Changeset 74767 in vbox for trunk/src/VBox

Timestamp:

Oct 11, 2018 12:16:21 PM (6 years ago)

Author:

vboxsync

Message:

RTSignTool,SUPR3: Implemented dev id / kext checks for verify-exe. bugref:9232

Location:

trunk/src/VBox

Files:

• HostDrivers/Support/Certificates (moved) (moved from trunk/src/VBox/HostDrivers/Support/win/Certificates )
• HostDrivers/Support/Certificates/AppleRoot-2bd06947947609fef46b8d2e40a6f7474d7f085e.taf (added)
• HostDrivers/Support/Certificates/AppleRoot-G2-c499136c1803c27bc0a3a00d7f72807a1c77268d.taf (added)
• HostDrivers/Support/Makefile.kmk (modified) (2 diffs)
• Runtime/tools/RTSignTool.cpp (modified) (7 diffs)

trunk/src/VBox/HostDrivers/Support/Makefile.kmk

@@ -91 +91 @@
        NtRootMicrosoft7=NtRoot-MicrosoftCodeVerificationRoot-729404101f3e0ca347837fca175a8438.taf \
        TimeRootMicrosoft0=Timestamp-CopyrightC1997MicrosoftCorp-01.taf \
-       TrustedCertVBox0=Trusted-OracleCorporationVirtualBox-51ca009816fdbd80f120e015ee75823e.taf
+       TrustedCertVBox0=Trusted-OracleCorporationVirtualBox-51ca009816fdbd80f120e015ee75823e.taf \
+       AppleRoot0=AppleRoot-2bd06947947609fef46b8d2e40a6f7474d7f085e.taf \
+       AppleRoot1=AppleRoot-G2-c499136c1803c27bc0a3a00d7f72807a1c77268d.taf
 VBOX_SUP_WIN_CERT_NAMES := $(foreach cert,$(VBOX_SUP_WIN_CERTS),$(firstword $(subst =,$(SPACE) ,$(cert))))
-VBOX_PATH_SUPR3_CERTIFICATES := $(PATH_SUB_CURRENT)/win/Certificates
+VBOX_PATH_SUPR3_CERTIFICATES := $(PATH_SUB_CURRENT)/Certificates
 
 # 1=name, 2=filter, 3=buildcert?.
@@ -129 +131 @@
 # Generate certificate lists.
         $(QUIET)$(APPEND) -n "$@" '' \
-               $(call VBOX_SUP_GEN_CERT_MACRO,All,%,build) \
-               $(call VBOX_SUP_GEN_CERT_MACRO,SpcRoot,SpcRoot%) \
-               $(call VBOX_SUP_GEN_CERT_MACRO,NtKernelRoot,NtRoot%) \
-               $(call VBOX_SUP_GEN_CERT_MACRO,Timestamp,TimeRoot%) \
-               $(call VBOX_SUP_GEN_CERT_MACRO,Trusted,TrustedCert%,build)
+                $(call VBOX_SUP_GEN_CERT_MACRO,All,%,build) \
+                $(call VBOX_SUP_GEN_CERT_MACRO,SpcRoot,SpcRoot%) \
+                $(call VBOX_SUP_GEN_CERT_MACRO,NtKernelRoot,NtRoot%) \
+                $(call VBOX_SUP_GEN_CERT_MACRO,Timestamp,TimeRoot%) \
+                $(call VBOX_SUP_GEN_CERT_MACRO,AppleRoot,AppleRoot%) \
+                $(call VBOX_SUP_GEN_CERT_MACRO,Trusted,TrustedCert%,build)
 
 tst: $(VBOX_SUP_WIN_CERTS_FILE)

trunk/src/VBox/Runtime/tools/RTSignTool.cpp

@@ -46 +46 @@
 # include <iprt/formats/pecoff.h>
 #endif
+#include <iprt/crypto/applecodesign.h>
 #include <iprt/crypto/digest.h>
 #include <iprt/crypto/x509.h>
@@ -1312 +1313 @@
     {
         /*
-         * If kernel signing, a valid certificate path must be anchored by the
-         * microsoft kernel signing root certificate.  The only alternative is
-         * test signing.
+         * If windows kernel signing, a valid certificate path must be anchored
+         * by the microsoft kernel signing root certificate.  The only
+         * alternative is test signing.
          */
-        if (pState->fKernel && hCertPaths != NIL_RTCRX509CERTPATHS)
+        if (   pState->fKernel
+            && hCertPaths != NIL_RTCRX509CERTPATHS
+            && pState->enmSignType == VERIFYEXESTATE::kSignType_Windows)
         {
             uint32_t cFound = 0;
@@ -1362 +1365 @@
                 RTMsgWarning("%u valid paths, expected 2", cValid);
         }
+        /*
+         * For Mac OS X signing, check for special developer ID attributes.
+         */
+        else if (pState->enmSignType == VERIFYEXESTATE::kSignType_OSX)
+        {
+            uint32_t cDevIdApp  = 0;
+            uint32_t cDevIdKext = 0;
+            for (uint32_t i = 0; i < pCert->TbsCertificate.T3.Extensions.cItems; i++)
+            {
+                PCRTCRX509EXTENSION pExt = pCert->TbsCertificate.T3.Extensions.papItems[i];
+                if (RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCR_APPLE_CS_DEVID_APPLICATION_OID) == 0)
+                {
+                    cDevIdApp++;
+                    if (!pExt->Critical.fValue)
+                        rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                           "Dev ID Application certificate extension is not flagged critical");
+                }
+                else if (RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCR_APPLE_CS_DEVID_KEXT_OID) == 0)
+                {
+                    cDevIdKext++;
+                    if (!pExt->Critical.fValue)
+                        rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                           "Dev ID kext certificate extension is not flagged critical");
+                }
+            }
+            if (cDevIdApp == 0)
+                rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                   "Certificate is missing the 'Dev ID Application' extension");
+            if (cDevIdKext == 0 && pState->fKernel)
+                rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                   "Certificate is missing the 'Dev ID kext' extension");
+        }
     }
 
@@ -1418 +1453 @@
 }
 
-/** Worker for HandleVerifyExe. */
+/**
+ * Worker for HandleVerifyExe.
+ */
 static RTEXITCODE HandleVerifyExeWorker(VERIFYEXESTATE *pState, const char *pszFilename, PRTERRINFOSTATIC pStaticErrInfo)
 {
@@ -1546 +1583 @@
      * Populate the certificate stores according to the signing type.
      */
-#ifdef VBOX
+# ifdef VBOX
     unsigned          cSets = 0;
     struct STSTORESET aSets[6];
-#endif
-
     switch (State.enmSignType)
     {
         case VERIFYEXESTATE::kSignType_Windows:
-#ifdef VBOX
             aSets[cSets].hStore  = State.hRootStore;
             aSets[cSets].paTAs   = g_aSUPTimestampTAs;
@@ -1571 +1605 @@
             aSets[cSets].cTAs    = g_cSUPNtKernelRootTAs;
             cSets++;
-#endif
             break;
 
         case VERIFYEXESTATE::kSignType_OSX:
-            return RTMsgErrorExit(RTEXITCODE_FAILURE, "Mac OS X executable signing is not implemented.");
-    }
-
-#ifdef VBOX
+            aSets[cSets].hStore  = State.hRootStore;
+            aSets[cSets].paTAs   = g_aSUPAppleRootTAs;
+            aSets[cSets].cTAs    = g_cSUPAppleRootTAs;
+            cSets++;
+            break;
+    }
     for (unsigned i = 0; i < cSets; i++)
         for (unsigned j = 0; j < aSets[i].cTAs; j++)
@@ -1588 +1623 @@
                                       i, j, StaticErrInfo.szMsg);
         }
-#endif
+# endif /* VBOX */
 
     /*