath, O_RDONLY, 0);
351	if (fd >= 0)
352	{
353	/*
354	* On unixy systems we'll make sure the directory is owned by root
355	* and not writable by the group and user.
356	*/
357	struct stat st;
358	if (!fstat(fd, &st))
359	{
360
361	if ( st.st_uid == 0
362	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
363	&& S_ISDIR(st.st_mode))
364	{
365	g_aSupVerifiedDirs[enmDir].hDir = fd;
366	g_aSupVerifiedDirs[enmDir].fValidated = true;
367	}
368	else
369	{
370	if (!S_ISDIR(st.st_mode))
371	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
372	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
373	szPath, (long)st.st_uid);
374	else if (st.st_uid)
375	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
376	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
377	szPath, (long)st.st_uid);
378	else
379	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
380	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
381	szPath, (long)st.st_mode);
382	close(fd);
383	}
384	}
385	else
386	{
387	int err = errno;
388	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
389	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
390	szPath, strerror(err), err);
391	close(fd);
392	}
393	}
394	else
395	{
396	int err = errno;
397	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
398	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
399	szPath, strerror(err), err);
400	}
401	#endif /* UNIXY */
402	}
403
404	return rc;
405	}
406
407
408	/**
409	* Verifies a file entry.
410	*
411	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
412	* fFatal is clear and if it's set the function wont return.
413	*
414	* @param iFile The file table index of the file to be verified.
415	* @param fFatal Whether validation failures should be treated as
416	* fatal (true) or not (false).
417	* @param fLeaveFileOpen Whether the file should be left open.
418	*/
419	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
420	{
421	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
422	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
423
424	/*
425	* Already done?
426	*/
427	if (pVerified->fValidated)
428	return VINF_SUCCESS; /** @todo revalidate? */
429
430
431	/* initialize the entry. */
432	if (pVerified->hFile != 0)
433	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
434	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
435	(void *)pVerified->hFile, pFile->pszFile);
436	pVerified->hFile = -1;
437	pVerified->fValidated = false;
438
439	/*
440	* Verify the directory then proceed to open it.
441	* (This'll make sure the directory is opened and that we can (later)
442	* use openat if we wish.)
443	*/
444	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
445	if (RT_SUCCESS(rc))
446	{
447	char szPath[RTPATH_MAX];
448	int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
449	if (RT_SUCCESS(rc))
450	{
451	#if defined(RT_OS_WINDOWS)
452	HANDLE hFile = CreateFile(szPath,
453	GENERIC_READ,
454	FILE_SHARE_READ,
455	NULL,
456	OPEN_ALWAYS,
457	FILE_ATTRIBUTE_NORMAL,
458	NULL);
459	if (hFile != INVALID_HANDLE_VALUE)
460	{
461	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
462	{
463	/* it's valid. */
464	if (fLeaveFileOpen)
465	pVerified->hFile = (intptr_t)hFile;
466	else
467	CloseHandle(hFile);
468	pVerified->fValidated = true;
469	}
470	}
471	else
472	{
473	int err = GetLastError();
474	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
475	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
476	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
477	szPath, err);
478	}
479	#else /* UNIXY */
480	int fd = open(szPath, O_RDONLY, 0);
481	if (fd >= 0)
482	{
483	/*
484	* On unixy systems we'll make sure the directory is owned by root
485	* and not writable by the group and user.
486	*/
487	struct stat st;
488	if (!fstat(fd, &st))
489	{
490	if ( st.st_uid == 0
491	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
492	&& S_ISREG(st.st_mode))
493	{
494	/* it's valid. */
495	if (fLeaveFileOpen)
496	pVerified->hFile = fd;
497	else
498	close(fd);
499	pVerified->fValidated = true;
500	}
501	else
502	{
503	if (!S_ISREG(st.st_mode))
504	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
505	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
506	szPath, (long)st.st_uid);
507	else if (st.st_uid)
508	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
509	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
510	szPath, (long)st.st_uid);
511	else
512	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
513	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
514	szPath, (long)st.st_mode);
515	close(fd);
516	}
517	}
518	else
519	{
520	int err = errno;
521	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
522	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
523	szPath, strerror(err), err);
524	close(fd);
525	}
526	}
527	else
528	{
529	int err = errno;
530	if (!pFile->fOptional \|\| err != ENOENT)
531	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
532	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
533	szPath, strerror(err), err);
534	}
535	#endif /* UNIXY */
536	}
537	}
538
539	return rc;
540	}
541
542
543	/**
544	* Verifies that the specified table entry matches the given filename.
545	*
546	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
547	* error is returned or we terminate the application.
548	*
549	* @param iFile The file table index.
550	* @param pszFilename The filename.
551	* @param fFatal Whether validation failures should be treated as
552	* fatal (true) or not (false).
553	*/
554	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
555	{
556	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
557
558	/*
559	* Construct the full path for the file table entry
560	* and compare it with the specified file.
561	*/
562	char szName[RTPATH_MAX];
563	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
564	if (RT_FAILURE(rc))
565	return rc;
566	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
567	if (stricmp(szName, pszFilename))
568	#else
569	if (strcmp(szName, pszFilename))
570	#endif
571	{
572	/*
573	* Normalize the two paths and compare again.
574	*/
575	rc = VERR_NOT_SAME_DEVICE;
576	#if defined(RT_OS_WINDOWS)
577	LPSTR pszIgnored;
578	char szName2[RTPATH_MAX];
579	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
580	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
581	if (!stricmp(szName2, szName))
582	rc = VINF_SUCCESS;
583	#else
584	AssertCompile(RTPATH_MAX >= PATH_MAX);
585	char szName2[RTPATH_MAX];
586	if ( realpath(szName, szName2) != NULL
587	&& realpath(pszFilename, szName) != NULL)
588	if (!strcmp(szName2, szName))
589	rc = VINF_SUCCESS;
590	#endif
591
592	if (RT_FAILURE(rc))
593	{
594	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
595	return supR3HardenedError(rc, fFatal,
596	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
597	pszFilename, szName);
598	}
599	}
600
601	/*
602	* Check more stuff like the stat info if it's an already open file?
603	*/
604
605
606
607	return VINF_SUCCESS;
608	}
609
610
611	/**
612	* Verifies a file.
613	*
614	* @returns VINF_SUCCESS on success.
615	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
616	* On verfication failure, an error code will be returned when fFatal is clear,
617	* otherwise the program will be termindated.
618	*
619	* @param pszFilename The filename.
620	* @param fFatal Whether validation failures should be treated as
621	* fatal (true) or not (false).
622	*/
623	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
624	{
625	/*
626	* Lookup the file and check if it's the same file.
627	*/
628	const char *pszName = supR3HardenedPathFilename(pszFilename);
629	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
630	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
631	{
632	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
633	if (RT_SUCCESS(rc))
634	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
635	return rc;
636	}
637
638	return VERR_NOT_FOUND;
639	}
640
641
642	/**
643	* Verifies a program, worker for supR3HardenedVerifyAll.
644	*
645	* @returns See supR3HardenedVerifyAll.
646	* @param pszProgName See supR3HardenedVerifyAll.
647	* @param fFatal See supR3HardenedVerifyAll.
648	*/
649	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
650	{
651	/*
652	* Search the table looking for the executable and the DLL/DYLIB/SO.
653	*/
654	int rc = VINF_SUCCESS;
655	bool fExe = false;
656	bool fDll = false;
657	size_t const cchProgName = strlen(pszProgName);
658	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
659	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
660	{
661	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
662	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
663	{
664	/* This only has to be found (once). */
665	if (fDll)
666	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
667	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
668	fDll = true;
669	}
670	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
671	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
672	{
673	/* Here we'll have to check that the specific program is the same as the entry. */
674	if (fExe)
675	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
676	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
677	fExe = true;
678
679	char szFilename[RTPATH_MAX];
680	int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
681	if (RT_SUCCESS(rc2))
682	{
683	strcat(szFilename, "/");
684	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
685	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
686	}
687	else
688	rc = supR3HardenedError(rc2, fFatal,
689	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
690	}
691	}
692
693	/*
694	* Check the findings.
695	*/
696	if (!fDll && !fExe)
697	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
698	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
699	else if (!fExe)
700	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
701	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
702	else if (!fDll)
703	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
704	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
705	return rc;
706	}
707
708
709
710	/**
711	* Verifies all the known files.
712	*
713	* @returns VINF_SUCCESS on success.
714	* On verfication failure, an error code will be returned when fFatal is clear,
715	* otherwise the program will be termindated.
716	*
717	* @param fFatal Whether validation failures should be treated as
718	* fatal (true) or not (false).
719	* @param fLeaveFilesOpen If set, all the verfied files are left open.
720	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
721	* to verify that both the executable and corresponding
722	* DLL/DYLIB/SO are valid.
723	*/
724	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
725	{
726	/*
727	* The verify all the files.
728	*/
729	int rc = VINF_SUCCESS;
730	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
731	{
732	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
733	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
734	rc = rc2;
735	}
736
737	/*
738	* Verify the program name if specified, that is to say, just check that
739	* it's in the table (=> we've already verified it).
740	*/
741	if (pszProgName)
742	{
743	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
744	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
745	rc2 = rc;
746	}
747
748	return rc;
749	}
750
751
752	/**
753	* Gets the pre-init data for the hand-over to the other version
754	* of this code.
755	*
756	* The reason why we pass this information on is that it contains
757	* open directories and files. Later it may include even more info
758	* (int the verified arrays mostly).
759	*
760	* The receiver is supR3HardenedRecvPreInitData.
761	*
762	* @param pPreInitData Where to store it.
763	*/
764	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
765	{
766	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
767	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
768	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
769
770	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
771	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
772	}
773
774
775	/**
776	* Receives the pre-init data from the static executable stub.
777	*
778	* @returns VBox status code. Will not bitch on failure since the
779	* runtime isn't ready for it, so that is left to the exe stub.
780	*
781	* @param pPreInitData The hand-over data.
782	*/
783	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
784	{
785	/*
786	* Compare the array lengths and the contents of g_aSupInstallFiles.
787	*/
788	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
789	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
790	return VERR_VERSION_MISMATCH;
791	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
792	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
793	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
794	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
795	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
796	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
797	return VERR_VERSION_MISMATCH;
798
799	/*
800	* Check that we're not called out of order.
801	* If dynamic linking it screwed up, we may end up here.
802	*/
803	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
804	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
805	return VERR_WRONG_ORDER;
806
807	/*
808	* Copy the verification data over.
809	*/
810	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
811	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
812	return VINF_SUCCESS;
813	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 20504

Download in other formats: