VirtualBox

Changeset 106968 in vbox for trunk/src/VBox


Ignore:
Timestamp:
Nov 12, 2024 4:35:48 PM (3 months ago)
Author:
vboxsync
Message:

SUPHardNt: Slightly relaxed the extension pack signing requirements in hardened builds. Mostly untested. jiraref:VBP-1451

Location:
trunk/src/VBox/HostDrivers/Support
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/HostDrivers/Support/Makefile.kmk

    r106945 r106968  
    120120        TimeRootOracle1=Timestamp-VBoxLegacyWinSha1CA.taf \
    121121        TrustedCertVBox0=Trusted-OracleCorporationVirtualBox-05308b76ac2e15b29720fb4395f65f38.taf \
     122        TrustedCertVBox1=Trusted-OracleAmerica-060e2f8f9e1b8be518d5fe2b69cfccb1.taf \
    122123        AppleRoot0=AppleRoot-2bd06947947609fef46b8d2e40a6f7474d7f085e.taf \
    123124        AppleRoot1=AppleRoot-G2-c499136c1803c27bc0a3a00d7f72807a1c77268d.taf

  • trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp

    r106061 r106968  
    18751875    {
    18761876# ifdef VBOX_WITH_HARDENING
    1877         uint32_t fFlags = SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING;
     1877        /** @todo do we need to validate the fMaybe3rdParty claim here? I.e. only
     1878         *        apply it if 'ExtensionPacks' is part of the path. */
     1879        uint32_t fFlags = SUPHNTVI_F_REQUIRE_CODE_SIGNING;
    18781880        if (!fMaybe3rdParty)
    18791881            fFlags = SUPHNTVI_F_REQUIRE_BUILD_CERT;

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h

    r106061 r106968  
    146146 * was signed with. */
    147147#  define SUPHNTVI_F_REQUIRE_BUILD_CERT             RT_BIT(0)
     148/** The signing certificate must be one the build certificate or one of the
     149 * one used by Oracle to sign the extension pack. */
     150#  define SUPHNTVI_F_REQUIRE_SPECIAL_TRUST_CERT     RT_BIT(1)
     151/** Require regular code signing. */
     152#  define SUPHNTVI_F_REQUIRE_CODE_SIGNING           RT_BIT(2)
    148153/** Require kernel code signing level. */
    149 #  define SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING    RT_BIT(1)
     154#  define SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING    RT_BIT(3)
    150155/** Require the image to force the memory mapper to do signature checking. */
    151 #  define SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT  RT_BIT(2)
     156#  define SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT  RT_BIT(4)
    152157/** Whether to allow image verification by catalog file. */
    153 #  define SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION    RT_BIT(3)
     158#  define SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION    RT_BIT(5)
    154159/** The file owner must be TrustedInstaller, Builtin\\Administrators
    155160 *  (S-1-5-32-544) or local system (S-1-5-21) on Vista+. */
    156 #  define SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER RT_BIT(4)
     161#  define SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER RT_BIT(6)
    157162/** Ignore the image architecture (otherwise it must match the verification
    158163 * code).  Used with resource images and such. */
    … …  
    229234#endif /* IN_RING3 && !VBOX_PERMIT_EVEN_MORE */
    230235extern SUPSYSROOTDIRBUF g_SupLibHardenedExeNtPath;
    231 extern SUPSYSROOTDIRBUF g_SupLibHardenedAppBinNtPath;
    232236
    233237#   ifdef IN_RING0

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

    r106893 r106968  
    130130/** The build certificate. */
    131131static RTCRX509CERTIFICATE  g_BuildX509Cert;
     132
     133/** Store for certificates that we put special trust it, like the build
     134 * certificate and the ones used by the Oracle extension pack. */
     135static RTCRSTORE            g_hSpecialTrustStore = NIL_RTCRSTORE;
    132136
    133137/** Store for root software publisher certificates. */
    … …  
    771775    RT_NOREF1(hLdrMod);
    772776
    773     if (fFlags & (SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING))
     777    if (fFlags & (  SUPHNTVI_F_REQUIRE_BUILD_CERT
     778                  | SUPHNTVI_F_REQUIRE_SPECIAL_TRUST_CERT
     779                  | SUPHNTVI_F_REQUIRE_CODE_SIGNING
     780                  | SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING))
    774781        return rc;
    775782
    … …  
    10421049
    10431050    /*
    1044      * Standard code signing capabilites required.
     1051     * Standard code signing capabilites required (SUPHNTVI_F_REQUIRE_CODE_SIGNING is implied here).
    10451052     */
    10461053    int rc = RTCrPkcs7VerifyCertCallbackCodeSigning(pCert, hCertPaths, fFlags, NULL, pErrInfo);
    … …  
    12011208                                 g_BuildX509Cert.TbsCertificate.SerialNumber.Asn1Core.uData.pv);
    12021209    }
     1210    /** @todo apply these to all signatures, but don't fail in a bad way for
     1211     *        stuff with extra signatures (typically from microsoft). */
     1212    else if (   (pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_SPECIAL_TRUST_CERT)
     1213             && pInfo->iSignature == 0)
     1214    {
     1215        PCRTCRCERTCTX const pCertCtx = RTCrStoreCertByIssuerAndSerialNo(g_hSpecialTrustStore,
     1216                                                                        &pSignerInfo->IssuerAndSerialNumber.Name,
     1217                                                                        &pSignerInfo->IssuerAndSerialNumber.SerialNumber);
     1218        if (!pCertCtx)
     1219            return RTErrInfoSetF(pErrInfo, VERR_SUP_VP_NOT_SIGNED_WITH_SPECIALLY_TRUSTED_CERT,
     1220                                 "Signature #%u/%u: Not signed with the build certificate or any of the specially trusted ones (serial %.*Rhxs)",
     1221                                 pInfo->iSignature + 1, pInfo->cSignatures,
     1222                                 pSignerInfo->IssuerAndSerialNumber.SerialNumber.Asn1Core.cb,
     1223                                 pSignerInfo->IssuerAndSerialNumber.SerialNumber.Asn1Core.uData.pv);
     1224        RTCrCertCtxRelease(pCertCtx);
     1225    }
    12031226
    12041227    /*
    … …  
    12721295
    12731296#ifdef IN_RING3 /* Hack alert! (see above) */
    1274             if ((pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_BUILD_CERT) && g_uBuildTimestampHack == 0 && cTimes > 1)
     1297            if (   (pNtViRdr->fFlags & (SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_REQUIRE_SPECIAL_TRUST_CERT))
     1298                && g_uBuildTimestampHack == 0
     1299                && cTimes > 1)
    12751300                g_uBuildTimestampHack = uTimestamp;
    12761301#endif
    … …  
    13251350
    13261351                /* This leniency is not applicable to build certificate requirements (signature #1 only). */
    1327                 if (  !(pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_BUILD_CERT)
     1352                if (  !(pNtViRdr->fFlags & (SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_REQUIRE_SPECIAL_TRUST_CERT))
    13281353                    || pInfo->iSignature != 0)
    13291354                {
    … …  
    19932018         */
    19942019        rc = supHardNtViCertInit(&g_BuildX509Cert, g_abSUPBuildCert, g_cbSUPBuildCert, pErrInfo, "BuildCertificate");
     2020        SUPTAENTRY const aBuildCerts[1] = { { g_abSUPBuildCert, g_cbSUPBuildCert }, };
     2021        if (RT_SUCCESS(rc))
     2022            rc = supHardNtViCertStoreInit(&g_hSpecialTrustStore,
     2023                                          aBuildCerts, RT_ELEMENTS(aBuildCerts),
     2024                                          g_aSUPTrustedTAs, g_cSUPTrustedTAs,
     2025                                          NULL, 0,
     2026                                          pErrInfo, "SpecialTrustStore");
    19952027        if (RT_SUCCESS(rc))
    19962028            rc = supHardNtViCertStoreInit(&g_hSpcRootStore, g_aSUPSpcRootTAs, g_cSUPSpcRootTAs,
    … …  
    20762108    RTCrStoreRelease(g_hSpcRootStore);
    20772109    g_hSpcRootStore = NIL_RTCRSTORE;
     2110
     2111    RTCrStoreRelease(g_hSpecialTrustStore);
     2112    g_hSpecialTrustStore = NIL_RTCRSTORE;
    20782113}
    20792114

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

    r106897 r106968  
    318318SUPSYSROOTDIRBUF            g_SupLibHardenedExeNtPath;
    319319/** The NT path of the application binary directory. */
    320 SUPSYSROOTDIRBUF            g_SupLibHardenedAppBinNtPath;
     320static SUPSYSROOTDIRBUF     g_SupLibHardenedAppBinNtPath;
     321/** The NT path of the extension packs directory. */
     322static SUPSYSROOTDIRBUF     g_SupLibHardenedExtPacksNtPath;
    321323/** The offset into g_SupLibHardenedExeNtPath of the executable name (WCHAR,
    322324 * not byte). This also gives the length of the exectuable directory path,
    … …  
    15091511     *      1. System32      - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
    15101512     *      2. WinSxS        - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
    1511      *      3. VirtualBox    - build with:
     1513     *      3. ExtPacks      - VBox built with:
     1514     *         - regular code signing cert: regular code signing, owner TrustedInstaller/Administrators/LocalSystem.
     1515     *         - kernel code signing cert:  kernel code signing and integrity checks.
     1516     *      4. VirtualBox    - VBox built with:
    15121517     *         - regular code signing cert: build cert code signing, owner TrustedInstaller/Administrators/LocalSystem.
    15131518     *         - kernel code signing cert:  kernel code signing and integrity checks.
    1514      *      4. AppPatchDir   - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
    1515      *      5. Program Files - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
    1516      *      6. Common Files  - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
    1517      *      7. x86 variations of 4 & 5 - ditto.
     1519     *      5. AppPatchDir   - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1520     *      6. Program Files - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1521     *      7. Common Files  - normal code or cat signing, owner TrustedInstaller/Administrators/LocalSystem.
     1522     *      8. x86 variations of 5 & 6 - ditto.
    15181523     *
    15191524     * Note! VBOX_WITHOUT_KERNEL_CODE_SIGNING_CERT means the /IntegrityCheck does
    … …  
    15271532    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_WinSxSNtPath.UniStr, true /*fCheckSlash*/))
    15281533        fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
     1534    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedExtPacksNtPath.UniStr, true /*fCheckSlash*/))
     1535# ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
     1536        fFlags |= SUPHNTVI_F_REQUIRE_CODE_SIGNING | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
     1537# else
     1538        fFlags |= SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING | SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT;
     1539# endif
    15291540    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedAppBinNtPath.UniStr, true /*fCheckSlash*/))
    15301541# ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
    1531         /** @todo r=bird: See SUPHNTVI_F_REQUIRE_BUILD_CERT comment below (in the
    1532          *        code that's actually used). */
    15331542        fFlags |= SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15341543# else
    … …  
    15751584     * Require trusted installer + some kind of signature on everything, except
    15761585     * for the VBox bits where we have extra requirements depending on the signing
    1577      * certificate used:
    1578      *         - regular code signing cert: build cert code signing, owner TrustedInstaller/Administrators/LocalSystem.
    1579      *         - kernel code signing cert:  kernel code signing and integrity checks.
     1586     * certificate used.
     1587     *     1. ExtPacks      - VBox built with:
     1588     *        - regular code signing cert: regular code signing, owner TrustedInstaller/Administrators/LocalSystem.
     1589     *        - kernel code signing cert:  kernel code signing and integrity checks.
     1590     *     2. VirtualBox    - VBox built with:
     1591     *        - regular code signing cert: build cert code signing, owner TrustedInstaller/Administrators/LocalSystem.
     1592     *        - kernel code signing cert:  kernel code signing and integrity checks.
     1593     *     3. Everything else: allow .cat-file verification, , owner TrustedInstaller/Administrators/LocalSystem.
    15801594     */
    15811595    uint32_t fFlags = 0;
    1582     if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedAppBinNtPath.UniStr, true /*fCheckSlash*/))
     1596    if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedExtPacksNtPath.UniStr, true /*fCheckSlash*/))
    15831597# ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
    1584         /** @todo r=bird: Since extension packs are installed under
    1585          * g_SupLibHardenedAppBinNtPath and I'm pretty sure that everything loaded into
    1586          * a VBox VM process goes thru this validation step at DLL load time, this means
    1587          * only we can now sign extension packs.
    1588          *
    1589          * I suspect we have to relax the signing restrictions on the ExtensionPacks
    1590          * subdirectory to keep 3rd party extensions working.  */
     1598        fFlags |= SUPHNTVI_F_REQUIRE_CODE_SIGNING | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
     1599# else
     1600        fFlags |= SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING | SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT;
     1601# endif
     1602    else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_SupLibHardenedAppBinNtPath.UniStr, true /*fCheckSlash*/))
     1603# ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
    15911604        fFlags |= SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER;
    15921605# else
    … …  
    59936006
    59946007/**
    5995  * Initializes the application binary directory path.
     6008 * Initializes the application binary directory path and the extpacks path.
    59966009 *
    59976010 * This is called once or twice.
    … …  
    60366049    g_SupLibHardenedAppBinNtPath.UniStr.MaximumLength = sizeof(g_SupLibHardenedAppBinNtPath.awcBuffer);
    60376050    SUP_DPRINTF(("supR3HardenedWinInitAppBin(%#x): '%ls'\n", fFlags, g_SupLibHardenedAppBinNtPath.UniStr.Buffer));
     6051
     6052    /* Extension packs: */
     6053    static wchar_t const s_wszExtPacks[] = L"\\ExtensionPacks";
     6054    if (g_SupLibHardenedAppBinNtPath.UniStr.Buffer[cwc - 1] == '\\' || g_SupLibHardenedAppBinNtPath.UniStr.Buffer[cwc - 1] == '/')
     6055        cwc--;
     6056    if (cwc + RT_ELEMENTS(s_wszExtPacks) > RT_ELEMENTS(g_SupLibHardenedExtPacksNtPath.awcBuffer))
     6057        supR3HardenedFatal("supR3HardenedWinInitAppBin: Location is too deep! (cwc=%#x)\n", cwc);
     6058    g_SupLibHardenedExtPacksNtPath.UniStr.Buffer = g_SupLibHardenedExtPacksNtPath.awcBuffer;
     6059    memcpy(g_SupLibHardenedExtPacksNtPath.UniStr.Buffer, g_SupLibHardenedAppBinNtPath.UniStr.Buffer, cwc * sizeof(WCHAR));
     6060    memcpy(&g_SupLibHardenedExtPacksNtPath.UniStr.Buffer[cwc], s_wszExtPacks, RT_ELEMENTS(s_wszExtPacks) * sizeof(WCHAR));
     6061    g_SupLibHardenedExtPacksNtPath.UniStr.Length = (cwc + RT_ELEMENTS(s_wszExtPacks) - 1) * sizeof(WCHAR);
     6062    g_SupLibHardenedExtPacksNtPath.UniStr.MaximumLength = sizeof(g_SupLibHardenedExtPacksNtPath.awcBuffer);
    60386063}
    60396064
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette