[11725] | 1 | /* $Id: SUPR3HardenedMain.cpp 18499 2009-03-29 02:26:30Z vboxsync $ */
|
---|
| 2 | /** @file
|
---|
| 3 | * VirtualBox Support Library - Hardened main().
|
---|
| 4 | */
|
---|
| 5 |
|
---|
| 6 | /*
|
---|
| 7 | * Copyright (C) 2006-2008 Sun Microsystems, Inc.
|
---|
| 8 | *
|
---|
| 9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
| 10 | * available from http://www.virtualbox.org. This file is free software;
|
---|
| 11 | * you can redistribute it and/or modify it under the terms of the GNU
|
---|
| 12 | * General Public License (GPL) as published by the Free Software
|
---|
| 13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
| 14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
| 15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
| 16 | *
|
---|
| 17 | * The contents of this file may alternatively be used under the terms
|
---|
| 18 | * of the Common Development and Distribution License Version 1.0
|
---|
| 19 | * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
---|
| 20 | * VirtualBox OSE distribution, in which case the provisions of the
|
---|
| 21 | * CDDL are applicable instead of those of the GPL.
|
---|
| 22 | *
|
---|
| 23 | * You may elect to license modified versions of this file under the
|
---|
| 24 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
| 25 | *
|
---|
| 26 | * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
|
---|
| 27 | * Clara, CA 95054 USA or visit http://www.sun.com if you need
|
---|
| 28 | * additional information or have any questions.
|
---|
| 29 | */
|
---|
| 30 |
|
---|
| 31 | /*******************************************************************************
|
---|
| 32 | * Header Files *
|
---|
| 33 | *******************************************************************************/
|
---|
| 34 | #if defined(RT_OS_OS2)
|
---|
| 35 | # define INCL_BASE
|
---|
| 36 | # define INCL_ERRORS
|
---|
| 37 | # include <os2.h>
|
---|
| 38 | # include <stdio.h>
|
---|
[13908] | 39 | # include <stdlib.h>
|
---|
| 40 | # include <dlfcn.h>
|
---|
[11725] | 41 |
|
---|
| 42 | #elif RT_OS_WINDOWS
|
---|
| 43 | # include <Windows.h>
|
---|
| 44 | # include <stdio.h>
|
---|
| 45 |
|
---|
| 46 | #else /* UNIXes */
|
---|
| 47 | # include <iprt/types.h> /* stdint fun on darwin. */
|
---|
| 48 |
|
---|
| 49 | # include <stdio.h>
|
---|
| 50 | # include <stdlib.h>
|
---|
| 51 | # include <dlfcn.h>
|
---|
| 52 | # include <limits.h>
|
---|
| 53 | # include <errno.h>
|
---|
| 54 | # include <unistd.h>
|
---|
| 55 | # include <sys/stat.h>
|
---|
| 56 | # include <sys/time.h>
|
---|
| 57 | # include <stdio.h>
|
---|
| 58 | # include <sys/types.h>
|
---|
[15270] | 59 | # if defined(RT_OS_LINUX)
|
---|
[15871] | 60 | # undef USE_LIB_PCAP /* don't depend on libcap as we had to depend on either
|
---|
| 61 | libcap1 or libcap2 */
|
---|
| 62 |
|
---|
| 63 | # undef _POSIX_SOURCE
|
---|
[15180] | 64 | # include <sys/capability.h>
|
---|
| 65 | # include <sys/prctl.h>
|
---|
[15873] | 66 | # ifndef CAP_TO_MASK
|
---|
| 67 | # define CAP_TO_MASK(cap) RT_BIT(cap)
|
---|
| 68 | # endif
|
---|
[15270] | 69 | # elif defined(RT_OS_SOLARIS)
|
---|
| 70 | # include <priv.h>
|
---|
[15180] | 71 | # endif
|
---|
[11725] | 72 | # include <pwd.h>
|
---|
| 73 | # ifdef RT_OS_DARWIN
|
---|
| 74 | # include <mach-o/dyld.h>
|
---|
| 75 | # endif
|
---|
| 76 |
|
---|
| 77 | #endif
|
---|
| 78 |
|
---|
| 79 | #include <VBox/sup.h>
|
---|
| 80 | #include <VBox/err.h>
|
---|
| 81 | #include <iprt/string.h>
|
---|
| 82 | #include <iprt/param.h>
|
---|
| 83 |
|
---|
| 84 | #include "SUPLibInternal.h"
|
---|
| 85 |
|
---|
| 86 |
|
---|
| 87 | /*******************************************************************************
|
---|
| 88 | * Defined Constants And Macros *
|
---|
| 89 | *******************************************************************************/
|
---|
| 90 | /** @def SUP_HARDENED_SUID
|
---|
| 91 | * Whether we're employing set-user-ID-on-execute in the hardening.
|
---|
| 92 | */
|
---|
| 93 | #if !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_L4)
|
---|
| 94 | # define SUP_HARDENED_SUID
|
---|
| 95 | #else
|
---|
| 96 | # undef SUP_HARDENED_SUID
|
---|
| 97 | #endif
|
---|
| 98 |
|
---|
| 99 | /** @def SUP_HARDENED_SYM
|
---|
| 100 | * Decorate a symbol that's resolved dynamically.
|
---|
| 101 | */
|
---|
| 102 | #ifdef RT_OS_OS2
|
---|
[13908] | 103 | # define SUP_HARDENED_SYM(sym) "_" sym
|
---|
[11725] | 104 | #else
|
---|
| 105 | # define SUP_HARDENED_SYM(sym) sym
|
---|
| 106 | #endif
|
---|
| 107 |
|
---|
| 108 |
|
---|
| 109 | /*******************************************************************************
|
---|
| 110 | * Structures and Typedefs *
|
---|
| 111 | *******************************************************************************/
|
---|
[11843] | 112 | /** @see RTR3InitEx */
|
---|
| 113 | typedef DECLCALLBACK(int) FNRTR3INITEX(uint32_t iVersion, const char *pszProgramPath, bool fInitSUPLib);
|
---|
| 114 | typedef FNRTR3INITEX *PFNRTR3INITEX;
|
---|
[11725] | 115 |
|
---|
| 116 |
|
---|
| 117 | /*******************************************************************************
|
---|
| 118 | * Global Variables *
|
---|
| 119 | *******************************************************************************/
|
---|
| 120 | /** The pre-init data we pass on to SUPR3 (residing in VBoxRT). */
|
---|
| 121 | static SUPPREINITDATA g_SupPreInitData;
|
---|
[11843] | 122 | /** The progam executable path. */
|
---|
| 123 | static char g_szSupLibHardenedExePath[RTPATH_MAX];
|
---|
| 124 | /** The program directory path. */
|
---|
| 125 | static char g_szSupLibHardenedDirPath[RTPATH_MAX];
|
---|
[11725] | 126 |
|
---|
| 127 | /** The program name. */
|
---|
[11843] | 128 | static const char *g_pszSupLibHardenedProgName;
|
---|
[11725] | 129 |
|
---|
[13458] | 130 | #ifdef SUP_HARDENED_SUID
|
---|
| 131 | /** The real UID at startup. */
|
---|
| 132 | static uid_t g_uid;
|
---|
| 133 | /** The real GID at startup. */
|
---|
| 134 | static gid_t g_gid;
|
---|
[16048] | 135 | # ifdef RT_OS_LINUX
|
---|
[16067] | 136 | static uint32_t g_uCaps;
|
---|
[16048] | 137 | # endif
|
---|
[13458] | 138 | #endif
|
---|
[11725] | 139 |
|
---|
[13458] | 140 | /*******************************************************************************
|
---|
| 141 | * Internal Functions *
|
---|
| 142 | *******************************************************************************/
|
---|
| 143 | #ifdef SUP_HARDENED_SUID
|
---|
| 144 | static void supR3HardenedMainDropPrivileges(void);
|
---|
| 145 | #endif
|
---|
| 146 | static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName);
|
---|
| 147 |
|
---|
| 148 |
|
---|
[11725] | 149 | /**
|
---|
| 150 | * @copydoc RTPathStripFilename.
|
---|
| 151 | */
|
---|
| 152 | static void suplibHardenedPathStripFilename(char *pszPath)
|
---|
| 153 | {
|
---|
| 154 | char *psz = pszPath;
|
---|
| 155 | char *pszLastSep = pszPath;
|
---|
| 156 |
|
---|
| 157 | for (;; psz++)
|
---|
| 158 | {
|
---|
| 159 | switch (*psz)
|
---|
| 160 | {
|
---|
| 161 | /* handle separators. */
|
---|
| 162 | #if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
|
---|
| 163 | case ':':
|
---|
| 164 | pszLastSep = psz + 1;
|
---|
| 165 | break;
|
---|
| 166 |
|
---|
| 167 | case '\\':
|
---|
| 168 | #endif
|
---|
| 169 | case '/':
|
---|
| 170 | pszLastSep = psz;
|
---|
| 171 | break;
|
---|
| 172 |
|
---|
| 173 | /* the end */
|
---|
| 174 | case '\0':
|
---|
| 175 | if (pszLastSep == pszPath)
|
---|
| 176 | *pszLastSep++ = '.';
|
---|
| 177 | *pszLastSep = '\0';
|
---|
| 178 | return;
|
---|
| 179 | }
|
---|
| 180 | }
|
---|
| 181 | /* will never get here */
|
---|
| 182 | }
|
---|
| 183 |
|
---|
| 184 |
|
---|
| 185 | /**
|
---|
| 186 | * @copydoc RTPathFilename
|
---|
| 187 | */
|
---|
| 188 | DECLHIDDEN(char *) supR3HardenedPathFilename(const char *pszPath)
|
---|
| 189 | {
|
---|
| 190 | const char *psz = pszPath;
|
---|
| 191 | const char *pszLastComp = pszPath;
|
---|
| 192 |
|
---|
| 193 | for (;; psz++)
|
---|
| 194 | {
|
---|
| 195 | switch (*psz)
|
---|
| 196 | {
|
---|
| 197 | /* handle separators. */
|
---|
| 198 | #if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
|
---|
| 199 | case ':':
|
---|
| 200 | pszLastComp = psz + 1;
|
---|
| 201 | break;
|
---|
| 202 |
|
---|
| 203 | case '\\':
|
---|
| 204 | #endif
|
---|
| 205 | case '/':
|
---|
| 206 | pszLastComp = psz + 1;
|
---|
| 207 | break;
|
---|
| 208 |
|
---|
| 209 | /* the end */
|
---|
| 210 | case '\0':
|
---|
| 211 | if (*pszLastComp)
|
---|
| 212 | return (char *)(void *)pszLastComp;
|
---|
| 213 | return NULL;
|
---|
| 214 | }
|
---|
| 215 | }
|
---|
| 216 |
|
---|
| 217 | /* will never get here */
|
---|
| 218 | return NULL;
|
---|
| 219 | }
|
---|
| 220 |
|
---|
| 221 |
|
---|
| 222 | /**
|
---|
| 223 | * @copydoc RTPathAppPrivateNoArch
|
---|
| 224 | */
|
---|
| 225 | DECLHIDDEN(int) supR3HardenedPathAppPrivateNoArch(char *pszPath, size_t cchPath)
|
---|
| 226 | {
|
---|
| 227 | #if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE)
|
---|
| 228 | const char *pszSrcPath = RTPATH_APP_PRIVATE;
|
---|
| 229 | size_t cchPathPrivateNoArch = strlen(pszSrcPath);
|
---|
| 230 | if (cchPathPrivateNoArch >= cchPath)
|
---|
| 231 | supR3HardenedFatal("supR3HardenedPathAppPrivateNoArch: Buffer overflow, %lu >= %lu\n",
|
---|
| 232 | (unsigned long)cchPathPrivateNoArch, (unsigned long)cchPath);
|
---|
| 233 | memcpy(pszPath, pszSrcPath, cchPathPrivateNoArch + 1);
|
---|
| 234 | return VINF_SUCCESS;
|
---|
| 235 |
|
---|
| 236 | #else
|
---|
| 237 | return supR3HardenedPathProgram(pszPath, cchPath);
|
---|
| 238 | #endif
|
---|
| 239 | }
|
---|
| 240 |
|
---|
| 241 |
|
---|
| 242 | /**
|
---|
| 243 | * @copydoc RTPathAppPrivateArch
|
---|
| 244 | */
|
---|
| 245 | DECLHIDDEN(int) supR3HardenedPathAppPrivateArch(char *pszPath, size_t cchPath)
|
---|
| 246 | {
|
---|
| 247 | #if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE_ARCH)
|
---|
| 248 | const char *pszSrcPath = RTPATH_APP_PRIVATE_ARCH;
|
---|
| 249 | size_t cchPathPrivateArch = strlen(pszSrcPath);
|
---|
| 250 | if (cchPathPrivateArch >= cchPath)
|
---|
| 251 | supR3HardenedFatal("supR3HardenedPathAppPrivateArch: Buffer overflow, %lu >= %lu\n",
|
---|
| 252 | (unsigned long)cchPathPrivateArch, (unsigned long)cchPath);
|
---|
| 253 | memcpy(pszPath, pszSrcPath, cchPathPrivateArch + 1);
|
---|
| 254 | return VINF_SUCCESS;
|
---|
| 255 |
|
---|
| 256 | #else
|
---|
| 257 | return supR3HardenedPathProgram(pszPath, cchPath);
|
---|
| 258 | #endif
|
---|
| 259 | }
|
---|
| 260 |
|
---|
| 261 |
|
---|
| 262 | /**
|
---|
| 263 | * @copydoc RTPathSharedLibs
|
---|
| 264 | */
|
---|
| 265 | DECLHIDDEN(int) supR3HardenedPathSharedLibs(char *pszPath, size_t cchPath)
|
---|
| 266 | {
|
---|
| 267 | #if !defined(RT_OS_WINDOWS) && defined(RTPATH_SHARED_LIBS)
|
---|
| 268 | const char *pszSrcPath = RTPATH_SHARED_LIBS;
|
---|
| 269 | size_t cchPathSharedLibs = strlen(pszSrcPath);
|
---|
| 270 | if (cchPathSharedLibs >= cchPath)
|
---|
| 271 | supR3HardenedFatal("supR3HardenedPathSharedLibs: Buffer overflow, %lu >= %lu\n",
|
---|
| 272 | (unsigned long)cchPathSharedLibs, (unsigned long)cchPath);
|
---|
| 273 | memcpy(pszPath, pszSrcPath, cchPathSharedLibs + 1);
|
---|
| 274 | return VINF_SUCCESS;
|
---|
| 275 |
|
---|
| 276 | #else
|
---|
| 277 | return supR3HardenedPathProgram(pszPath, cchPath);
|
---|
| 278 | #endif
|
---|
| 279 | }
|
---|
| 280 |
|
---|
| 281 |
|
---|
| 282 | /**
|
---|
| 283 | * @copydoc RTPathAppDocs
|
---|
| 284 | */
|
---|
| 285 | DECLHIDDEN(int) supR3HardenedPathAppDocs(char *pszPath, size_t cchPath)
|
---|
| 286 | {
|
---|
| 287 | #if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_DOCS)
|
---|
| 288 | const char *pszSrcPath = RTPATH_APP_DOCS;
|
---|
| 289 | size_t cchPathAppDocs = strlen(pszSrcPath);
|
---|
| 290 | if (cchPathAppDocs >= cchPath)
|
---|
| 291 | supR3HardenedFatal("supR3HardenedPathAppDocs: Buffer overflow, %lu >= %lu\n",
|
---|
| 292 | (unsigned long)cchPathAppDocs, (unsigned long)cchPath);
|
---|
| 293 | memcpy(pszPath, pszSrcPath, cchPathAppDocs + 1);
|
---|
| 294 | return VINF_SUCCESS;
|
---|
| 295 |
|
---|
| 296 | #else
|
---|
| 297 | return supR3HardenedPathProgram(pszPath, cchPath);
|
---|
| 298 | #endif
|
---|
| 299 | }
|
---|
| 300 |
|
---|
| 301 |
|
---|
| 302 | /**
|
---|
[11843] | 303 | * Returns the full path to the executable.
|
---|
[12111] | 304 | *
|
---|
[11843] | 305 | * @returns IPRT status code.
|
---|
| 306 | * @param pszPath Where to store it.
|
---|
| 307 | * @param cchPath How big that buffer is.
|
---|
[11725] | 308 | */
|
---|
[11843] | 309 | static void supR3HardenedGetFullExePath(void)
|
---|
[11725] | 310 | {
|
---|
| 311 | /*
|
---|
[11843] | 312 | * Get the program filename.
|
---|
| 313 | *
|
---|
| 314 | * Most UNIXes have no API for obtaining the executable path, but provides a symbolic
|
---|
| 315 | * link in the proc file system that tells who was exec'ed. The bad thing about this
|
---|
| 316 | * is that we have to use readlink, one of the weirder UNIX APIs.
|
---|
| 317 | *
|
---|
| 318 | * Darwin, OS/2 and Windows all have proper APIs for getting the program file name.
|
---|
[11725] | 319 | */
|
---|
| 320 | #if defined(RT_OS_LINUX) || defined(RT_OS_FREEBSD) || defined(RT_OS_SOLARIS)
|
---|
| 321 | # ifdef RT_OS_LINUX
|
---|
[11843] | 322 | int cchLink = readlink("/proc/self/exe", &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
|
---|
[11725] | 323 | # elif defined(RT_OS_SOLARIS)
|
---|
[11843] | 324 | char szFileBuf[PATH_MAX + 1];
|
---|
| 325 | sprintf(szFileBuf, "/proc/%ld/path/a.out", (long)getpid());
|
---|
| 326 | int cchLink = readlink(szFileBuf, &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
|
---|
[11725] | 327 | # else /* RT_OS_FREEBSD: */
|
---|
[11843] | 328 | int cchLink = readlink("/proc/curproc/file", &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
|
---|
[11725] | 329 | # endif
|
---|
[11843] | 330 | if (cchLink < 0 || cchLink == sizeof(g_szSupLibHardenedExePath) - 1)
|
---|
| 331 | supR3HardenedFatal("supR3HardenedPathProgram: couldn't read \"%s\", errno=%d cchLink=%d\n",
|
---|
| 332 | g_szSupLibHardenedExePath, errno, cchLink);
|
---|
| 333 | g_szSupLibHardenedExePath[cchLink] = '\0';
|
---|
[11725] | 334 |
|
---|
| 335 | #elif defined(RT_OS_OS2) || defined(RT_OS_L4)
|
---|
[11843] | 336 | _execname(g_szSupLibHardenedExePath, sizeof(g_szSupLibHardenedExePath));
|
---|
[11725] | 337 |
|
---|
| 338 | #elif defined(RT_OS_DARWIN)
|
---|
[11843] | 339 | const char *pszImageName = _dyld_get_image_name(0);
|
---|
| 340 | if (!pszImageName)
|
---|
| 341 | supR3HardenedFatal("supR3HardenedPathProgram: _dyld_get_image_name(0) failed\n");
|
---|
| 342 | size_t cchImageName = strlen(pszImageName);
|
---|
| 343 | if (!cchImageName || cchImageName >= sizeof(g_szSupLibHardenedExePath))
|
---|
| 344 | supR3HardenedFatal("supR3HardenedPathProgram: _dyld_get_image_name(0) failed, cchImageName=%d\n", cchImageName);
|
---|
| 345 | memcpy(g_szSupLibHardenedExePath, pszImageName, cchImageName + 1);
|
---|
[11725] | 346 |
|
---|
| 347 | #elif defined(RT_OS_WINDOWS)
|
---|
[11843] | 348 | HMODULE hExe = GetModuleHandle(NULL);
|
---|
| 349 | if (!GetModuleFileName(hExe, &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath)))
|
---|
| 350 | supR3HardenedFatal("supR3HardenedPathProgram: GetModuleFileName failed, rc=%d\n", GetLastError());
|
---|
[11725] | 351 | #else
|
---|
| 352 | # error needs porting.
|
---|
| 353 | #endif
|
---|
[12111] | 354 |
|
---|
[11843] | 355 | /*
|
---|
| 356 | * Strip off the filename part (RTPathStripFilename()).
|
---|
| 357 | */
|
---|
| 358 | strcpy(g_szSupLibHardenedDirPath, g_szSupLibHardenedExePath);
|
---|
| 359 | suplibHardenedPathStripFilename(g_szSupLibHardenedDirPath);
|
---|
| 360 | }
|
---|
[11725] | 361 |
|
---|
| 362 |
|
---|
[11843] | 363 | #ifdef RT_OS_LINUX
|
---|
| 364 | /**
|
---|
| 365 | * Checks if we can read /proc/self/exe.
|
---|
[12111] | 366 | *
|
---|
| 367 | * This is used on linux to see if we have to call init
|
---|
[11843] | 368 | * with program path or not.
|
---|
[12111] | 369 | *
|
---|
[11843] | 370 | * @returns true / false.
|
---|
| 371 | */
|
---|
| 372 | static bool supR3HardenedMainIsProcSelfExeAccssible(void)
|
---|
| 373 | {
|
---|
| 374 | char szPath[RTPATH_MAX];
|
---|
| 375 | int cchLink = readlink("/proc/self/exe", szPath, sizeof(szPath));
|
---|
| 376 | return cchLink != -1;
|
---|
| 377 | }
|
---|
| 378 | #endif /* RT_OS_LINUX */
|
---|
| 379 |
|
---|
| 380 |
|
---|
| 381 |
|
---|
| 382 | /**
|
---|
| 383 | * @copydoc RTPathProgram
|
---|
| 384 | */
|
---|
| 385 | DECLHIDDEN(int) supR3HardenedPathProgram(char *pszPath, size_t cchPath)
|
---|
| 386 | {
|
---|
[11725] | 387 | /*
|
---|
[11843] | 388 | * Lazy init (probably not required).
|
---|
| 389 | */
|
---|
| 390 | if (!g_szSupLibHardenedDirPath[0])
|
---|
| 391 | supR3HardenedGetFullExePath();
|
---|
| 392 |
|
---|
| 393 | /*
|
---|
[11725] | 394 | * Calc the length and check if there is space before copying.
|
---|
| 395 | */
|
---|
[18499] | 396 | size_t cch = strlen(g_szSupLibHardenedDirPath) + 1;
|
---|
[11725] | 397 | if (cch <= cchPath)
|
---|
| 398 | {
|
---|
[11843] | 399 | memcpy(pszPath, g_szSupLibHardenedDirPath, cch + 1);
|
---|
[11725] | 400 | return VINF_SUCCESS;
|
---|
| 401 | }
|
---|
| 402 |
|
---|
| 403 | supR3HardenedFatal("supR3HardenedPathProgram: Buffer too small (%u < %u)\n", cchPath, cch);
|
---|
| 404 | return VERR_BUFFER_OVERFLOW;
|
---|
| 405 | }
|
---|
| 406 |
|
---|
| 407 |
|
---|
[13458] | 408 | DECLHIDDEN(void) supR3HardenedFatalMsgV(const char *pszWhere, SUPINITOP enmWhat, int rc, const char *pszMsgFmt, va_list va)
|
---|
| 409 | {
|
---|
| 410 | /*
|
---|
| 411 | * To the console first, like supR3HardenedFatalV.
|
---|
| 412 | */
|
---|
| 413 | fprintf(stderr, "%s: Error %d in %s!\n", g_pszSupLibHardenedProgName, rc, pszWhere);
|
---|
| 414 | fprintf(stderr, "%s: ", g_pszSupLibHardenedProgName);
|
---|
| 415 | va_list vaCopy;
|
---|
| 416 | va_copy(vaCopy, va);
|
---|
| 417 | vfprintf(stderr, pszMsgFmt, vaCopy);
|
---|
| 418 | va_end(vaCopy);
|
---|
| 419 | fprintf(stderr, "\n");
|
---|
[11725] | 420 |
|
---|
[13458] | 421 | switch (enmWhat)
|
---|
| 422 | {
|
---|
| 423 | case kSupInitOp_Driver:
|
---|
| 424 | fprintf(stderr,
|
---|
| 425 | "\n"
|
---|
| 426 | "%s: Tip! Make sure the kernel module is loaded. It may also help to reinstall VirtualBox.\n",
|
---|
| 427 | g_pszSupLibHardenedProgName);
|
---|
| 428 | break;
|
---|
| 429 |
|
---|
| 430 | case kSupInitOp_IPRT:
|
---|
| 431 | case kSupInitOp_Integrity:
|
---|
| 432 | case kSupInitOp_RootCheck:
|
---|
| 433 | fprintf(stderr,
|
---|
| 434 | "\n"
|
---|
| 435 | "%s: Tip! It may help to reinstall VirtualBox.\n",
|
---|
| 436 | g_pszSupLibHardenedProgName);
|
---|
| 437 | break;
|
---|
| 438 |
|
---|
| 439 | default:
|
---|
| 440 | /* no hints here */
|
---|
| 441 | break;
|
---|
| 442 | }
|
---|
| 443 |
|
---|
| 444 | #ifdef SUP_HARDENED_SUID
|
---|
| 445 | /*
|
---|
| 446 | * Drop any root privileges we might be holding, this won't return
|
---|
| 447 | * if it fails but end up calling supR3HardenedFatal[V].
|
---|
| 448 | */
|
---|
| 449 | supR3HardenedMainDropPrivileges();
|
---|
| 450 | #endif /* SUP_HARDENED_SUID */
|
---|
| 451 |
|
---|
| 452 | /*
|
---|
| 453 | * Now try resolve and call the TrustedError entry point if we can
|
---|
[13503] | 454 | * find it. We'll fork before we attempt this because that way the
|
---|
| 455 | * session management in main will see us exiting immediately (if
|
---|
| 456 | * it's invovled with us).
|
---|
[13458] | 457 | */
|
---|
[13503] | 458 | #if !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
|
---|
| 459 | int pid = fork();
|
---|
| 460 | if (pid <= 0)
|
---|
| 461 | #endif
|
---|
| 462 | {
|
---|
| 463 | PFNSUPTRUSTEDERROR pfnTrustedError = supR3HardenedMainGetTrustedError(g_pszSupLibHardenedProgName);
|
---|
| 464 | if (pfnTrustedError)
|
---|
| 465 | pfnTrustedError(pszWhere, enmWhat, rc, pszMsgFmt, va);
|
---|
| 466 | }
|
---|
[13458] | 467 |
|
---|
| 468 | /*
|
---|
| 469 | * Quit
|
---|
| 470 | */
|
---|
| 471 | for (;;)
|
---|
| 472 | #ifdef _MSC_VER
|
---|
| 473 | exit(1);
|
---|
| 474 | #else
|
---|
| 475 | _Exit(1);
|
---|
| 476 | #endif
|
---|
| 477 | }
|
---|
| 478 |
|
---|
| 479 |
|
---|
| 480 | DECLHIDDEN(void) supR3HardenedFatalMsg(const char *pszWhere, SUPINITOP enmWhat, int rc, const char *pszMsgFmt, ...)
|
---|
| 481 | {
|
---|
| 482 | va_list va;
|
---|
| 483 | va_start(va, pszMsgFmt);
|
---|
| 484 | supR3HardenedFatalMsgV(pszWhere, enmWhat, rc, pszMsgFmt, va);
|
---|
| 485 | va_end(va);
|
---|
| 486 | }
|
---|
| 487 |
|
---|
| 488 |
|
---|
[11725] | 489 | DECLHIDDEN(void) supR3HardenedFatalV(const char *pszFormat, va_list va)
|
---|
| 490 | {
|
---|
[11843] | 491 | fprintf(stderr, "%s: ", g_pszSupLibHardenedProgName);
|
---|
[11725] | 492 | vfprintf(stderr, pszFormat, va);
|
---|
| 493 | for (;;)
|
---|
| 494 | #ifdef _MSC_VER
|
---|
| 495 | exit(1);
|
---|
| 496 | #else
|
---|
| 497 | _Exit(1);
|
---|
| 498 | #endif
|
---|
| 499 | }
|
---|
| 500 |
|
---|
| 501 |
|
---|
| 502 | DECLHIDDEN(void) supR3HardenedFatal(const char *pszFormat, ...)
|
---|
| 503 | {
|
---|
| 504 | va_list va;
|
---|
| 505 | va_start(va, pszFormat);
|
---|
| 506 | supR3HardenedFatalV(pszFormat, va);
|
---|
| 507 | va_end(va);
|
---|
| 508 | }
|
---|
| 509 |
|
---|
| 510 |
|
---|
| 511 | DECLHIDDEN(int) supR3HardenedErrorV(int rc, bool fFatal, const char *pszFormat, va_list va)
|
---|
| 512 | {
|
---|
| 513 | if (fFatal)
|
---|
| 514 | supR3HardenedFatalV(pszFormat, va);
|
---|
| 515 |
|
---|
[11843] | 516 | fprintf(stderr, "%s: ", g_pszSupLibHardenedProgName);
|
---|
[11725] | 517 | vfprintf(stderr, pszFormat, va);
|
---|
| 518 | return rc;
|
---|
| 519 | }
|
---|
| 520 |
|
---|
| 521 |
|
---|
| 522 | DECLHIDDEN(int) supR3HardenedError(int rc, bool fFatal, const char *pszFormat, ...)
|
---|
| 523 | {
|
---|
| 524 | va_list va;
|
---|
| 525 | va_start(va, pszFormat);
|
---|
| 526 | supR3HardenedErrorV(rc, fFatal, pszFormat, va);
|
---|
| 527 | va_end(va);
|
---|
| 528 | return rc;
|
---|
| 529 | }
|
---|
| 530 |
|
---|
| 531 |
|
---|
| 532 | /**
|
---|
| 533 | * Wrapper around snprintf which will throw a fatal error on buffer overflow.
|
---|
| 534 | *
|
---|
| 535 | * @returns Number of chars in the result string.
|
---|
| 536 | * @param pszDst The destination buffer.
|
---|
| 537 | * @param cchDst The size of the buffer.
|
---|
| 538 | * @param pszFormat The format string.
|
---|
| 539 | * @param ... Format arguments.
|
---|
| 540 | */
|
---|
| 541 | static size_t supR3HardenedStrPrintf(char *pszDst, size_t cchDst, const char *pszFormat, ...)
|
---|
| 542 | {
|
---|
| 543 | va_list va;
|
---|
| 544 | va_start(va, pszFormat);
|
---|
| 545 | #ifdef _MSC_VER
|
---|
| 546 | int cch = _vsnprintf(pszDst, cchDst, pszFormat, va);
|
---|
| 547 | #else
|
---|
| 548 | int cch = vsnprintf(pszDst, cchDst, pszFormat, va);
|
---|
| 549 | #endif
|
---|
| 550 | va_end(va);
|
---|
| 551 | if ((unsigned)cch >= cchDst || cch < 0)
|
---|
| 552 | supR3HardenedFatal("supR3HardenedStrPrintf: buffer overflow, %d >= %lu\n", cch, (long)cchDst);
|
---|
| 553 | return cch;
|
---|
| 554 | }
|
---|
| 555 |
|
---|
| 556 |
|
---|
| 557 | /**
|
---|
| 558 | * Attempts to open /dev/vboxdrv (or equvivalent).
|
---|
| 559 | *
|
---|
| 560 | * @remarks This function will not return on failure.
|
---|
| 561 | */
|
---|
| 562 | static void supR3HardenedMainOpenDevice(void)
|
---|
| 563 | {
|
---|
| 564 | int rc = suplibOsInit(&g_SupPreInitData.Data, false);
|
---|
| 565 | if (RT_SUCCESS(rc))
|
---|
| 566 | return;
|
---|
| 567 |
|
---|
| 568 | switch (rc)
|
---|
| 569 | {
|
---|
[13458] | 570 | /** @todo better messages! */
|
---|
[11725] | 571 | case VERR_VM_DRIVER_NOT_INSTALLED:
|
---|
[13458] | 572 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
[18242] | 573 | "Kernel driver not installed");
|
---|
[11725] | 574 | case VERR_VM_DRIVER_NOT_ACCESSIBLE:
|
---|
[13458] | 575 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
[18242] | 576 | "Kernel driver not accessible");
|
---|
[11725] | 577 | case VERR_VM_DRIVER_LOAD_ERROR:
|
---|
[13458] | 578 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
| 579 | "VERR_VM_DRIVER_LOAD_ERROR");
|
---|
[11725] | 580 | case VERR_VM_DRIVER_OPEN_ERROR:
|
---|
[13458] | 581 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
| 582 | "VERR_VM_DRIVER_OPEN_ERROR");
|
---|
[11725] | 583 | case VERR_VM_DRIVER_VERSION_MISMATCH:
|
---|
[13458] | 584 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
[18242] | 585 | "Kernel driver version mismatch");
|
---|
[11725] | 586 | case VERR_ACCESS_DENIED:
|
---|
[13458] | 587 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
| 588 | "VERR_ACCESS_DENIED");
|
---|
[18242] | 589 | case VERR_NO_MEMORY:
|
---|
| 590 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
| 591 | "Kernel memory allocation/mapping failed");
|
---|
[11725] | 592 | default:
|
---|
[13458] | 593 | supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc,
|
---|
| 594 | "Unknown rc=%d", rc);
|
---|
[11725] | 595 | }
|
---|
| 596 | }
|
---|
| 597 |
|
---|
| 598 |
|
---|
[13458] | 599 | #ifdef SUP_HARDENED_SUID
|
---|
[15314] | 600 |
|
---|
[11725] | 601 | /**
|
---|
[15314] | 602 | * Grabs extra non-root capabilities / privileges that we might require.
|
---|
| 603 | *
|
---|
| 604 | * This is currently only used for being able to do ICMP from the NAT engine.
|
---|
| 605 | *
|
---|
| 606 | * @note We still have root privileges at the time of this call.
|
---|
[13458] | 607 | */
|
---|
[15314] | 608 | static void supR3HardenedMainGrabCapabilites(void)
|
---|
[13458] | 609 | {
|
---|
[15180] | 610 | # if defined(RT_OS_LINUX)
|
---|
[13458] | 611 | /*
|
---|
[15180] | 612 | * We are about to drop all our privileges. Remove all capabilities but
|
---|
| 613 | * keep the cap_net_raw capability for ICMP sockets for the NAT stack.
|
---|
| 614 | */
|
---|
[16050] | 615 | if (g_uCaps != 0)
|
---|
| 616 | {
|
---|
[15871] | 617 | # ifdef USE_LIB_PCAP
|
---|
[16050] | 618 | /* XXX cap_net_bind_service */
|
---|
| 619 | if (!cap_set_proc(cap_from_text("all-eip cap_net_raw+ep")))
|
---|
| 620 | prctl(PR_SET_KEEPCAPS, /*keep=*/1, 0, 0, 0);
|
---|
[15871] | 621 | # else
|
---|
[16048] | 622 | cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
|
---|
| 623 | cap_user_data_t cap = (cap_user_data_t)alloca(sizeof(*cap));
|
---|
| 624 | memset(hdr, 0, sizeof(*hdr));
|
---|
| 625 | hdr->version = _LINUX_CAPABILITY_VERSION;
|
---|
| 626 | memset(cap, 0, sizeof(*cap));
|
---|
| 627 | cap->effective = g_uCaps;
|
---|
| 628 | cap->permitted = g_uCaps;
|
---|
| 629 | if (!capset(hdr, cap))
|
---|
| 630 | prctl(PR_SET_KEEPCAPS, /*keep=*/1, 0, 0, 0);
|
---|
[16050] | 631 | # endif /* !USE_LIB_PCAP */
|
---|
[16048] | 632 | }
|
---|
[15299] | 633 |
|
---|
[15270] | 634 | # elif defined(RT_OS_SOLARIS)
|
---|
| 635 | /*
|
---|
[15298] | 636 | * Add net_icmpaccess privilege to permitted, effective and inheritable privileges
|
---|
[15270] | 637 | * before dropping root privileges.
|
---|
| 638 | */
|
---|
[15298] | 639 | priv_set_t *pPrivSet = priv_str_to_set("basic", ",", NULL);
|
---|
| 640 | if (pPrivSet)
|
---|
[15270] | 641 | {
|
---|
[15298] | 642 | priv_addset(pPrivSet, PRIV_NET_ICMPACCESS);
|
---|
| 643 | int rc = setppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
|
---|
| 644 | if (!rc)
|
---|
[15270] | 645 | {
|
---|
[15298] | 646 | rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
|
---|
| 647 | if (!rc)
|
---|
[15270] | 648 | {
|
---|
[15298] | 649 | rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
|
---|
| 650 | if (rc)
|
---|
[15313] | 651 | supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effectives privilege set.\n");
|
---|
[15270] | 652 | }
|
---|
| 653 | else
|
---|
[15313] | 654 | supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
|
---|
[15270] | 655 | }
|
---|
| 656 | else
|
---|
[15314] | 657 | supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set inheritable privilege set.\n");
|
---|
[15271] | 658 |
|
---|
[15298] | 659 | priv_freeset(pPrivSet);
|
---|
[15270] | 660 | }
|
---|
| 661 | else
|
---|
[15313] | 662 | supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to get basic privilege set.\n");
|
---|
[15298] | 663 |
|
---|
[15180] | 664 | # endif
|
---|
[15314] | 665 | }
|
---|
[15180] | 666 |
|
---|
[16048] | 667 | /*
|
---|
| 668 | * Look at the environment for some special options.
|
---|
| 669 | */
|
---|
| 670 | static void supR3GrabOptions(void)
|
---|
| 671 | {
|
---|
| 672 | const char *pszOpt;
|
---|
| 673 |
|
---|
| 674 | # ifdef RT_OS_LINUX
|
---|
| 675 | g_uCaps = 0;
|
---|
| 676 |
|
---|
| 677 | /*
|
---|
[16050] | 678 | * Do _not_ perform any capability-related system calls for root processes
|
---|
| 679 | * (leaving g_uCaps at 0).
|
---|
[16053] | 680 | * (Hint: getuid gets the real user id, not the effective.)
|
---|
[16048] | 681 | */
|
---|
[16050] | 682 | if (getuid() != 0)
|
---|
| 683 | {
|
---|
| 684 | /*
|
---|
| 685 | * CAP_NET_RAW.
|
---|
| 686 | * Default: enabled.
|
---|
| 687 | * Can be disabled with 'export VBOX_HARD_CAP_NET_RAW=0'.
|
---|
| 688 | */
|
---|
| 689 | pszOpt = getenv("VBOX_HARD_CAP_NET_RAW");
|
---|
| 690 | if ( !pszOpt
|
---|
[16051] | 691 | || memcmp(pszOpt, "0", sizeof("0")) != 0)
|
---|
[16050] | 692 | g_uCaps = CAP_TO_MASK(CAP_NET_RAW);
|
---|
[16048] | 693 |
|
---|
[16050] | 694 | /*
|
---|
| 695 | * CAP_NET_BIND_SERVICE.
|
---|
| 696 | * Default: disabled.
|
---|
| 697 | * Can be enabled with 'export VBOX_HARD_CAP_NET_BIND_SERVICE=1'.
|
---|
| 698 | */
|
---|
| 699 | pszOpt = getenv("VBOX_HARD_CAP_NET_BIND_SERVICE");
|
---|
| 700 | if ( pszOpt
|
---|
[16051] | 701 | && memcmp(pszOpt, "0", sizeof("0")) != 0)
|
---|
[16050] | 702 | g_uCaps |= CAP_TO_MASK(CAP_NET_BIND_SERVICE);
|
---|
| 703 | }
|
---|
[16048] | 704 | # endif
|
---|
| 705 | }
|
---|
| 706 |
|
---|
[15314] | 707 | /**
|
---|
| 708 | * Drop any root privileges we might be holding.
|
---|
| 709 | */
|
---|
| 710 | static void supR3HardenedMainDropPrivileges(void)
|
---|
| 711 | {
|
---|
[15180] | 712 | /*
|
---|
[13458] | 713 | * Try use setre[ug]id since this will clear the save uid/gid and thus
|
---|
| 714 | * leave fewer traces behind that libs like GTK+ may pick up.
|
---|
| 715 | */
|
---|
| 716 | uid_t euid, ruid, suid;
|
---|
| 717 | gid_t egid, rgid, sgid;
|
---|
| 718 | # if defined(RT_OS_DARWIN)
|
---|
| 719 | /* The really great thing here is that setreuid isn't available on
|
---|
| 720 | OS X 10.4, libc emulates it. While 10.4 have a sligtly different and
|
---|
| 721 | non-standard setuid implementation compared to 10.5, the following
|
---|
| 722 | works the same way with both version since we're super user (10.5 req).
|
---|
| 723 | The following will set all three variants of the group and user IDs. */
|
---|
| 724 | setgid(g_gid);
|
---|
| 725 | setuid(g_uid);
|
---|
| 726 | euid = geteuid();
|
---|
| 727 | ruid = suid = getuid();
|
---|
| 728 | egid = getegid();
|
---|
| 729 | rgid = sgid = getgid();
|
---|
| 730 |
|
---|
| 731 | # elif defined(RT_OS_SOLARIS)
|
---|
| 732 | /* Solaris doesn't have setresuid, but the setreuid interface is BSD
|
---|
| 733 | compatible and will set the saved uid to euid when we pass it a ruid
|
---|
| 734 | that isn't -1 (which we do). */
|
---|
| 735 | setregid(g_gid, g_gid);
|
---|
| 736 | setreuid(g_uid, g_uid);
|
---|
| 737 | euid = geteuid();
|
---|
| 738 | ruid = suid = getuid();
|
---|
| 739 | egid = getegid();
|
---|
| 740 | rgid = sgid = getgid();
|
---|
| 741 |
|
---|
| 742 | # else
|
---|
| 743 | /* This is the preferred one, full control no questions about semantics.
|
---|
| 744 | PORTME: If this isn't work, try join one of two other gangs above. */
|
---|
| 745 | setresgid(g_gid, g_gid, g_gid);
|
---|
| 746 | setresuid(g_uid, g_uid, g_uid);
|
---|
| 747 | if (getresuid(&ruid, &euid, &suid) != 0)
|
---|
| 748 | {
|
---|
| 749 | euid = geteuid();
|
---|
| 750 | ruid = suid = getuid();
|
---|
| 751 | }
|
---|
| 752 | if (getresgid(&rgid, &egid, &sgid) != 0)
|
---|
| 753 | {
|
---|
| 754 | egid = getegid();
|
---|
| 755 | rgid = sgid = getgid();
|
---|
| 756 | }
|
---|
| 757 | # endif
|
---|
| 758 |
|
---|
[15180] | 759 |
|
---|
[13458] | 760 | /* Check that it worked out all right. */
|
---|
| 761 | if ( euid != g_uid
|
---|
| 762 | || ruid != g_uid
|
---|
| 763 | || suid != g_uid
|
---|
| 764 | || egid != g_gid
|
---|
| 765 | || rgid != g_gid
|
---|
| 766 | || sgid != g_gid)
|
---|
| 767 | supR3HardenedFatal("SUPR3HardenedMain: failed to drop root privileges!"
|
---|
| 768 | " (euid=%d ruid=%d suid=%d egid=%d rgid=%d sgid=%d; wanted uid=%d and gid=%d)\n",
|
---|
| 769 | euid, ruid, suid, egid, rgid, sgid, g_uid, g_gid);
|
---|
[15180] | 770 |
|
---|
| 771 | # if RT_OS_LINUX
|
---|
| 772 | /*
|
---|
| 773 | * Re-enable the cap_net_raw capability which was disabled during setresuid.
|
---|
| 774 | */
|
---|
[16050] | 775 | if (g_uCaps != 0)
|
---|
| 776 | {
|
---|
[15871] | 777 | # ifdef USE_LIB_PCAP
|
---|
[16050] | 778 | /** @todo Warn if that does not work? */
|
---|
| 779 | /* XXX cap_net_bind_service */
|
---|
| 780 | cap_set_proc(cap_from_text("cap_net_raw+ep"));
|
---|
[15871] | 781 | # else
|
---|
[16048] | 782 | cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
|
---|
| 783 | cap_user_data_t cap = (cap_user_data_t)alloca(sizeof(*cap));
|
---|
| 784 | memset(hdr, 0, sizeof(*hdr));
|
---|
| 785 | hdr->version = _LINUX_CAPABILITY_VERSION;
|
---|
| 786 | memset(cap, 0, sizeof(*cap));
|
---|
| 787 | cap->effective = g_uCaps;
|
---|
| 788 | cap->permitted = g_uCaps;
|
---|
| 789 | /** @todo Warn if that does not work? */
|
---|
| 790 | capset(hdr, cap);
|
---|
[16050] | 791 | # endif /* !USE_LIB_PCAP */
|
---|
[16048] | 792 | }
|
---|
[15314] | 793 | # endif
|
---|
[13458] | 794 | }
|
---|
[15314] | 795 |
|
---|
[13458] | 796 | #endif /* SUP_HARDENED_SUID */
|
---|
| 797 |
|
---|
| 798 | /**
|
---|
[11725] | 799 | * Loads the VBoxRT DLL/SO/DYLIB, hands it the open driver,
|
---|
| 800 | * and calls RTR3Init.
|
---|
| 801 | *
|
---|
| 802 | * @param fFlags The SUPR3HardenedMain fFlags argument, passed to supR3PreInit.
|
---|
| 803 | *
|
---|
| 804 | * @remarks VBoxRT contains both IPRT and SUPR3.
|
---|
| 805 | * @remarks This function will not return on failure.
|
---|
| 806 | */
|
---|
| 807 | static void supR3HardenedMainInitRuntime(uint32_t fFlags)
|
---|
| 808 | {
|
---|
| 809 | /*
|
---|
| 810 | * Construct the name.
|
---|
| 811 | */
|
---|
| 812 | char szPath[RTPATH_MAX];
|
---|
| 813 | supR3HardenedPathSharedLibs(szPath, sizeof(szPath) - sizeof("/VBoxRT" SUPLIB_DLL_SUFF));
|
---|
| 814 | strcat(szPath, "/VBoxRT" SUPLIB_DLL_SUFF);
|
---|
| 815 |
|
---|
| 816 | /*
|
---|
| 817 | * Open it and resolve the symbols.
|
---|
| 818 | */
|
---|
| 819 | #if defined(RT_OS_WINDOWS)
|
---|
| 820 | /** @todo consider using LOAD_WITH_ALTERED_SEARCH_PATH here! */
|
---|
| 821 | HMODULE hMod = LoadLibraryEx(szPath, NULL /*hFile*/, 0 /* dwFlags */);
|
---|
| 822 | if (!hMod)
|
---|
[13458] | 823 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
|
---|
| 824 | "LoadLibraryEx(\"%s\",,) failed (rc=%d)",
|
---|
| 825 | szPath, GetLastError());
|
---|
[11843] | 826 | PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)GetProcAddress(hMod, SUP_HARDENED_SYM("RTR3InitEx"));
|
---|
| 827 | if (!pfnRTInitEx)
|
---|
[13458] | 828 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
|
---|
| 829 | "Entrypoint \"RTR3InitEx\" not found in \"%s\" (rc=%d)",
|
---|
| 830 | szPath, GetLastError());
|
---|
[11725] | 831 |
|
---|
| 832 | PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)GetProcAddress(hMod, SUP_HARDENED_SYM("supR3PreInit"));
|
---|
| 833 | if (!pfnSUPPreInit)
|
---|
[13458] | 834 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
|
---|
| 835 | "Entrypoint \"supR3PreInit\" not found in \"%s\" (rc=%d)",
|
---|
| 836 | szPath, GetLastError());
|
---|
[11725] | 837 |
|
---|
| 838 | #else
|
---|
| 839 | /* the dlopen crowd */
|
---|
| 840 | void *pvMod = dlopen(szPath, RTLD_NOW | RTLD_GLOBAL);
|
---|
| 841 | if (!pvMod)
|
---|
[13458] | 842 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
|
---|
| 843 | "dlopen(\"%s\",) failed: %s",
|
---|
| 844 | szPath, dlerror());
|
---|
[11843] | 845 | PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("RTR3InitEx"));
|
---|
| 846 | if (!pfnRTInitEx)
|
---|
[13458] | 847 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
|
---|
| 848 | "Entrypoint \"RTR3InitEx\" not found in \"%s\"!\ndlerror: %s",
|
---|
| 849 | szPath, dlerror());
|
---|
[11725] | 850 | PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("supR3PreInit"));
|
---|
| 851 | if (!pfnSUPPreInit)
|
---|
[13458] | 852 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
|
---|
| 853 | "Entrypoint \"supR3PreInit\" not found in \"%s\"!\ndlerror: %s",
|
---|
| 854 | szPath, dlerror());
|
---|
[11725] | 855 | #endif
|
---|
| 856 |
|
---|
| 857 | /*
|
---|
| 858 | * Make the calls.
|
---|
| 859 | */
|
---|
| 860 | supR3HardenedGetPreInitData(&g_SupPreInitData);
|
---|
| 861 | int rc = pfnSUPPreInit(&g_SupPreInitData, fFlags);
|
---|
| 862 | if (RT_FAILURE(rc))
|
---|
[13458] | 863 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
|
---|
| 864 | "supR3PreInit failed with rc=%d", rc);
|
---|
[11843] | 865 | const char *pszExePath = NULL;
|
---|
| 866 | #ifdef RT_OS_LINUX
|
---|
| 867 | if (!supR3HardenedMainIsProcSelfExeAccssible())
|
---|
| 868 | pszExePath = g_szSupLibHardenedExePath;
|
---|
[12111] | 869 | #endif
|
---|
[11843] | 870 | rc = pfnRTInitEx(0, pszExePath, !(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV));
|
---|
[11725] | 871 | if (RT_FAILURE(rc))
|
---|
[13458] | 872 | supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
|
---|
| 873 | "RTR3Init failed with rc=%d", rc);
|
---|
[11725] | 874 | }
|
---|
| 875 |
|
---|
| 876 |
|
---|
| 877 | /**
|
---|
| 878 | * Loads the DLL/SO/DYLIB containing the actual program and
|
---|
[13458] | 879 | * resolves the TrustedError symbol.
|
---|
| 880 | *
|
---|
| 881 | * This is very similar to supR3HardenedMainGetTrustedMain().
|
---|
| 882 | *
|
---|
| 883 | * @returns Pointer to the trusted error symbol if it is exported, NULL
|
---|
| 884 | * and no error messages otherwise.
|
---|
| 885 | * @param pszProgName The program name.
|
---|
| 886 | */
|
---|
| 887 | static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName)
|
---|
| 888 | {
|
---|
| 889 | /*
|
---|
| 890 | * Construct the name.
|
---|
| 891 | */
|
---|
| 892 | char szPath[RTPATH_MAX];
|
---|
| 893 | supR3HardenedPathAppPrivateArch(szPath, sizeof(szPath) - 10);
|
---|
| 894 | size_t cch = strlen(szPath);
|
---|
| 895 | supR3HardenedStrPrintf(&szPath[cch], sizeof(szPath) - cch, "/%s%s", pszProgName, SUPLIB_DLL_SUFF);
|
---|
| 896 |
|
---|
| 897 | /*
|
---|
| 898 | * Open it and resolve the symbol.
|
---|
| 899 | */
|
---|
| 900 | #if defined(RT_OS_WINDOWS)
|
---|
| 901 | /** @todo consider using LOAD_WITH_ALTERED_SEARCH_PATH here! */
|
---|
| 902 | HMODULE hMod = LoadLibraryEx(szPath, NULL /*hFile*/, 0 /* dwFlags */);
|
---|
| 903 | if (!hMod)
|
---|
| 904 | return NULL;
|
---|
| 905 | FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedError"));
|
---|
| 906 | if (!pfn)
|
---|
| 907 | return NULL;
|
---|
| 908 | return (PFNSUPTRUSTEDERROR)pfn;
|
---|
| 909 |
|
---|
| 910 | #else
|
---|
| 911 | /* the dlopen crowd */
|
---|
| 912 | void *pvMod = dlopen(szPath, RTLD_NOW | RTLD_GLOBAL);
|
---|
| 913 | if (!pvMod)
|
---|
| 914 | return NULL;
|
---|
| 915 | void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedError"));
|
---|
| 916 | if (!pvSym)
|
---|
| 917 | return NULL;
|
---|
| 918 | return (PFNSUPTRUSTEDERROR)(uintptr_t)pvSym;
|
---|
| 919 | #endif
|
---|
| 920 | }
|
---|
| 921 |
|
---|
| 922 |
|
---|
| 923 | /**
|
---|
| 924 | * Loads the DLL/SO/DYLIB containing the actual program and
|
---|
[11725] | 925 | * resolves the TrustedMain symbol.
|
---|
| 926 | *
|
---|
| 927 | * @returns Pointer to the trusted main of the actual program.
|
---|
| 928 | * @param pszProgName The program name.
|
---|
| 929 | * @remarks This function will not return on failure.
|
---|
| 930 | */
|
---|
[13458] | 931 | static PFNSUPTRUSTEDMAIN supR3HardenedMainGetTrustedMain(const char *pszProgName)
|
---|
[11725] | 932 | {
|
---|
| 933 | /*
|
---|
| 934 | * Construct the name.
|
---|
| 935 | */
|
---|
| 936 | char szPath[RTPATH_MAX];
|
---|
| 937 | supR3HardenedPathAppPrivateArch(szPath, sizeof(szPath) - 10);
|
---|
| 938 | size_t cch = strlen(szPath);
|
---|
| 939 | supR3HardenedStrPrintf(&szPath[cch], sizeof(szPath) - cch, "/%s%s", pszProgName, SUPLIB_DLL_SUFF);
|
---|
| 940 |
|
---|
| 941 | /*
|
---|
| 942 | * Open it and resolve the symbol.
|
---|
| 943 | */
|
---|
| 944 | #if defined(RT_OS_WINDOWS)
|
---|
| 945 | /** @todo consider using LOAD_WITH_ALTERED_SEARCH_PATH here! */
|
---|
| 946 | HMODULE hMod = LoadLibraryEx(szPath, NULL /*hFile*/, 0 /* dwFlags */);
|
---|
| 947 | if (!hMod)
|
---|
| 948 | supR3HardenedFatal("supR3HardenedMainGetTrustedMain: LoadLibraryEx(\"%s\",,) failed, rc=%d\n",
|
---|
| 949 | szPath, GetLastError());
|
---|
| 950 | FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedMain"));
|
---|
| 951 | if (!pfn)
|
---|
| 952 | supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\" (rc=%d)\n",
|
---|
| 953 | szPath, GetLastError());
|
---|
[13458] | 954 | return (PFNSUPTRUSTEDMAIN)pfn;
|
---|
[11725] | 955 |
|
---|
| 956 | #else
|
---|
| 957 | /* the dlopen crowd */
|
---|
| 958 | void *pvMod = dlopen(szPath, RTLD_NOW | RTLD_GLOBAL);
|
---|
| 959 | if (!pvMod)
|
---|
| 960 | supR3HardenedFatal("supR3HardenedMainGetTrustedMain: dlopen(\"%s\",) failed: %s\n",
|
---|
| 961 | szPath, dlerror());
|
---|
| 962 | void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedMain"));
|
---|
| 963 | if (!pvSym)
|
---|
| 964 | supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\"!\ndlerror: %s\n",
|
---|
| 965 | szPath, dlerror());
|
---|
[13458] | 966 | return (PFNSUPTRUSTEDMAIN)(uintptr_t)pvSym;
|
---|
[11725] | 967 | #endif
|
---|
| 968 | }
|
---|
| 969 |
|
---|
| 970 |
|
---|
| 971 | /**
|
---|
| 972 | * Secure main.
|
---|
| 973 | *
|
---|
| 974 | * This is used for the set-user-ID-on-execute binaries on unixy systems
|
---|
| 975 | * and when using the open-vboxdrv-via-root-service setup on Windows.
|
---|
| 976 | *
|
---|
| 977 | * This function will perform the integrity checks of the VirtualBox
|
---|
| 978 | * installation, open the support driver, open the root service (later),
|
---|
| 979 | * and load the DLL corresponding to \a pszProgName and execute its main
|
---|
| 980 | * function.
|
---|
| 981 | *
|
---|
| 982 | * @returns Return code appropriate for main().
|
---|
| 983 | *
|
---|
| 984 | * @param pszProgName The program name. This will be used to figure out which
|
---|
| 985 | * DLL/SO/DYLIB to load and execute.
|
---|
| 986 | * @param fFlags Flags.
|
---|
| 987 | * @param argc The argument count.
|
---|
| 988 | * @param argv The argument vector.
|
---|
| 989 | * @param envp The environment vector.
|
---|
| 990 | */
|
---|
| 991 | DECLHIDDEN(int) SUPR3HardenedMain(const char *pszProgName, uint32_t fFlags, int argc, char **argv, char **envp)
|
---|
| 992 | {
|
---|
| 993 | /*
|
---|
| 994 | * Note! At this point there is no IPRT, so we will have to stick
|
---|
| 995 | * to basic CRT functions that everyone agree upon.
|
---|
| 996 | */
|
---|
[11843] | 997 | g_pszSupLibHardenedProgName = pszProgName;
|
---|
[11725] | 998 | g_SupPreInitData.u32Magic = SUPPREINITDATA_MAGIC;
|
---|
| 999 | g_SupPreInitData.Data.hDevice = NIL_RTFILE;
|
---|
| 1000 | g_SupPreInitData.u32EndMagic = SUPPREINITDATA_MAGIC;
|
---|
| 1001 |
|
---|
| 1002 | #ifdef SUP_HARDENED_SUID
|
---|
[12111] | 1003 | # ifdef RT_OS_LINUX
|
---|
| 1004 | /*
|
---|
[11843] | 1005 | * On linux we have to make sure the path is initialized because we
|
---|
| 1006 | * *might* not be able to access /proc/self/exe after the seteuid call.
|
---|
| 1007 | */
|
---|
| 1008 | supR3HardenedGetFullExePath();
|
---|
[16048] | 1009 |
|
---|
[11843] | 1010 | # endif
|
---|
[13458] | 1011 |
|
---|
| 1012 | /*
|
---|
[16048] | 1013 | * Grab any options from the environment.
|
---|
| 1014 | */
|
---|
| 1015 | supR3GrabOptions();
|
---|
| 1016 |
|
---|
| 1017 | /*
|
---|
[13458] | 1018 | * Check that we're root, if we aren't then the installation is butchered.
|
---|
| 1019 | */
|
---|
| 1020 | g_uid = getuid();
|
---|
| 1021 | g_gid = getgid();
|
---|
| 1022 | if (geteuid() != 0 /* root */)
|
---|
| 1023 | supR3HardenedFatalMsg("SUPR3HardenedMain", kSupInitOp_RootCheck, VERR_PERMISSION_DENIED,
|
---|
| 1024 | "Effective UID is not root (euid=%d egid=%d uid=%d gid=%d)",
|
---|
| 1025 | geteuid(), getegid(), g_uid, g_gid);
|
---|
[11725] | 1026 | #endif
|
---|
| 1027 |
|
---|
| 1028 | /*
|
---|
| 1029 | * Validate the installation.
|
---|
| 1030 | */
|
---|
| 1031 | supR3HardenedVerifyAll(true /* fFatal */, false /* fLeaveFilesOpen */, pszProgName);
|
---|
| 1032 |
|
---|
| 1033 | /*
|
---|
| 1034 | * Open the vboxdrv device.
|
---|
| 1035 | */
|
---|
| 1036 | if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
|
---|
| 1037 | supR3HardenedMainOpenDevice();
|
---|
| 1038 |
|
---|
| 1039 | /*
|
---|
| 1040 | * Open the root service connection.
|
---|
| 1041 | */
|
---|
| 1042 | //if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_SVC))
|
---|
| 1043 | //supR3HardenedMainOpenService(&g_SupPreInitData, true /* fFatal */);
|
---|
| 1044 |
|
---|
| 1045 | #ifdef SUP_HARDENED_SUID
|
---|
| 1046 | /*
|
---|
[15314] | 1047 | * Grab additional capabilities / privileges.
|
---|
| 1048 | */
|
---|
| 1049 | supR3HardenedMainGrabCapabilites();
|
---|
| 1050 |
|
---|
| 1051 | /*
|
---|
[13458] | 1052 | * Drop any root privileges we might be holding (won't return on failure)
|
---|
[11725] | 1053 | */
|
---|
[13458] | 1054 | supR3HardenedMainDropPrivileges();
|
---|
[11725] | 1055 | #endif
|
---|
| 1056 |
|
---|
| 1057 | /*
|
---|
| 1058 | * Load the IPRT, hand the SUPLib part the open driver and
|
---|
| 1059 | * call RTR3Init.
|
---|
| 1060 | */
|
---|
| 1061 | supR3HardenedMainInitRuntime(fFlags);
|
---|
| 1062 |
|
---|
| 1063 | /*
|
---|
| 1064 | * Load the DLL/SO/DYLIB containing the actual program
|
---|
| 1065 | * and pass control to it.
|
---|
| 1066 | */
|
---|
[13458] | 1067 | PFNSUPTRUSTEDMAIN pfnTrustedMain = supR3HardenedMainGetTrustedMain(pszProgName);
|
---|
[11725] | 1068 | return pfnTrustedMain(argc, argv, envp);
|
---|
| 1069 | }
|
---|
| 1070 |
|
---|
| 1071 |
|
---|