Changeset 104261 in vbox for trunk/src/VBox/HostDrivers

Timestamp:

Apr 10, 2024 12:26:37 AM (8 months ago)

Author:

vboxsync

Message:

SUP: Moved the program binary directory check to the right place, replace weird strncmp use with suplibHardenedStrCmp, and make it applicable to all hosts defining RTPATH_APP_PRIVATE_ARCH and therefore expecting the binaries to be installed in a certain location. bugref:10626

File:

• trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp (modified) (2 diffs)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

@@ -1344 +1344 @@
     suplibHardenedStrCopy(g_szSupLibHardenedAppBinPath, g_szSupLibHardenedExePath);
     suplibHardenedPathStripFilename(g_szSupLibHardenedAppBinPath);
-
-    /* Make sure binary is located in known location (unix-like hosts only). */
-#if defined(RT_OS_LINUX) || defined(RT_OS_FREEBSD) || defined(RT_OS_SOLARIS) || defined(RT_OS_DARWIN)
-    if (strncmp(RTPATH_APP_PRIVATE_ARCH, g_szSupLibHardenedAppBinPath, sizeof(RTPATH_APP_PRIVATE_ARCH)) != 0)
-        supR3HardenedFatal("supR3HardenedExecDir: refusing to start binary from unknown location %s\n",
-                           g_szSupLibHardenedAppBinPath);
-#endif
 
     g_offSupLibHardenedExecName = suplibHardenedStrLen(g_szSupLibHardenedAppBinPath);
@@ -1406 +1399 @@
             supR3HardenedFatal("supR3HardenedExecDir: Unknown program binary location: %#x\n", g_fSupHardenedMain);
     }
+
+#ifdef RTPATH_APP_PRIVATE_ARCH
+    /*
+     * If the location is fixed, do not continue if it is not correct. Binaries
+     * must not be allowed to be started from anywhere else.  (@bugref{10626})
+     */
+    if (suplibHardenedStrCmp(g_szSupLibHardenedAppBinPath, RTPATH_APP_PRIVATE_ARCH) != 0)
+        supR3HardenedFatal("supR3HardenedExecDir: Invalid program binary location: %s (expected %s)\n",
+                           g_szSupLibHardenedAppBinPath, RTPATH_APP_PRIVATE_ARCH);
+# ifdef RT_OS_WINDOWS
+#  error "Didn't expect RTPATH_APP_PRIVATE_ARCH to be defined on Windows."
+# endif
+#elif defined(RT_OS_LINUX) || defined(RT_OS_FREEBSD) || defined(RT_OS_SOLARIS) || defined(RT_OS_DARWIN)
+# error "Expected RTPATH_APP_PRIVATE_ARCH to be define on this host."
+#endif
 }