SUPR3HardenedVerify.cpp@ 51866

Last change on this file since 51866 was 51803, checked in by vboxsync, 11 years ago
Use CreateFileW instead of CreateFileA when verifying the install files and plugins.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 62.8 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 51803 2014-07-02 09:28:15Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/*******************************************************************************
28	* Header Files *
29	*******************************************************************************/
30	#if defined(RT_OS_OS2)
31	# define INCL_BASE
32	# define INCL_ERRORS
33	# include <os2.h>
34	# include <stdio.h>
35	# include <stdlib.h>
36	# include <unistd.h>
37	# include <sys/fcntl.h>
38	# include <sys/errno.h>
39	# include <sys/syslimits.h>
40
41	#elif defined(RT_OS_WINDOWS)
42	# include <Windows.h>
43	# ifndef IN_SUP_HARDENED_R3
44	# include <stdio.h>
45	# endif
46
47	#else /* UNIXes */
48	# include <sys/types.h>
49	# include <stdio.h>
50	# include <stdlib.h>
51	# include <dirent.h>
52	# include <dlfcn.h>
53	# include <fcntl.h>
54	# include <limits.h>
55	# include <errno.h>
56	# include <unistd.h>
57	# include <sys/stat.h>
58	# include <sys/time.h>
59	# include <sys/fcntl.h>
60	# include <pwd.h>
61	# ifdef RT_OS_DARWIN
62	# include <mach-o/dyld.h>
63	# endif
64
65	#endif
66
67	#include <VBox/sup.h>
68	#include <VBox/err.h>
69	#include <iprt/asm.h>
70	#include <iprt/ctype.h>
71	#include <iprt/param.h>
72	#include <iprt/path.h>
73	#include <iprt/string.h>
74
75	#include "SUPLibInternal.h"
76	#if defined(RT_OS_WINDOWS) && defined(VBOX_WITH_HARDENING)
77	# define SUPHNTVI_NO_NT_STUFF
78	# include "win/SUPHardenedVerify-win.h"
79	#endif
80
81
82	/*******************************************************************************
83	* Defined Constants And Macros *
84	*******************************************************************************/
85	/** The max path length acceptable for a trusted path. */
86	#define SUPR3HARDENED_MAX_PATH 260U
87
88	#ifdef RT_OS_SOLARIS
89	# define dirfd(d) ((d)->d_fd)
90	#endif
91
92	/** Compare table file names with externally supplied names. */
93	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
94	# define SUP_COMP_FILENAME suplibHardenedStrICmp
95	#else
96	# define SUP_COMP_FILENAME suplibHardenedStrCmp
97	#endif
98
99
100	/*******************************************************************************
101	* Global Variables *
102	*******************************************************************************/
103	/**
104	* The files that gets verified.
105	*
106	* @todo This needs reviewing against the linux packages.
107	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
108	* the time being we're building the linux packages with SharedLib pointing to
109	* AppPrivArch (lazy bird).
110	*/
111	static SUPINSTFILE const g_aSupInstallFiles[] =
112	{
113	/* type, dir, fOpt, "pszFile" */
114	/* ---------------------------------------------------------------------- */
115	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
116	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
117	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
118
119	#ifdef VBOX_WITH_RAW_MODE
120	{ kSupIFT_Rc, kSupID_AppPrivArch, false, "VMMGC.gc" },
121	{ kSupIFT_Rc, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
122	{ kSupIFT_Rc, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
123	#endif
124
125	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
126	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
127	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
128	#if HC_ARCH_BITS == 32
129	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
130	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
131	#endif
132	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
133	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
134	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
135
136	//#ifdef VBOX_WITH_DEBUGGER_GUI
137	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
138	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
139	//#endif
140
141	//#ifdef VBOX_WITH_SHARED_CLIPBOARD
142	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
143	//#endif
144	//#ifdef VBOX_WITH_SHARED_FOLDERS
145	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
146	//#endif
147	//#ifdef VBOX_WITH_DRAG_AND_DROP
148	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxDragAndDropSvc" SUPLIB_DLL_SUFF },
149	//#endif
150	//#ifdef VBOX_WITH_GUEST_PROPS
151	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
152	//#endif
153	//#ifdef VBOX_WITH_GUEST_CONTROL
154	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestControlSvc" SUPLIB_DLL_SUFF },
155	//#endif
156	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHostChannel" SUPLIB_DLL_SUFF },
157	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
158	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
159	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
160	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
161
162	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
163
164	#ifdef VBOX_WITH_MAIN
165	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
166	#ifdef RT_OS_WINDOWS
167	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxC" SUPLIB_DLL_SUFF },
168	#else
169	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
170	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
171	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
172	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
173	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
174	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
175	#endif
176	#endif
177
178	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
179	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxAuth" SUPLIB_DLL_SUFF },
180	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
181
182	//#ifdef VBOX_WITH_HEADLESS
183	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
184	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
185	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxVideoRecFB" SUPLIB_DLL_SUFF },
186	//#endif
187
188	//#ifdef VBOX_WITH_QTGUI
189	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
190	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
191	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
192	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
193	# endif
194	//#endif
195
196	//#ifdef VBOX_WITH_VBOXSDL
197	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
198	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
199	//#endif
200
201	//#ifdef VBOX_WITH_WEBSERVICES
202	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
203	//#endif
204
205	#ifdef RT_OS_LINUX
206	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
207	#endif
208
209	//#ifdef VBOX_WITH_NETFLT
210	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
211	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
212	//#endif
213
214	//#ifdef VBOX_WITH_LWIP_NAT
215	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetNAT" SUPLIB_EXE_SUFF },
216	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetNAT" SUPLIB_DLL_SUFF },
217	//#endif
218	};
219
220
221	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
222	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
223
224	/** Array index by install directory specifier containing info about verified directories. */
225	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
226
227
228	/**
229	* Assembles the path to a directory.
230	*
231	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
232	* decides whether it returns or not).
233	*
234	* @param enmDir The directory.
235	* @param pszDst Where to assemble the path.
236	* @param cchDst The size of the buffer.
237	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
238	*/
239	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
240	{
241	int rc;
242	switch (enmDir)
243	{
244	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
245	case kSupID_Bin:
246	rc = supR3HardenedPathExecDir(pszDst, cchDst);
247	break;
248	case kSupID_SharedLib:
249	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
250	break;
251	case kSupID_AppPrivArch:
252	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
253	break;
254	case kSupID_AppPrivArchComp:
255	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
256	if (RT_SUCCESS(rc))
257	{
258	size_t off = suplibHardenedStrLen(pszDst);
259	if (cchDst - off >= sizeof("/components"))
260	suplibHardenedMemCopy(&pszDst[off], "/components", sizeof("/components"));
261	else
262	rc = VERR_BUFFER_OVERFLOW;
263	}
264	break;
265	case kSupID_AppPrivNoArch:
266	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
267	break;
268	default:
269	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
270	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
271	}
272	if (RT_FAILURE(rc))
273	supR3HardenedError(rc, fFatal,
274	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
275	return rc;
276	}
277
278
279
280	/**
281	* Assembles the path to a file table entry, with or without the actual filename.
282	*
283	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
284	* decides whether it returns or not).
285	*
286	* @param pFile The file table entry.
287	* @param pszDst Where to assemble the path.
288	* @param cchDst The size of the buffer.
289	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
290	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
291	*/
292	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
293	{
294	/*
295	* Combine supR3HardenedMakePath and the filename.
296	*/
297	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
298	if (RT_SUCCESS(rc) && fWithFilename)
299	{
300	size_t cchFile = suplibHardenedStrLen(pFile->pszFile);
301	size_t off = suplibHardenedStrLen(pszDst);
302	if (cchDst - off >= cchFile + 2)
303	{
304	pszDst[off++] = '/';
305	suplibHardenedMemCopy(&pszDst[off], pFile->pszFile, cchFile + 1);
306	}
307	else
308	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
309	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
310	pFile->pszFile, (long)off);
311	}
312	return rc;
313	}
314
315
316	/**
317	* Verifies a directory.
318	*
319	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
320	* fFatal is clear and if it's set the function wont return.
321	* @param enmDir The directory specifier.
322	* @param fFatal Whether validation failures should be treated as
323	* fatal (true) or not (false).
324	*/
325	DECLHIDDEN(int) supR3HardenedVerifyFixedDir(SUPINSTDIR enmDir, bool fFatal)
326	{
327	/*
328	* Validate the index just to be on the safe side...
329	*/
330	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
331	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
332	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
333
334	/*
335	* Already validated?
336	*/
337	if (g_aSupVerifiedDirs[enmDir].fValidated)
338	return VINF_SUCCESS; /** @todo revalidate? */
339
340	/* initialize the entry. */
341	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
342	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
343	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
344	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
345	g_aSupVerifiedDirs[enmDir].hDir = -1;
346	g_aSupVerifiedDirs[enmDir].fValidated = false;
347
348	/*
349	* Make the path and open the directory.
350	*/
351	char szPath[RTPATH_MAX];
352	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
353	if (RT_SUCCESS(rc))
354	{
355	#if defined(RT_OS_WINDOWS)
356	HANDLE hDir = CreateFile(szPath,
357	GENERIC_READ,
358	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
359	NULL,
360	OPEN_EXISTING,
361	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
362	NULL);
363	if (hDir != INVALID_HANDLE_VALUE)
364	{
365	/** @todo check the type */
366	/* That's all on windows, for now at least... */
367	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
368	g_aSupVerifiedDirs[enmDir].fValidated = true;
369	}
370	else
371	{
372	int err = GetLastError();
373	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
374	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
375	szPath, err);
376	}
377	#else /* UNIXY */
378	int fd = open(szPath, O_RDONLY, 0);
379	if (fd >= 0)
380	{
381	/*
382	* On unixy systems we'll make sure the directory is owned by root
383	* and not writable by the group and user.
384	*/
385	struct stat st;
386	if (!fstat(fd, &st))
387	{
388
389	if ( st.st_uid == 0
390	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
391	&& S_ISDIR(st.st_mode))
392	{
393	g_aSupVerifiedDirs[enmDir].hDir = fd;
394	g_aSupVerifiedDirs[enmDir].fValidated = true;
395	}
396	else
397	{
398	if (!S_ISDIR(st.st_mode))
399	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
400	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
401	szPath, (long)st.st_uid);
402	else if (st.st_uid)
403	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
404	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
405	szPath, (long)st.st_uid);
406	else
407	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
408	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
409	szPath, (long)st.st_mode);
410	close(fd);
411	}
412	}
413	else
414	{
415	int err = errno;
416	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
417	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
418	szPath, strerror(err), err);
419	close(fd);
420	}
421	}
422	else
423	{
424	int err = errno;
425	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
426	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
427	szPath, strerror(err), err);
428	}
429	#endif /* UNIXY */
430	}
431
432	return rc;
433	}
434
435
436	/**
437	* Verifies a file entry.
438	*
439	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
440	* fFatal is clear and if it's set the function wont return.
441	*
442	* @param iFile The file table index of the file to be verified.
443	* @param fFatal Whether validation failures should be treated as
444	* fatal (true) or not (false).
445	* @param fLeaveFileOpen Whether the file should be left open.
446	*/
447	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
448	{
449	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
450	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
451
452	/*
453	* Already done?
454	*/
455	if (pVerified->fValidated)
456	return VINF_SUCCESS; /** @todo revalidate? */
457
458
459	/* initialize the entry. */
460	if (pVerified->hFile != 0)
461	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
462	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
463	(void *)pVerified->hFile, pFile->pszFile);
464	pVerified->hFile = -1;
465	pVerified->fValidated = false;
466
467	/*
468	* Verify the directory then proceed to open it.
469	* (This'll make sure the directory is opened and that we can (later)
470	* use openat if we wish.)
471	*/
472	int rc = supR3HardenedVerifyFixedDir(pFile->enmDir, fFatal);
473	if (RT_SUCCESS(rc))
474	{
475	char szPath[RTPATH_MAX];
476	rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true /fWithFilename/, fFatal);
477	if (RT_SUCCESS(rc))
478	{
479	#if defined(RT_OS_WINDOWS) /** @todo Need to use WCHAR on windows! */
480	PRTUTF16 pwszPath;
481	rc = RTStrToUtf16(szPath, &pwszPath);
482	if (RT_SUCCESS(rc))
483	{
484	HANDLE hFile = CreateFileW(pwszPath,
485	GENERIC_READ,
486	FILE_SHARE_READ,
487	NULL,
488	OPEN_EXISTING,
489	FILE_ATTRIBUTE_NORMAL,
490	NULL);
491	if (hFile != INVALID_HANDLE_VALUE)
492	{
493	# if defined(VBOX_WITH_HARDENING) && !defined(IN_SUP_R3_STATIC) /* Latter: Not in VBoxCpuReport and friends. */
494
495	char szErr[1024];
496	RTERRINFO ErrInfo;
497	RTErrInfoInit(&ErrInfo, szErr, sizeof(szErr));
498
499	uint32_t fFlags = SUPHNTVI_F_REQUIRE_BUILD_CERT;
500	if (pFile->enmType == kSupIFT_Rc)
501	fFlags \|= SUPHNTVI_F_RC_IMAGE;
502
503	rc = supHardenedWinVerifyImageByHandleNoName(hFile, fFlags, &ErrInfo);
504	if (RT_FAILURE(rc))
505	{
506	rc = supR3HardenedError(rc, fFatal, "supR3HardenedVerifyFileInternal: '%s': Image verify error rc=%Rrc: %s\n",
507	szPath, rc, szErr);
508	CloseHandle(hFile);
509	}
510	else
511	# endif
512	{
513	/* it's valid. */
514	if (fLeaveFileOpen)
515	pVerified->hFile = (intptr_t)hFile;
516	else
517	CloseHandle(hFile);
518	pVerified->fValidated = true;
519	}
520	}
521	else
522	{
523	int err = GetLastError();
524	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
525	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
526	"supR3HardenedVerifyFileInternal: Failed to open '%s': err=%d\n", szPath, err);
527	}
528	RTUtf16Free(pwszPath);
529	}
530	else
531	rc = supR3HardenedError(rc, fFatal, "supR3HardenedVerifyFileInternal: Failed to convert '%s' to UTF-16: %Rrc\n",
532	szPath, rc);
533	#else /* UNIXY */
534	int fd = open(szPath, O_RDONLY, 0);
535	if (fd >= 0)
536	{
537	/*
538	* On unixy systems we'll make sure the directory is owned by root
539	* and not writable by the group and user.
540	*/
541	struct stat st;
542	if (!fstat(fd, &st))
543	{
544	if ( st.st_uid == 0
545	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
546	&& S_ISREG(st.st_mode))
547	{
548	/* it's valid. */
549	if (fLeaveFileOpen)
550	pVerified->hFile = fd;
551	else
552	close(fd);
553	pVerified->fValidated = true;
554	}
555	else
556	{
557	if (!S_ISREG(st.st_mode))
558	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
559	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
560	szPath, (long)st.st_uid);
561	else if (st.st_uid)
562	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
563	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
564	szPath, (long)st.st_uid);
565	else
566	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
567	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
568	szPath, (long)st.st_mode);
569	close(fd);
570	}
571	}
572	else
573	{
574	int err = errno;
575	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
576	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
577	szPath, strerror(err), err);
578	close(fd);
579	}
580	}
581	else
582	{
583	int err = errno;
584	if (!pFile->fOptional \|\| err != ENOENT)
585	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
586	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
587	szPath, strerror(err), err);
588	}
589	#endif /* UNIXY */
590	}
591	}
592
593	return rc;
594	}
595
596
597	/**
598	* Verifies that the specified table entry matches the given filename.
599	*
600	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
601	* error is returned or we terminate the application.
602	*
603	* @param iFile The file table index.
604	* @param pszFilename The filename.
605	* @param fFatal Whether validation failures should be treated as
606	* fatal (true) or not (false).
607	*/
608	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
609	{
610	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
611
612	/*
613	* Construct the full path for the file table entry
614	* and compare it with the specified file.
615	*/
616	char szName[RTPATH_MAX];
617	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
618	if (RT_FAILURE(rc))
619	return rc;
620	if (SUP_COMP_FILENAME(szName, pszFilename))
621	{
622	/*
623	* Normalize the two paths and compare again.
624	*/
625	rc = VERR_NOT_SAME_DEVICE;
626	#if defined(RT_OS_WINDOWS)
627	LPSTR pszIgnored;
628	char szName2[RTPATH_MAX];
629	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
630	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
631	if (!SUP_COMP_FILENAME(szName2, szName))
632	rc = VINF_SUCCESS;
633	#else
634	AssertCompile(RTPATH_MAX >= PATH_MAX);
635	char szName2[RTPATH_MAX];
636	if ( realpath(szName, szName2) != NULL
637	&& realpath(pszFilename, szName) != NULL)
638	if (!SUP_COMP_FILENAME(szName2, szName))
639	rc = VINF_SUCCESS;
640	#endif
641
642	if (RT_FAILURE(rc))
643	{
644	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
645	return supR3HardenedError(rc, fFatal,
646	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
647	pszFilename, szName);
648	}
649	}
650
651	/*
652	* Check more stuff like the stat info if it's an already open file?
653	*/
654
655
656
657	return VINF_SUCCESS;
658	}
659
660
661	/**
662	* Verifies a file.
663	*
664	* @returns VINF_SUCCESS on success.
665	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
666	* On verification failure, an error code will be returned when fFatal is clear,
667	* otherwise the program will be terminated.
668	*
669	* @param pszFilename The filename.
670	* @param fFatal Whether validation failures should be treated as
671	* fatal (true) or not (false).
672	*/
673	DECLHIDDEN(int) supR3HardenedVerifyFixedFile(const char *pszFilename, bool fFatal)
674	{
675	/*
676	* Lookup the file and check if it's the same file.
677	*/
678	const char *pszName = supR3HardenedPathFilename(pszFilename);
679	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
680	if (!SUP_COMP_FILENAME(pszName, g_aSupInstallFiles[iFile].pszFile))
681	{
682	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
683	if (RT_SUCCESS(rc))
684	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
685	return rc;
686	}
687
688	return VERR_NOT_FOUND;
689	}
690
691
692	/**
693	* Verifies a program, worker for supR3HardenedVerifyAll.
694	*
695	* @returns See supR3HardenedVerifyAll.
696	* @param pszProgName See supR3HardenedVerifyAll.
697	* @param fFatal See supR3HardenedVerifyAll.
698	*/
699	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
700	{
701	/*
702	* Search the table looking for the executable and the DLL/DYLIB/SO.
703	*/
704	int rc = VINF_SUCCESS;
705	bool fExe = false;
706	bool fDll = false;
707	size_t const cchProgName = suplibHardenedStrLen(pszProgName);
708	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
709	if (!suplibHardenedStrNCmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
710	{
711	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
712	&& !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
713	{
714	/* This only has to be found (once). */
715	if (fDll)
716	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
717	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
718	fDll = true;
719	}
720	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
721	&& !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
722	{
723	/* Here we'll have to check that the specific program is the same as the entry. */
724	if (fExe)
725	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
726	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
727	fExe = true;
728
729	char szFilename[RTPATH_MAX];
730	int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
731	if (RT_SUCCESS(rc2))
732	{
733	suplibHardenedStrCat(szFilename, "/");
734	suplibHardenedStrCat(szFilename, g_aSupInstallFiles[iFile].pszFile);
735	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
736	}
737	else
738	rc = supR3HardenedError(rc2, fFatal,
739	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
740	}
741	}
742
743	/*
744	* Check the findings.
745	*/
746	if (!fDll && !fExe)
747	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
748	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
749	else if (!fExe)
750	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
751	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
752	else if (!fDll)
753	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
754	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
755	return rc;
756	}
757
758
759	/**
760	* Verifies all the known files.
761	*
762	* @returns VINF_SUCCESS on success.
763	* On verification failure, an error code will be returned when fFatal is clear,
764	* otherwise the program will be terminated.
765	*
766	* @param fFatal Whether validation failures should be treated as
767	* fatal (true) or not (false).
768	* @param fLeaveFilesOpen If set, all the verified files are left open.
769	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
770	* to verify that both the executable and corresponding
771	* DLL/DYLIB/SO are valid.
772	*/
773	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
774	{
775	/*
776	* The verify all the files.
777	*/
778	int rc = VINF_SUCCESS;
779	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
780	{
781	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
782	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
783	rc = rc2;
784	}
785
786	/*
787	* Verify the program name if specified, that is to say, just check that
788	* it's in the table (=> we've already verified it).
789	*/
790	if (pszProgName)
791	{
792	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
793	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
794	rc2 = rc;
795	}
796
797	return rc;
798	}
799
800
801	/**
802	* Copies the N messages into the error buffer and returns @a rc.
803	*
804	* @returns Returns @a rc
805	* @param rc The return code.
806	* @param pErrInfo The error info structure.
807	* @param cMsgs The number of messages in the ellipsis.
808	* @param ... Message parts.
809	*/
810	static int supR3HardenedSetErrorN(int rc, PRTERRINFO pErrInfo, unsigned cMsgs, ...)
811	{
812	if (pErrInfo)
813	{
814	size_t cbErr = pErrInfo->cbMsg;
815	char *pszErr = pErrInfo->pszMsg;
816
817	va_list va;
818	va_start(va, cMsgs);
819	while (cMsgs-- > 0 && cbErr > 0)
820	{
821	const char pszMsg = va_arg(va, const char );
822	size_t cchMsg = VALID_PTR(pszMsg) ? suplibHardenedStrLen(pszMsg) : 0;
823	if (cchMsg >= cbErr)
824	cchMsg = cbErr - 1;
825	suplibHardenedMemCopy(pszErr, pszMsg, cchMsg);
826	pszErr[cchMsg] = '\0';
827	pszErr += cchMsg;
828	cbErr -= cchMsg;
829	}
830	va_end(va);
831
832	pErrInfo->rc = rc;
833	pErrInfo->fFlags \|= RTERRINFO_FLAGS_SET;
834	}
835
836	return rc;
837	}
838
839
840	/**
841	* Copies the three messages into the error buffer and returns @a rc.
842	*
843	* @returns Returns @a rc
844	* @param rc The return code.
845	* @param pErrInfo The error info structure.
846	* @param pszMsg1 The first message part.
847	* @param pszMsg2 The second message part.
848	* @param pszMsg3 The third message part.
849	*/
850	static int supR3HardenedSetError3(int rc, PRTERRINFO pErrInfo, const char *pszMsg1,
851	const char pszMsg2, const char pszMsg3)
852	{
853	return supR3HardenedSetErrorN(rc, pErrInfo, 3, pszMsg1, pszMsg2, pszMsg3);
854	}
855
856	#ifdef SOME_UNUSED_FUNCTION
857
858	/**
859	* Copies the two messages into the error buffer and returns @a rc.
860	*
861	* @returns Returns @a rc
862	* @param rc The return code.
863	* @param pErrInfo The error info structure.
864	* @param pszMsg1 The first message part.
865	* @param pszMsg2 The second message part.
866	*/
867	static int supR3HardenedSetError2(int rc, PRTERRINFO pErrInfo, const char *pszMsg1,
868	const char *pszMsg2)
869	{
870	return supR3HardenedSetErrorN(rc, pErrInfo, 2, pszMsg1, pszMsg2);
871	}
872
873
874	/**
875	* Copies the error message to the error buffer and returns @a rc.
876	*
877	* @returns Returns @a rc
878	* @param rc The return code.
879	* @param pErrInfo The error info structure.
880	* @param pszMsg The message.
881	*/
882	static int supR3HardenedSetError(int rc, PRTERRINFO pErrInfo, const char *pszMsg)
883	{
884	return supR3HardenedSetErrorN(rc, pErrInfo, 1, pszMsg);
885	}
886
887	#endif /* SOME_UNUSED_FUNCTION */
888
889	/**
890	* Output from a successfull supR3HardenedVerifyPathSanity call.
891	*/
892	typedef struct SUPR3HARDENEDPATHINFO
893	{
894	/** The length of the path in szCopy. */
895	uint16_t cch;
896	/** The number of path components. */
897	uint16_t cComponents;
898	/** Set if the path ends with slash, indicating that it's a directory
899	* reference and not a file reference. The slash has been removed from
900	* the copy. */
901	bool fDirSlash;
902	/** The offset where each path component starts, i.e. the char after the
903	* slash. The array has cComponents + 1 entries, where the final one is
904	* cch + 1 so that one can always terminate the current component by
905	* szPath[aoffComponent[i] - 1] = '\0'. */
906	uint16_t aoffComponents[32+1];
907	/** A normalized copy of the path.
908	* Reserve some extra space so we can be more relaxed about overflow
909	* checks and terminator paddings, especially when recursing. */
910	char szPath[SUPR3HARDENED_MAX_PATH * 2];
911	} SUPR3HARDENEDPATHINFO;
912	/** Pointer to a parsed path. */
913	typedef SUPR3HARDENEDPATHINFO *PSUPR3HARDENEDPATHINFO;
914
915
916	/**
917	* Verifies that the path is absolutely sane, it also parses the path.
918	*
919	* A sane path starts at the root (w/ drive letter on DOS derived systems) and
920	* does not have any relative bits (/../) or unnecessary slashes (/bin//ls).
921	* Sane paths are less or equal to SUPR3HARDENED_MAX_PATH bytes in length. UNC
922	* paths are not supported.
923	*
924	* @returns VBox status code.
925	* @param pszPath The path to check.
926	* @param pErrInfo The error info structure.
927	* @param pInfo Where to return a copy of the path along with
928	* parsing information.
929	*/
930	static int supR3HardenedVerifyPathSanity(const char *pszPath, PRTERRINFO pErrInfo, PSUPR3HARDENEDPATHINFO pInfo)
931	{
932	const char *pszSrc = pszPath;
933	char *pszDst = pInfo->szPath;
934
935	/*
936	* Check that it's an absolute path and copy the volume/root specifier.
937	*/
938	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
939	if ( !RT_C_IS_ALPHA(pszSrc[0])
940	\|\| pszSrc[1] != ':'
941	\|\| !RTPATH_IS_SLASH(pszSrc[2]))
942	return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo, "The path is not absolute: '", pszPath, "'");
943
944	*pszDst++ = RT_C_TO_UPPER(pszSrc[0]);
945	*pszDst++ = ':';
946	*pszDst++ = RTPATH_SLASH;
947	pszSrc += 3;
948
949	#else
950	if (!RTPATH_IS_SLASH(pszSrc[0]))
951	return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo, "The path is not absolute: '", pszPath, "'");
952
953	*pszDst++ = RTPATH_SLASH;
954	pszSrc += 1;
955	#endif
956
957	/*
958	* No path specifying the root or something very shortly thereafter will
959	* be approved of.
960	*/
961	if (pszSrc[0] == '\0')
962	return supR3HardenedSetError3(VERR_SUPLIB_PATH_IS_ROOT, pErrInfo, "The path is root: '", pszPath, "'");
963	if ( pszSrc[1] == '\0'
964	\|\| pszSrc[2] == '\0')
965	return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_SHORT, pErrInfo, "The path is too short: '", pszPath, "'");
966
967	/*
968	* Check each component. No parent references or double slashes.
969	*/
970	pInfo->cComponents = 0;
971	pInfo->fDirSlash = false;
972	while (pszSrc[0])
973	{
974	/* Sanity checks. */
975	if (RTPATH_IS_SLASH(pszSrc[0])) /* can be relaxed if we care. */
976	return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_CLEAN, pErrInfo,
977	"The path is not clean of double slashes: '", pszPath, "'");
978	if ( pszSrc[0] == '.'
979	&& pszSrc[1] == '.'
980	&& RTPATH_IS_SLASH(pszSrc[2]))
981	return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo,
982	"The path is not absolute: '", pszPath, "'");
983
984	/* Record the start of the component. */
985	if (pInfo->cComponents >= RT_ELEMENTS(pInfo->aoffComponents) - 1)
986	return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_MANY_COMPONENTS, pErrInfo,
987	"The path has too many components: '", pszPath, "'");
988	pInfo->aoffComponents[pInfo->cComponents++] = pszDst - &pInfo->szPath[0];
989
990	/* Traverse to the end of the component, copying it as we go along. */
991	while (pszSrc[0])
992	{
993	if (RTPATH_IS_SLASH(pszSrc[0]))
994	{
995	pszSrc++;
996	if (*pszSrc)
997	*pszDst++ = RTPATH_SLASH;
998	else
999	pInfo->fDirSlash = true;
1000	break;
1001	}
1002	pszDst++ = pszSrc++;
1003	if ((uintptr_t)(pszDst - &pInfo->szPath[0]) >= SUPR3HARDENED_MAX_PATH)
1004	return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_LONG, pErrInfo,
1005	"The path is too long: '", pszPath, "'");
1006	}
1007	}
1008
1009	/* Terminate the string and enter its length. */
1010	pszDst[0] = '\0';
1011	pszDst[1] = '\0'; /* for aoffComponents */
1012	pInfo->cch = (uint16_t)(pszDst - &pInfo->szPath[0]);
1013	pInfo->aoffComponents[pInfo->cComponents] = pInfo->cch + 1;
1014
1015	return VINF_SUCCESS;
1016	}
1017
1018
1019	/**
1020	* The state information collected by supR3HardenedVerifyFsObject.
1021	*
1022	* This can be used to verify that a directory we've opened for enumeration is
1023	* the same as the one that supR3HardenedVerifyFsObject just verified. It can
1024	* equally be used to verify a native specfied by the user.
1025	*/
1026	typedef struct SUPR3HARDENEDFSOBJSTATE
1027	{
1028	#ifdef RT_OS_WINDOWS
1029	/** Not implemented for windows yet. */
1030	char chTodo;
1031	#else
1032	/** The stat output. */
1033	struct stat Stat;
1034	#endif
1035	} SUPR3HARDENEDFSOBJSTATE;
1036	/** Pointer to a file system object state. */
1037	typedef SUPR3HARDENEDFSOBJSTATE *PSUPR3HARDENEDFSOBJSTATE;
1038	/** Pointer to a const file system object state. */
1039	typedef SUPR3HARDENEDFSOBJSTATE const *PCSUPR3HARDENEDFSOBJSTATE;
1040
1041
1042	/**
1043	* Query information about a file system object by path.
1044	*
1045	* @returns VBox status code, error buffer filled on failure.
1046	* @param pszPath The path to the object.
1047	* @param pFsObjState Where to return the state information.
1048	* @param pErrInfo The error info structure.
1049	*/
1050	static int supR3HardenedQueryFsObjectByPath(char const *pszPath, PSUPR3HARDENEDFSOBJSTATE pFsObjState, PRTERRINFO pErrInfo)
1051	{
1052	#if defined(RT_OS_WINDOWS)
1053	/** @todo Windows hardening. */
1054	pFsObjState->chTodo = 0;
1055	return VINF_SUCCESS;
1056
1057	#else
1058	/*
1059	* Stat the object, do not follow links.
1060	*/
1061	if (lstat(pszPath, &pFsObjState->Stat) != 0)
1062	{
1063	/* Ignore access errors */
1064	if (errno != EACCES)
1065	return supR3HardenedSetErrorN(VERR_SUPLIB_STAT_FAILED, pErrInfo,
1066	5, "stat failed with ", strerror(errno), " on: '", pszPath, "'");
1067	}
1068
1069	/*
1070	* Read ACLs.
1071	*/
1072	/** @todo */
1073
1074	return VINF_SUCCESS;
1075	#endif
1076	}
1077
1078
1079	/**
1080	* Query information about a file system object by native handle.
1081	*
1082	* @returns VBox status code, error buffer filled on failure.
1083	* @param hNative The native handle to the object @a pszPath
1084	* specifies and this should be verified to be the
1085	* same file system object.
1086	* @param pFsObjState Where to return the state information.
1087	* @param pszPath The path to the object. (For the error message
1088	* only.)
1089	* @param pErrInfo The error info structure.
1090	*/
1091	static int supR3HardenedQueryFsObjectByHandle(RTHCUINTPTR hNative, PSUPR3HARDENEDFSOBJSTATE pFsObjState,
1092	char const *pszPath, PRTERRINFO pErrInfo)
1093	{
1094	#if defined(RT_OS_WINDOWS)
1095	/** @todo Windows hardening. */
1096	pFsObjState->chTodo = 0;
1097	return VINF_SUCCESS;
1098
1099	#else
1100	/*
1101	* Stat the object, do not follow links.
1102	*/
1103	if (fstat((int)hNative, &pFsObjState->Stat) != 0)
1104	return supR3HardenedSetErrorN(VERR_SUPLIB_STAT_FAILED, pErrInfo,
1105	5, "fstat failed with ", strerror(errno), " on '", pszPath, "'");
1106
1107	/*
1108	* Read ACLs.
1109	*/
1110	/** @todo */
1111
1112	return VINF_SUCCESS;
1113	#endif
1114	}
1115
1116
1117	/**
1118	* Verifies that the file system object indicated by the native handle is the
1119	* same as the one @a pFsObjState indicates.
1120	*
1121	* @returns VBox status code, error buffer filled on failure.
1122	* @param pFsObjState1 File system object information/state by path.
1123	* @param pFsObjState2 File system object information/state by handle.
1124	* @param pszPath The path to the object @a pFsObjState
1125	* describes. (For the error message.)
1126	* @param pErrInfo The error info structure.
1127	*/
1128	static int supR3HardenedIsSameFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState1, PCSUPR3HARDENEDFSOBJSTATE pFsObjState2,
1129	const char *pszPath, PRTERRINFO pErrInfo)
1130	{
1131	#if defined(RT_OS_WINDOWS)
1132	/** @todo Windows hardening. */
1133	return VINF_SUCCESS;
1134
1135	#elif defined(RT_OS_OS2)
1136	return VINF_SUCCESS;
1137
1138	#else
1139	/*
1140	* Compare the ino+dev, then the uid+gid and finally the important mode
1141	* bits. Technically the first one should be enough, but we're paranoid.
1142	*/
1143	if ( pFsObjState1->Stat.st_ino != pFsObjState2->Stat.st_ino
1144	\|\| pFsObjState1->Stat.st_dev != pFsObjState2->Stat.st_dev)
1145	return supR3HardenedSetError3(VERR_SUPLIB_NOT_SAME_OBJECT, pErrInfo,
1146	"The native handle is not the same as '", pszPath, "' (ino/dev)");
1147	if ( pFsObjState1->Stat.st_uid != pFsObjState2->Stat.st_uid
1148	\|\| pFsObjState1->Stat.st_gid != pFsObjState2->Stat.st_gid)
1149	return supR3HardenedSetError3(VERR_SUPLIB_NOT_SAME_OBJECT, pErrInfo,
1150	"The native handle is not the same as '", pszPath, "' (uid/gid)");
1151	if ( (pFsObjState1->Stat.st_mode & (S_IFMT \| S_IWUSR \| S_IWGRP \| S_IWOTH))
1152	!= (pFsObjState2->Stat.st_mode & (S_IFMT \| S_IWUSR \| S_IWGRP \| S_IWOTH)))
1153	return supR3HardenedSetError3(VERR_SUPLIB_NOT_SAME_OBJECT, pErrInfo,
1154	"The native handle is not the same as '", pszPath, "' (mode)");
1155	return VINF_SUCCESS;
1156	#endif
1157	}
1158
1159
1160	/**
1161	* Verifies a file system object (file or directory).
1162	*
1163	* @returns VBox status code, error buffer filled on failure.
1164	* @param pFsObjState The file system object information/state to be
1165	* verified.
1166	* @param fDir Whether this is a directory or a file.
1167	* @param fRelaxed Whether we can be more relaxed about this
1168	* directory (only used for grand parent
1169	* directories).
1170	* @param pszPath The path to the object. For error messages and
1171	* securing a couple of hacks.
1172	* @param pErrInfo The error info structure.
1173	*/
1174	static int supR3HardenedVerifyFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState, bool fDir, bool fRelaxed,
1175	const char *pszPath, PRTERRINFO pErrInfo)
1176	{
1177	#if defined(RT_OS_WINDOWS)
1178	/** @todo Windows hardening. */
1179	NOREF(pFsObjState); NOREF(fDir); NOREF(fRelaxed); NOREF(pszPath); NOREF(pErrInfo);
1180	return VINF_SUCCESS;
1181
1182	#elif defined(RT_OS_OS2)
1183	/* No hardening here - it's a single user system. */
1184	NOREF(pFsObjState); NOREF(fDir); NOREF(fRelaxed); NOREF(pszPath); NOREF(pErrInfo);
1185	return VINF_SUCCESS;
1186
1187	#else
1188	/*
1189	* The owner must be root.
1190	*
1191	* This can be extended to include predefined system users if necessary.
1192	*/
1193	if (pFsObjState->Stat.st_uid != 0)
1194	return supR3HardenedSetError3(VERR_SUPLIB_OWNER_NOT_ROOT, pErrInfo, "The owner is not root: '", pszPath, "'");
1195
1196	/*
1197	* The object type must be directory or file, no symbolic links or other
1198	* risky stuff (sorry dude, but we're paranoid on purpose here).
1199	*/
1200	if ( !S_ISDIR(pFsObjState->Stat.st_mode)
1201	&& !S_ISREG(pFsObjState->Stat.st_mode))
1202	{
1203	if (S_ISLNK(pFsObjState->Stat.st_mode))
1204	return supR3HardenedSetError3(VERR_SUPLIB_SYMLINKS_ARE_NOT_PERMITTED, pErrInfo,
1205	"Symlinks are not permitted: '", pszPath, "'");
1206	return supR3HardenedSetError3(VERR_SUPLIB_NOT_DIR_NOT_FILE, pErrInfo,
1207	"Not regular file or directory: '", pszPath, "'");
1208	}
1209	if (fDir != !!S_ISDIR(pFsObjState->Stat.st_mode))
1210	{
1211	if (S_ISDIR(pFsObjState->Stat.st_mode))
1212	return supR3HardenedSetError3(VERR_SUPLIB_IS_DIRECTORY, pErrInfo,
1213	"Expected file but found directory: '", pszPath, "'");
1214	return supR3HardenedSetError3(VERR_SUPLIB_IS_FILE, pErrInfo,
1215	"Expected directory but found file: '", pszPath, "'");
1216	}
1217
1218	/*
1219	* The group does not matter if it does not have write access, if it has
1220	* write access it must be group 0 (root/wheel/whatever).
1221	*
1222	* This can be extended to include predefined system groups or groups that
1223	* only root is member of.
1224	*/
1225	if ( (pFsObjState->Stat.st_mode & S_IWGRP)
1226	&& pFsObjState->Stat.st_gid != 0)
1227	{
1228	#ifdef RT_OS_DARWIN
1229	/* HACK ALERT: On Darwin /Applications is root:admin with admin having
1230	full access. So, to work around we relax the hardening a bit and
1231	permit grand parents and beyond to be group writable by admin. */
1232	/** @todo dynamically resolve the admin group? */
1233	bool fBad = !fRelaxed \|\| pFsObjState->Stat.st_gid != 80 /admin/ \|\| suplibHardenedStrCmp(pszPath, "/Applications");
1234
1235	#elif defined(RT_OS_FREEBSD)
1236	/* HACK ALERT: PC-BSD 9 has group-writable /usr/pib directory which is
1237	similar to /Applications on OS X (see above).
1238	On FreeBSD root is normally the only member of this group, on
1239	PC-BSD the default user is a member. */
1240	/** @todo dynamically resolve the operator group? */
1241	bool fBad = !fRelaxed \|\| pFsObjState->Stat.st_gid != 5 /operator/ \|\| suplibHardenedStrCmp(pszPath, "/usr/pbi");
1242	NOREF(fRelaxed);
1243	#else
1244	NOREF(fRelaxed);
1245	bool fBad = true;
1246	#endif
1247	if (fBad)
1248	return supR3HardenedSetError3(VERR_SUPLIB_WRITE_NON_SYS_GROUP, pErrInfo,
1249	"The group is not a system group and it has write access to '", pszPath, "'");
1250	}
1251
1252	/*
1253	* World must not have write access. There is no relaxing this rule.
1254	*/
1255	if (pFsObjState->Stat.st_mode & S_IWOTH)
1256	return supR3HardenedSetError3(VERR_SUPLIB_WORLD_WRITABLE, pErrInfo,
1257	"World writable: '", pszPath, "'");
1258
1259	/*
1260	* Check the ACLs.
1261	*/
1262	/** @todo */
1263
1264	return VINF_SUCCESS;
1265	#endif
1266	}
1267
1268
1269	/**
1270	* Verifies that the file system object indicated by the native handle is the
1271	* same as the one @a pFsObjState indicates.
1272	*
1273	* @returns VBox status code, error buffer filled on failure.
1274	* @param hNative The native handle to the object @a pszPath
1275	* specifies and this should be verified to be the
1276	* same file system object.
1277	* @param pFsObjState The information/state returned by a previous
1278	* query call.
1279	* @param pszPath The path to the object @a pFsObjState
1280	* describes. (For the error message.)
1281	* @param pErrInfo The error info structure.
1282	*/
1283	static int supR3HardenedVerifySameFsObject(RTHCUINTPTR hNative, PCSUPR3HARDENEDFSOBJSTATE pFsObjState,
1284	const char *pszPath, PRTERRINFO pErrInfo)
1285	{
1286	SUPR3HARDENEDFSOBJSTATE FsObjState2;
1287	int rc = supR3HardenedQueryFsObjectByHandle(hNative, &FsObjState2, pszPath, pErrInfo);
1288	if (RT_SUCCESS(rc))
1289	rc = supR3HardenedIsSameFsObject(pFsObjState, &FsObjState2, pszPath, pErrInfo);
1290	return rc;
1291	}
1292
1293
1294	/**
1295	* Does the recursive directory enumeration.
1296	*
1297	* @returns VBox status code, error buffer filled on failure.
1298	* @param pszDirPath The path buffer containing the subdirectory to
1299	* enumerate followed by a slash (this is never
1300	* the root slash). The buffer is RTPATH_MAX in
1301	* size and anything starting at @a cchDirPath
1302	* - 1 and beyond is scratch space.
1303	* @param cchDirPath The length of the directory path + slash.
1304	* @param pFsObjState Pointer to the file system object state buffer.
1305	* On input this will hold the stats for
1306	* the directory @a pszDirPath indicates and will
1307	* be used to verified that we're opening the same
1308	* thing.
1309	* @param fRecursive Whether to recurse into subdirectories.
1310	* @param pErrInfo The error info structure.
1311	*/
1312	static int supR3HardenedVerifyDirRecursive(char *pszDirPath, size_t cchDirPath, PSUPR3HARDENEDFSOBJSTATE pFsObjState,
1313	bool fRecursive, PRTERRINFO pErrInfo)
1314	{
1315	#if defined(RT_OS_WINDOWS)
1316	/** @todo Windows hardening. */
1317	return VINF_SUCCESS;
1318
1319	#elif defined(RT_OS_OS2)
1320	/* No hardening here - it's a single user system. */
1321	return VINF_SUCCESS;
1322
1323	#else
1324	/*
1325	* Open the directory. Now, we could probably eliminate opendir here
1326	* and go down on kernel API level (open + getdents for instance), however
1327	* that's not very portable and hopefully not necessary.
1328	*/
1329	DIR *pDir = opendir(pszDirPath);
1330	if (!pDir)
1331	{
1332	/* Ignore access errors. */
1333	if (errno == EACCES)
1334	return VINF_SUCCESS;
1335	return supR3HardenedSetErrorN(VERR_SUPLIB_DIR_ENUM_FAILED, pErrInfo,
1336	5, "opendir failed with ", strerror(errno), " on '", pszDirPath, "'");
1337	}
1338	if (dirfd(pDir) != -1)
1339	{
1340	int rc = supR3HardenedVerifySameFsObject(dirfd(pDir), pFsObjState, pszDirPath, pErrInfo);
1341	if (RT_FAILURE(rc))
1342	{
1343	closedir(pDir);
1344	return rc;
1345	}
1346	}
1347
1348	/*
1349	* Enumerate the directory, check all the requested bits.
1350	*/
1351	int rc = VINF_SUCCESS;
1352	for (;;)
1353	{
1354	pszDirPath[cchDirPath] = '\0'; /* for error messages. */
1355
1356	struct dirent Entry;
1357	struct dirent *pEntry;
1358	int iErr = readdir_r(pDir, &Entry, &pEntry);
1359	if (iErr)
1360	{
1361	rc = supR3HardenedSetErrorN(VERR_SUPLIB_DIR_ENUM_FAILED, pErrInfo,
1362	5, "readdir_r failed with ", strerror(iErr), " in '", pszDirPath, "'");
1363	break;
1364	}
1365	if (!pEntry)
1366	break;
1367
1368	/*
1369	* Check the length and copy it into the path buffer so it can be
1370	* stat()'ed.
1371	*/
1372	size_t cchName = suplibHardenedStrLen(pEntry->d_name);
1373	if (cchName + cchDirPath > SUPR3HARDENED_MAX_PATH)
1374	{
1375	rc = supR3HardenedSetErrorN(VERR_SUPLIB_PATH_TOO_LONG, pErrInfo,
1376	4, "Path grew too long during recursion: '", pszDirPath, pEntry->d_name, "'");
1377	break;
1378	}
1379	suplibHardenedMemCopy(&pszDirPath[cchName], pEntry->d_name, cchName + 1);
1380
1381	/*
1382	* Query the information about the entry and verify it.
1383	* (We don't bother skipping '.' and '..' at this point, a little bit
1384	* of extra checks doesn't hurt and neither requires relaxed handling.)
1385	*/
1386	rc = supR3HardenedQueryFsObjectByPath(pszDirPath, pFsObjState, pErrInfo);
1387	if (RT_SUCCESS(rc))
1388	break;
1389	rc = supR3HardenedVerifyFsObject(pFsObjState, S_ISDIR(pFsObjState->Stat.st_mode), false /fRelaxed/,
1390	pszDirPath, pErrInfo);
1391	if (RT_FAILURE(rc))
1392	break;
1393
1394	/*
1395	* Recurse into subdirectories if requested.
1396	*/
1397	if ( fRecursive
1398	&& S_ISDIR(pFsObjState->Stat.st_mode)
1399	&& suplibHardenedStrCmp(pEntry->d_name, ".")
1400	&& suplibHardenedStrCmp(pEntry->d_name, ".."))
1401	{
1402	pszDirPath[cchDirPath + cchName] = RTPATH_SLASH;
1403	pszDirPath[cchDirPath + cchName + 1] = '\0';
1404
1405	rc = supR3HardenedVerifyDirRecursive(pszDirPath, cchDirPath + cchName + 1, pFsObjState,
1406	fRecursive, pErrInfo);
1407	if (RT_FAILURE(rc))
1408	break;
1409	}
1410	}
1411
1412	closedir(pDir);
1413	return VINF_SUCCESS;
1414	#endif
1415	}
1416
1417
1418	/**
1419	* Worker for SUPR3HardenedVerifyDir.
1420	*
1421	* @returns See SUPR3HardenedVerifyDir.
1422	* @param pszDirPath See SUPR3HardenedVerifyDir.
1423	* @param fRecursive See SUPR3HardenedVerifyDir.
1424	* @param fCheckFiles See SUPR3HardenedVerifyDir.
1425	* @param pErrInfo See SUPR3HardenedVerifyDir.
1426	*/
1427	DECLHIDDEN(int) supR3HardenedVerifyDir(const char *pszDirPath, bool fRecursive, bool fCheckFiles, PRTERRINFO pErrInfo)
1428	{
1429	/*
1430	* Validate the input path and parse it.
1431	*/
1432	SUPR3HARDENEDPATHINFO Info;
1433	int rc = supR3HardenedVerifyPathSanity(pszDirPath, pErrInfo, &Info);
1434	if (RT_FAILURE(rc))
1435	return rc;
1436
1437	/*
1438	* Verify each component from the root up.
1439	*/
1440	SUPR3HARDENEDFSOBJSTATE FsObjState;
1441	uint32_t const cComponents = Info.cComponents;
1442	for (uint32_t iComponent = 0; iComponent < cComponents; iComponent++)
1443	{
1444	bool fRelaxed = iComponent + 2 < cComponents;
1445	Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = '\0';
1446	rc = supR3HardenedQueryFsObjectByPath(Info.szPath, &FsObjState, pErrInfo);
1447	if (RT_SUCCESS(rc))
1448	rc = supR3HardenedVerifyFsObject(&FsObjState, true /fDir/, fRelaxed, Info.szPath, pErrInfo);
1449	if (RT_FAILURE(rc))
1450	return rc;
1451	Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = iComponent + 1 != cComponents ? RTPATH_SLASH : '\0';
1452	}
1453
1454	/*
1455	* Check files and subdirectories if requested.
1456	*/
1457	if (fCheckFiles \|\| fRecursive)
1458	{
1459	Info.szPath[Info.cch] = RTPATH_SLASH;
1460	Info.szPath[Info.cch + 1] = '\0';
1461	return supR3HardenedVerifyDirRecursive(Info.szPath, Info.cch + 1, &FsObjState,
1462	fRecursive, pErrInfo);
1463	}
1464
1465	return VINF_SUCCESS;
1466	}
1467
1468
1469	/**
1470	* Verfies a file.
1471	*
1472	* @returns VBox status code, error buffer filled on failure.
1473	* @param pszFilename The file to verify.
1474	* @param hNativeFile Handle to the file, verify that it's the same
1475	* as we ended up with when verifying the path.
1476	* RTHCUINTPTR_MAX means NIL here.
1477	* @param fMaybe3rdParty Set if the file is could be a supplied by a
1478	* third party. Different validation rules may
1479	* apply to 3rd party code on some platforms.
1480	* @param pErrInfo Where to return extended error information.
1481	* Optional.
1482	*/
1483	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, RTHCUINTPTR hNativeFile,
1484	bool fMaybe3rdParty, PRTERRINFO pErrInfo)
1485	{
1486	/*
1487	* Validate the input path and parse it.
1488	*/
1489	SUPR3HARDENEDPATHINFO Info;
1490	int rc = supR3HardenedVerifyPathSanity(pszFilename, pErrInfo, &Info);
1491	if (RT_FAILURE(rc))
1492	return rc;
1493	if (Info.fDirSlash)
1494	return supR3HardenedSetError3(VERR_SUPLIB_IS_DIRECTORY, pErrInfo,
1495	"The file path specifies a directory: '", pszFilename, "'");
1496
1497	/*
1498	* Verify each component from the root up.
1499	*/
1500	SUPR3HARDENEDFSOBJSTATE FsObjState;
1501	uint32_t const cComponents = Info.cComponents;
1502	for (uint32_t iComponent = 0; iComponent < cComponents; iComponent++)
1503	{
1504	bool fFinal = iComponent + 1 == cComponents;
1505	bool fRelaxed = iComponent + 2 < cComponents;
1506	Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = '\0';
1507	rc = supR3HardenedQueryFsObjectByPath(Info.szPath, &FsObjState, pErrInfo);
1508	if (RT_SUCCESS(rc))
1509	rc = supR3HardenedVerifyFsObject(&FsObjState, !fFinal /fDir/, fRelaxed, Info.szPath, pErrInfo);
1510	if (RT_FAILURE(rc))
1511	return rc;
1512	Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = !fFinal ? RTPATH_SLASH : '\0';
1513	}
1514
1515	/*
1516	* Verify the file handle against the last component, if specified.
1517	*/
1518	if (hNativeFile != RTHCUINTPTR_MAX)
1519	{
1520	rc = supR3HardenedVerifySameFsObject(hNativeFile, &FsObjState, Info.szPath, pErrInfo);
1521	if (RT_FAILURE(rc))
1522	return rc;
1523	}
1524
1525	#ifdef RT_OS_WINDOWS
1526	/*
1527	* The files shall be signed on windows, verify that.
1528	*/
1529	HANDLE hVerify;
1530	if (hNativeFile == RTHCUINTPTR_MAX)
1531	hVerify = CreateFile(pszFilename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1532	else if (!DuplicateHandle(GetCurrentProcess(), (HANDLE)hNativeFile, GetCurrentProcess(), &hVerify,
1533	GENERIC_READ, false /bInheritHandle/, 0 /dwOptions/))
1534	hVerify = INVALID_HANDLE_VALUE;
1535	if (hVerify != INVALID_HANDLE_VALUE)
1536	{
1537	# ifdef VBOX_WITH_HARDENING
1538	uint32_t fFlags = SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING;
1539	if (!fMaybe3rdParty)
1540	fFlags = SUPHNTVI_F_REQUIRE_BUILD_CERT;
1541	const char *pszSuffix = RTPathSuffix(pszFilename);
1542	if ( pszSuffix
1543	&& pszSuffix[0] == '.'
1544	&& ( RT_C_TO_LOWER(pszSuffix[1]) == 'r'
1545	\|\| RT_C_TO_LOWER(pszSuffix[1]) == 'g')
1546	&& RT_C_TO_LOWER(pszSuffix[2]) == 'c'
1547	&& pszSuffix[3] == '\0' )
1548	fFlags \|= SUPHNTVI_F_RC_IMAGE;
1549	# ifndef IN_SUP_R3_STATIC /* Not in VBoxCpuReport and friends. */
1550	rc = supHardenedWinVerifyImageByHandleNoName(hVerify, fFlags, pErrInfo);
1551	# endif
1552	# endif
1553	CloseHandle(hVerify);
1554	}
1555	else
1556	rc = RTErrInfoSetF(pErrInfo, RTErrConvertFromWin32(GetLastError()),
1557	"Error %u trying to open (or duplicate handle for) '%s'", GetLastError(), pszFilename);
1558	if (RT_FAILURE(rc))
1559	return rc;
1560	#endif
1561
1562	return VINF_SUCCESS;
1563	}
1564
1565
1566	/**
1567	* Gets the pre-init data for the hand-over to the other version
1568	* of this code.
1569	*
1570	* The reason why we pass this information on is that it contains
1571	* open directories and files. Later it may include even more info
1572	* (int the verified arrays mostly).
1573	*
1574	* The receiver is supR3HardenedRecvPreInitData.
1575	*
1576	* @param pPreInitData Where to store it.
1577	*/
1578	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
1579	{
1580	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
1581	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
1582	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
1583
1584	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
1585	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
1586	}
1587
1588
1589	/**
1590	* Receives the pre-init data from the static executable stub.
1591	*
1592	* @returns VBox status code. Will not bitch on failure since the
1593	* runtime isn't ready for it, so that is left to the exe stub.
1594	*
1595	* @param pPreInitData The hand-over data.
1596	*/
1597	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
1598	{
1599	/*
1600	* Compare the array lengths and the contents of g_aSupInstallFiles.
1601	*/
1602	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
1603	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
1604	return VERR_VERSION_MISMATCH;
1605	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
1606	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
1607	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
1608	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
1609	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
1610	\|\| suplibHardenedStrCmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
1611	return VERR_VERSION_MISMATCH;
1612
1613	/*
1614	* Check that we're not called out of order.
1615	* If dynamic linking it screwed up, we may end up here.
1616	*/
1617	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
1618	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
1619	return VERR_WRONG_ORDER;
1620
1621	/*
1622	* Copy the verification data over.
1623	*/
1624	suplibHardenedMemCopy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
1625	suplibHardenedMemCopy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
1626	return VINF_SUCCESS;
1627	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 51866

Download in other formats: