Changeset 75052 in vbox for trunk/src/VBox/HostDrivers/Support/darwin

Timestamp:

Oct 24, 2018 4:40:28 PM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

126099

Message:

SUPDrv: Made the sketches for bugref:9232 compile.

File:

• trunk/src/VBox/HostDrivers/Support/darwin/SUPDrv-darwin.cpp (modified) (18 diffs)

trunk/src/VBox/HostDrivers/Support/darwin/SUPDrv-darwin.cpp

@@ -34 +34 @@
 #include "../SUPDrvInternal.h"
 #include <VBox/version.h>
+#include <iprt/assert.h>
 #include <iprt/asm.h>
 #include <iprt/asm-amd64-x86.h>
+#include <iprt/ctype.h>
+#include <iprt/dbg.h>
 #include <iprt/initterm.h>
-#include <iprt/assert.h>
+#include <iprt/file.h>
+#include <iprt/ldr.h>
+#include <iprt/mem.h>
+#include <iprt/power.h>
+#include <iprt/process.h>
 #include <iprt/spinlock.h>
 #include <iprt/semaphore.h>
-#include <iprt/process.h>
-#include <iprt/alloc.h>
-#include <iprt/power.h>
-#include <iprt/dbg.h>
 #include <iprt/x86.h>
+#include <iprt/crypto/applecodesign.h>
+#include <iprt/crypto/store.h>
+#include <iprt/crypto/pkcs7.h>
+#include <iprt/crypto/x509.h>
 #include <VBox/err.h>
 #include <VBox/log.h>
@@ -94 +101 @@
 static kern_return_t    VBoxDrvDarwinStart(struct kmod_info *pKModInfo, void *pvData);
 static kern_return_t    VBoxDrvDarwinStop(struct kmod_info *pKModInfo, void *pvData);
+#ifdef SUPDRV_WITH_DARWIN_IMAGE_VERIFICATION
+static int              supdrvDarwinInitCertStores(PSUPDRVDEVEXT pDevExt);
+static void             supdrvDarwinDestroyCertStores(PSUPDRVDEVEXT pDevExt);
+#endif
 
 static int              VBoxDrvDarwinOpen(dev_t Dev, int fFlags, int fDevType, struct proc *pProcess);
@@ -275 +286 @@
         if (RT_SUCCESS(rc))
         {
+#ifdef SUPDRV_WITH_DARWIN_IMAGE_VERIFICATION
+            supdrvDarwinInitCertStores(&g_DevExt);
+#endif
+
             /*
              * Initialize the session hash table.
@@ -338 +353 @@
                         LogRel(("VBoxDrv: cdevsw_add failed (%d)\n", g_iMajorDeviceNo));
                 }
+#ifdef SUPDRV_WITH_DARWIN_IMAGE_VERIFICATION
+                supdrvDarwinDestroyCertStores(&g_DevExt);
+#endif
                 RTSpinlockDestroy(g_Spinlock);
                 g_Spinlock = NIL_RTSPINLOCK;
@@ -421 +439 @@
 
 
+#ifdef SUPDRV_WITH_DARWIN_IMAGE_VERIFICATION
+
+/**
+ * Initalizes the certificate stores (code signing) in the device extension.
+ */
+static int supdrvDarwinInitCertStores(PSUPDRVDEVEXT pDevExt)
+{
+    pDevExt->hAdditionalStore = NIL_RTCRSTORE;
+
+    pDevExt->hRootStore       = NIL_RTCRSTORE;
+    int rc = RTCrStoreCreateInMem(&pDevExt->hRootStore, g_cSUPTrustedTAs + 1);
+    if (RT_SUCCESS(rc))
+    {
+        for (uint32_t i = 0; i < g_cSUPTrustedTAs; i++)
+        {
+            int rc2 = RTCrStoreCertAddEncoded(pDevExt->hRootStore, RTCRCERTCTX_F_ENC_TAF_DER,
+                                              g_aSUPTrustedTAs[i].pch, g_aSUPTrustedTAs[i].cb, NULL);
+            if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+            {
+                printf("VBoxDrv: Error loading g_aSUPTrustedTAs[%u]: %d\n", i, rc);
+                rc = rc2;
+            }
+        }
+
+        /* We implicitly trust the build certificate. */
+        int rc2 = RTCrStoreCertAddEncoded(pDevExt->hRootStore, RTCRCERTCTX_F_ENC_X509_DER,
+                                          g_abSUPBuildCert, g_cbSUPBuildCert, NULL);
+        if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+        {
+            printf("VBoxDrv: Error loading g_cbSUPBuildCert: %d\n", rc);
+            rc = rc2;
+        }
+    }
+    return rc;
+}
+
+
+/**
+ * Releases the certificate stores in the device extension.
+ */
+static void supdrvDarwinDestroyCertStores(PSUPDRVDEVEXT pDevExt)
+{
+    if (pDevExt->hRootStore != NIL_RTCRSTORE)
+    {
+        uint32_t cRefs = RTCrStoreRelease(pDevExt->hRootStore);
+        Assert(cRefs == 0); RT_NOREF(cRefs);
+        pDevExt->hRootStore = NIL_RTCRSTORE;
+    }
+    if (pDevExt->hAdditionalStore != NIL_RTCRSTORE)
+    {
+        uint32_t cRefs = RTCrStoreRelease(pDevExt->hAdditionalStore);
+        Assert(cRefs == 0); RT_NOREF(cRefs);
+        pDevExt->hAdditionalStore = NIL_RTCRSTORE;
+    }
+}
+
+#endif /* SUPDRV_WITH_DARWIN_IMAGE_VERIFICATION */
+
 /**
  * Stop the kernel module.
@@ -457 +533 @@
     AssertRC(rc);
     g_Spinlock = NIL_RTSPINLOCK;
+
+#ifdef SUPDRV_WITH_DARWIN_IMAGE_VERIFICATION
+    supdrvDarwinDestroyCertStores(&g_DevExt);
+#endif
 
     RTR0TermForced();
@@ -1167 +1247 @@
      * Check already loaded modules.
      */
-    for (PSUPDRVLDRIMAGE pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext);
+    for (PSUPDRVLDRIMAGE pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
         if (   pImage->uState == SUP_IOCTL_LDR_LOAD
             && pImage->hLdrMod != NIL_RTLDRMOD)
@@ -1180 +1260 @@
      */
     printf("VBoxDrv: Unable to resolve symbol '%s'.\n", pszSymbol);
+    RT_NOREF(hLdrMod, pszModule, uSymbol);
     return VERR_SYMBOL_NOT_FOUND;
 }
@@ -1236 +1317 @@
             rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
                                "Certificate is missing the 'Dev ID Application' extension");
-        if (cDevIdKext == 0 && pState->fKernel)
+        if (cDevIdKext == 0)
             rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
                                "Certificate is missing the 'Dev ID kext' extension");
@@ -1254 +1335 @@
 {
     PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
+    RT_NOREF_PV(hLdrMod); RT_NOREF_PV(cbSignature);
+
     switch (enmSignature)
     {
@@ -1261 +1344 @@
                 PCRTCRPKCS7CONTENTINFO pContentInfo = (PCRTCRPKCS7CONTENTINFO)pvSignature;
                 RTTIMESPEC             ValidationTime;
-                RTTimeNow(&ValidationTime)
+                RTTimeNow(&ValidationTime);
 
                 return RTCrPkcs7VerifySignedDataWithExternalData(pContentInfo,
@@ -1268 +1351 @@
                                                                  | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT,
                                                                  pDevExt->hAdditionalStore, pDevExt->hRootStore, &ValidationTime,
-                                                                 supdrvDarwinLdrOpenVerifyCertificatCallback, pDevExt
+                                                                 supdrvDarwinLdrOpenVerifyCertificatCallback, pDevExt,
                                                                  pvExternalData, cbExternalData, pErrInfo);
             }
@@ -1274 +1357 @@
 
         default:
-            RT_NOREF_PV(hLdrMod); RT_NOREF_PV(cbSignature);
             return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported signature type: %d", enmSignature);
     }
@@ -1298 +1380 @@
      *       freed via the RTFileReadAllFree callback when the loader module is closed.
      */
-    void     *pvFile  = NULL;
-    size_t   *pcbFile = 0;
+    void     *pvFile = NULL;
+    size_t    cbFile = 0;
     int rc = RTFileReadAllEx(pszFilename, 0, _32M, RTFILE_RDALL_O_DENY_WRITE, &pvFile, &cbFile);
     if (RT_SUCCESS(rc))
@@ -1343 +1425 @@
                         }
 
-                        RTR0MemObjFree(hMemObj, true /*fFreeMappings*/);
+                        RTR0MemObjFree(hMemAlloc, true /*fFreeMappings*/);
                     }
                     else
-                        printf("VBoxDrv: Failed to allocate %u bytes for %s: %d\n", (unsigned)cbImage, rc);
+                        printf("VBoxDrv: Failed to allocate %u bytes for %s: %d\n", (unsigned)cbImage, pszFilename, rc);
                 }
                 else
                 {
                     printf("VBoxDrv: Image size mismatch for %s: %#x, ring-3 says %#x\n",
-                           pszFilename, cbImage, pImage->cbImageBits);
+                           pszFilename, (unsigned)cbImage, (unsigned)pImage->cbImageBits);
                     rc = VERR_LDR_MISMATCH_NATIVE;
                 }
@@ -1384 +1466 @@
 {
     RT_NOREF(hLdrMod, pszSymbol, uSymbol);
-    if (uValue == (uintptr_t)pvUser)
+    if (Value == (uintptr_t)pvUser)
         return VINF_CALLBACK_RETURN;
     return VINF_SUCCESS;
@@ -1417 +1499 @@
         }
         else
-            SUPR0Printf("SUPDrv: No export named %s (%p) in %s!\n", pszSymbol, uRvaToValidate, pImage->szName);
+            SUPR0Printf("SUPDrv: No export named %s (%p) in %s!\n", pszSymbol, pv, pImage->szName);
     }
     /*
@@ -1459 +1541 @@
     if (!memcmp(pImage->pvImage, pbImageBits, pImage->cbImageBits))
         return VINF_SUCCESS;
+
+    RT_NOREF(pDevExt, pReq);
     return VERR_LDR_MISMATCH_NATIVE;