VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp@ 103914

Last change on this file since 103914 was 99739, checked in by vboxsync, 19 months ago

*: doxygen corrections (mostly about removing @returns from functions returning void).

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 99.7 KB
Line 
1/* $Id: SUPR3HardenedMain.cpp 99739 2023-05-11 01:01:08Z vboxsync $ */
2/** @file
3 * VirtualBox Support Library - Hardened main().
4 */
5
6/*
7 * Copyright (C) 2006-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37/** @page pg_hardening %VirtualBox %VM Process Hardening
38 *
39 * The %VM process hardening is to prevent malicious software from using
40 * %VirtualBox as a vehicle to obtain kernel level access.
41 *
42 * The %VirtualBox %VMM requires supervisor (kernel) level access to the CPU.
43 * For both practical and historical reasons, part of the %VMM is realized in
44 * ring-3, with a rich interface to the kernel part. While the device
45 * emulations can be executed exclusively in ring-3, we have performance
46 * optimizations that loads device emulation code into ring-0 and our special
47 * raw-mode execution context (none VT-x/AMD-V mode) for handling frequent
48 * operations a lot more efficiently. These share data between all three
49 * context (ring-3, ring-0 and raw-mode). All this poses a rather broad attack
50 * surface, which the hardening protects.
51 *
52 * The hardening focuses primarily on restricting access to the support driver,
53 * VBoxDrv or vboxdrv depending on the OS, as it is ultimately the link and
54 * instigator of the communication between ring-3 and the ring-0 and raw-mode
55 * contexts. A secondary focus is to make sure malicious code cannot be loaded
56 * and executed in the %VM process. Exactly how we go about this depends a lot
57 * on the host OS.
58 *
59 * @section sec_hardening_supdrv The Support Driver Interfaces
60 *
61 * The support driver has several interfaces thru which it can be accessed:
62 * - /dev/vboxdrv (win: \\Device\\VBoxDrv) for full unrestricted access.
63 * Offers a rich I/O control interface, which needs protecting.
64 * - /dev/vboxdrvu (win: \\Device\\VBoxDrvU) for restricted access, which
65 * VBoxSVC uses to query VT-x and AMD-V capabilities. This does not
66 * require protecting, though we limit it to the vboxgroup on some
67 * systems.
68 * - \\Device\\VBoxDrvStub on Windows for protecting the second stub
69 * process and its child, the %VM process. This is an open+close
70 * interface, only available to partially verified stub processes.
71 * - \\Device\\VBoxDrvErrorInfo on Windows for obtaining detailed error
72 * information on a previous attempt to open \\Device\\VBoxDrv or
73 * \\Device\\VBoxDrvStub. Open, read and close only interface.
74 *
75 * The rest of VBox accesses the device interface thru the support library,
76 * @ref grp_sup "SUPR3" / sup.h.
77 *
78 * The support driver also exposes a set of functions and data that other VBox
79 * ring-0 modules can import from. This includes much of the IPRT we need in
80 * the ring-0 part of the %VMM and device emulations.
81 *
82 * The ring-0 part of the %VMM and device emulations are loaded via the
83 * #SUPR3LoadModule and #SUPR3LoadServiceModule support library function, which
84 * both translates to a sequence of I/O controls against /dev/vboxdrv. On
85 * Windows we use the native kernel loader to load the module, while on the
86 * other systems ring-3 prepares the bits with help from the IPRT loader code.
87 *
88 *
89 * @section sec_hardening_unix Hardening on UNIX-like OSes
90 *
91 * On UNIX-like systems (Solaris, Linux, darwin, freebsd, ...) we put our trust
92 * in root and that root knows what he/she/it is doing.
93 *
94 * We only allow root to get full unrestricted access to the support driver.
95 * The device node corresponding to unrestricted access (/dev/vboxdrv) is own by
96 * root and has a 0600 access mode (i.e. only accessible to the owner, root). In
97 * addition to this file system level restriction, the support driver also
98 * checks that the effective user ID (EUID) is root when it is being opened.
99 *
100 * The %VM processes temporarily assume root privileges using the set-uid-bit on
101 * the executable with root as owner. In fact, all the files and directories we
102 * install are owned by root and the wheel (or equivalent gid = 0) group,
103 * including extension pack files.
104 *
105 * The executable with the set-uid-to-root-bit set is a stub binary that has no
106 * unnecessary library dependencies (only libc, pthreads, dynamic linker) and
107 * simply calls #SUPR3HardenedMain. It does the following:
108 * 1. Validate the VirtualBox installation (#supR3HardenedVerifyAll):
109 * - Check that the executable file of the process is one of the known
110 * VirtualBox executables.
111 * - Check that all mandatory files are present.
112 * - Check that all installed files and directories (both optional and
113 * mandatory ones) are owned by root:wheel and are not writable by
114 * anyone except root.
115 * - Check that all the parent directories, all the way up to the root
116 * if possible, only permits root (or system admin) to change them.
117 * This is that to rule out unintentional rename races.
118 * - On some systems we may also validate the cryptographic signtures
119 * of executable images.
120 *
121 * 2. Open a file descriptor for the support device driver
122 * (#supR3HardenedMainOpenDevice).
123 *
124 * 3. Grab ICMP capabilities for NAT ping support, if required by the OS
125 * (#supR3HardenedMainGrabCapabilites).
126 *
127 * 4. Correctly drop the root privileges
128 * (#supR3HardenedMainDropPrivileges).
129 *
130 * 5. Load the VBoxRT dynamic link library and hand over the file
131 * descriptor to the support library code in it
132 * (#supR3HardenedMainInitRuntime).
133 *
134 * 6. Load the dynamic library containing the actual %VM front end code and
135 * run it (tail of #SUPR3HardenedMain).
136 *
137 * The set-uid-to-root stub executable is paired with a dynamic link library
138 * which export one TrustedMain entry point (see #FNSUPTRUSTEDMAIN) that we
139 * call. In case of error reporting, the library may also export a TrustedError
140 * function (#FNSUPTRUSTEDERROR).
141 *
142 * That the set-uid-to-root-bit modifies the dynamic linker behavior on all
143 * systems, even after we've dropped back to the real user ID, is something we
144 * take advantage of. The dynamic linkers takes special care to prevent users
145 * from using clever tricks to inject their own code into set-uid processes and
146 * causing privilege escalation issues. This is the exact help we need.
147 *
148 * The VirtualBox installation location is hardcoded, which means the any
149 * dynamic linker paths embedded or inferred from the executable and dynamic
150 * libraries are also hardcoded. This helps eliminating search path attack
151 * vectors at the cost of being inflexible regarding installation location.
152 *
153 * In addition to what the dynamic linker does for us, the VirtualBox code will
154 * not directly be calling either RTLdrLoad or dlopen to load dynamic link
155 * libraries into the process. Instead it will call #SUPR3HardenedLdrLoad,
156 * #SUPR3HardenedLdrLoadAppPriv and #SUPR3HardenedLdrLoadPlugIn to do the
157 * loading. These functions will perform the same validations on the file being
158 * loaded as #SUPR3HardenedMain did in its validation step. So, anything we
159 * load must be installed with root/wheel as owner/group, the directory we load
160 * it from must also be owned by root:wheel and now allow for renaming the file.
161 * Similar ownership restrictions applies to all the parent directories (except
162 * on darwin).
163 *
164 * So, we place the responsibility of not installing malicious software on the
165 * root user on UNIX-like systems. Which is fair enough, in our opinion.
166 *
167 *
168 * @section sec_hardening_win Hardening on Windows
169 *
170 * On Windows we cannot put the same level or trust in the Administrator user(s)
171 * (equivalent of root/wheel on unix) as on the UNIX-like systems, which
172 * complicates things greatly.
173 *
174 * Some of the blame for this can be given to Windows being a descendant /
175 * replacement for a set of single user systems: DOS, Windows 1.0-3.11 Windows
176 * 95-ME, and OS/2. Users of NT 3.1 and later was inclined to want to always
177 * run it with full root/administrator privileges like they had done on the
178 * predecessors, while Microsoft didn't provide much incentive for more secure
179 * alternatives. Bad idea, security wise, but execellent for the security
180 * software industry. For this reason using a set-uid-to-root approach is
181 * pointless, even if Windows had one.
182 *
183 * So, in order to protect access to the support driver and protect the %VM
184 * process while it's running we have to do a lot more work. A keystone in the
185 * defences is cryptographic code signing. Here's the short version of what we
186 * do:
187 * - Minimal stub executable, signed with the same certificate as the
188 * kernel driver.
189 *
190 * - The stub executable respawns itself twice, hooking the NTDLL init
191 * routine to perform protection tasks as early as possible. The parent
192 * stub helps keep in the child clean for verification as does the
193 * support driver.
194 *
195 * - In order to protect against loading unwanted code into the process,
196 * the stub processes installs DLL load hooks with NTDLL as well as
197 * directly intercepting the LdrLoadDll and NtCreateSection APIs.
198 *
199 * - The support driver will verify all but the initial process very
200 * thoroughly before allowing them protection and in the final case full
201 * unrestricted access.
202 *
203 *
204 * @subsection sec_hardening_win_protsoft 3rd Party "Protection" Software
205 *
206 * What makes our life REALLY difficult on Windows is this 3rd party "security"
207 * software which is more or less required to keep a Windows system safe for
208 * normal users and all corporate IT departments rightly insists on installing.
209 * After the kernel patching clampdown in Vista, anti-* software has to do a
210 * lot more mucking about in user mode to get their job (kind of) done. So, it
211 * is common practice to patch a lot of NTDLL, KERNEL32, the executable import
212 * table, load extra DLLs into the process, allocate executable memory in the
213 * process (classic code injection) and more.
214 *
215 * The BIG problem with all this is that it is indistinguishable from what
216 * malicious software would be doing in order to intercept process activity
217 * (network sniffing, maybe password snooping) or gain a level of kernel access
218 * via the support driver. So, the "protection" software is what is currently
219 * forcing us to do the pre-NTDLL initialization.
220 *
221 *
222 * @subsection sec_hardening_win_1st_stub The Initial Stub Process
223 *
224 * We share the stub executable approach with the UNIX-like systems, so there's
225 * the #SUPR3HardenedMain calling stub executable with its partner DLL exporting
226 * TrustedMain and TrustedError. However, the stub executable does a lot more,
227 * while doing it in a more bare metal fashion:
228 * - It does not use the Microsoft CRT, what we need of CRT functions comes
229 * from IPRT.
230 * - It does not statically import anything. This is to avoid having an
231 * import table that can be patched to intercept our calls or extended to
232 * load additional DLLs.
233 * - Direct NT system calls. System calls normally going thru NTDLL, but
234 * since there is so much software out there which wants to patch known
235 * NTDLL entry points to control our software (either for good or
236 * malicious reasons), we do it ourselves.
237 *
238 * The initial stub process is not really to be trusted, though we try our best
239 * to limit potential harm (user mode debugger checks, disable thread creation).
240 * So, when it enters #SUPR3HardenedMain we only call #supR3HardenedVerifyAll to
241 * verify the installation (known executables and DLLs, checking their code
242 * signing signatures, keeping them all open to deny deletion and replacing) and
243 * does a respawn via #supR3HardenedWinReSpawn.
244 *
245 *
246 * @subsection sec_hardening_win_2nd_stub The Second Stub Process
247 *
248 * The second stub process will be created in suspended state, i.e. the main
249 * thread is suspended before it executes a single instruction. It is also
250 * created with a less generous ACLs, though this doesn't protect us from admin
251 * users. In order for #SUPR3HardenedMain to figure that it is the second stub
252 * process, the zeroth command line argument has been replaced by a known magic
253 * string (UUID).
254 *
255 * Now, before the process starts executing, the parent (initial stub) will
256 * patch the LdrInitializeThunk entry point in NTDLL to call
257 * #supR3HardenedEarlyProcessInit via #supR3HardenedEarlyProcessInitThunk. The
258 * parent will also plant some synchronization stuff via #g_ProcParams (NTDLL
259 * location, inherited event handles and associated ping-pong equipment).
260 *
261 * The LdrInitializeThunk entry point of NTDLL is where the kernel sets up
262 * process execution to start executing (via a user alert, so it is not subject
263 * to SetThreadContext). LdrInitializeThunk performs process, NTDLL and
264 * sub-system client (kernel32) initialization. A lot of "protection" software
265 * uses triggers in this initialization sequence (like the KERNEL32.DLL load
266 * event), so we avoid quite a bit of problems by getting our stuff done early
267 * on.
268 *
269 * However, there are also those that uses events that triggers immediately when
270 * the process is created or/and starts executing the first instruction. But we
271 * can easily counter these as we have a known process state we can restore. So,
272 * the first thing that #supR3HardenedEarlyProcessInit does is to signal the
273 * parent to perform a child purification, so the potentially evil influences
274 * can be exorcised.
275 *
276 * What the parent does during the purification is very similar to what the
277 * kernel driver will do later on when verifying the second stub and the %VM
278 * processes, except that instead of failing when encountering an shortcoming it
279 * will take corrective actions:
280 * - Executable memory regions not belonging to a DLL mapping will be
281 * attempted freed, and we'll only fail if we can't evict them.
282 * - All pages in the executable images in the process (should be just the
283 * stub executable and NTDLL) will be compared to the pristine fixed-up
284 * copy prepared by the IPRT PE loader code, restoring any bytes which
285 * appears differently in the child. (#g_ProcParams is exempted,
286 * LdrInitializeThunk is set to call NtTerminateThread.)
287 * - Unwanted DLLs will be unloaded (we have a set of DLLs we like).
288 *
289 * Before signalling the second stub process that it has been purified and should
290 * get on with it, the parent will close all handles with unrestricted access to
291 * the process and thread so that the initial stub process no longer can
292 * influence the child in any really harmful way. (The caller of CreateProcess
293 * usually receives handles with unrestricted access to the child process and
294 * its main thread. These could in theory be used with DuplicateHandle or
295 * WriteProcessMemory to get at the %VM process if we're not careful.)
296 *
297 * #supR3HardenedEarlyProcessInit will continue with opening the log file
298 * (requires command line parsing). It will continue to initialize a bunch of
299 * global variables, system calls and trustworthy/harmless NTDLL imports.
300 * #supR3HardenedWinInit is then called to setup image verification, that is:
301 * - Hook the NtCreateSection entry point in NTDLL so we can check all
302 * executable mappings before they're created and can be mapped. The
303 * NtCreateSection code jumps to #supR3HardenedMonitor_NtCreateSection.
304 * - Hook (ditto) the LdrLoadDll entry point in NTDLL so we can
305 * pre-validate all images that gets loaded the normal way (partly
306 * because the NtCreateSection context is restrictive because the NTDLL
307 * loader lock is usually held, which prevents us from safely calling
308 * WinVerityTrust). The LdrLoadDll code jumps to
309 * #supR3HardenedMonitor_LdrLoadDll.
310 *
311 * The image/DLL verification hooks are at this point able to verify DLLs
312 * containing embedded code signing signatures, and will restrict the locations
313 * from which DLLs will be loaded. When #SUPR3HardenedMain gets going later on,
314 * they will start insisting on everything having valid signatures, either
315 * embedded or in a signed installer catalog file.
316 *
317 * The function also irrevocably disables debug notifications related to the
318 * current thread, just to make attaching a debugging that much more difficult
319 * and less useful.
320 *
321 * Now, the second stub process will open the so called stub device
322 * (\\Device\\VBoxDrvStub), that is a special support driver device node that
323 * tells the support driver to:
324 * - Protect the process against the OpenProcess and OpenThread attack
325 * vectors by stripping risky access rights.
326 * - Check that the process isn't being debugged.
327 * - Check that the process contains exactly one thread.
328 * - Check that the process doesn't have any unknown DLLs loaded into it.
329 * - Check that the process doesn't have any executable memory (other than
330 * DLL sections) in it.
331 * - Check that the process executable is a known VBox executable which may
332 * access the support driver.
333 * - Check that the process executable is signed with the same code signing
334 * certificate as the driver and that the on disk image is valid
335 * according to its embedded signature.
336 * - Check all the signature of all DLLs in the process (NTDLL) if they are
337 * signed, and only accept unsigned ones in versions where they are known
338 * not to be signed.
339 * - Check that the code and readonly parts of the executable and DLLs
340 * mapped into the process matches the on disk content (no patches other
341 * than our own two in NTDLL are allowed).
342 *
343 * Once granted access to the stub device, #supR3HardenedEarlyProcessInit will
344 * restore the LdrInitializeThunk code and let the process perform normal
345 * initialization. Leading us to #SUPR3HardenedMain where we detect that this
346 * is the 2nd stub process and does another respawn.
347 *
348 *
349 * @subsection sec_hardening_win_3rd_stub The Final Stub / VM Process
350 *
351 * The third stub process is what becomes the %VM process. Because the parent
352 * has opened \\Device\\VBoxDrvSub, it is protected from malicious OpenProcess &
353 * OpenThread calls from the moment of inception, practically speaking.
354 *
355 * It goes thru the same suspended creation, patching, purification and such as
356 * its parent (the second stub process). However, instead of opening
357 * \\Device\\VBoxDrvStub from #supR3HardenedEarlyProcessInit, it opens the
358 * support driver for full unrestricted access, i.e. \\Device\\VBoxDrv.
359 *
360 * The support driver will perform the same checks as it did when
361 * \\Device\\VBoxDrvStub was opened, but in addition it will:
362 * - Check that the process is the first child of a process that opened
363 * \\Device\\VBoxDrvStub.
364 * - Check that the parent process is still alive.
365 * - Scan all open handles in the system for potentially harmful ones to
366 * the process or the primary thread.
367 *
368 * Knowing that the process is genuinly signed with the same certificate as the
369 * kernel driver, and the exectuable code in the process is either shipped by us
370 * or Microsoft, the support driver will trust it with full access and to keep
371 * the handle secure.
372 *
373 * We also trust the protection the support driver gives the process to keep out
374 * malicious ring-3 code, and therefore any code, patching or other mysterious
375 * stuff that enteres the process must be from kernel mode and that we can trust
376 * it (the alternative interpretation is that the kernel has been breanched
377 * already, which isn't our responsibility). This means that, the anti-software
378 * products can do whatever they like from this point on. However, should they
379 * do unrevertable changes to the process before this point, VirtualBox won't
380 * work.
381 *
382 * As in the second stub process, we'll now do normal process initialization and
383 * #SUPR3HardenedMain will take control. It will detect that it is being called
384 * by the 3rd stub process because of a different magic string starting the
385 * command line, and not respawn itself any more. #SUPR3HardenedMain will
386 * recheck the VirtualBox installation, keeping all known files open just like
387 * in two previous stub processes.
388 *
389 * It will then load the Windows cryptographic API and load the trusted root
390 * certificates from the Windows store. The API enables using installation
391 * catalog files for signature checking as well as providing a second
392 * verification in addition to our own implementation (IPRT). The certificates
393 * allows our signature validation implementation to validate all embedded
394 * signatures, not just the microsoft ones and the one signed by our own
395 * certificate.
396 *
397 */
398
399
400/*********************************************************************************************************************************
401* Header Files *
402*********************************************************************************************************************************/
403#if defined(RT_OS_OS2)
404# define INCL_BASE
405# define INCL_ERRORS
406# include <os2.h>
407# include <stdio.h>
408# include <stdlib.h>
409# include <dlfcn.h>
410# include <unistd.h>
411
412#elif RT_OS_WINDOWS
413# include <iprt/nt/nt-and-windows.h>
414
415#else /* UNIXes */
416# ifdef RT_OS_DARWIN
417# define _POSIX_C_SOURCE 1 /* pick the correct prototype for unsetenv. */
418# endif
419# include <iprt/types.h> /* stdint fun on darwin. */
420
421# include <stdio.h>
422# include <stdlib.h>
423# include <dlfcn.h>
424# include <limits.h>
425# include <errno.h>
426# include <unistd.h>
427# include <sys/stat.h>
428# include <sys/time.h>
429# include <sys/types.h>
430# if defined(RT_OS_LINUX)
431# undef USE_LIB_PCAP /* don't depend on libcap as we had to depend on either
432 libcap1 or libcap2 */
433
434# undef _POSIX_SOURCE
435# include <linux/types.h> /* sys/capabilities from uek-headers require this */
436# include <sys/capability.h>
437# include <sys/prctl.h>
438# ifndef CAP_TO_MASK
439# define CAP_TO_MASK(cap) RT_BIT(cap)
440# endif
441# elif defined(RT_OS_FREEBSD)
442# include <sys/param.h>
443# include <sys/sysctl.h>
444# elif defined(RT_OS_SOLARIS)
445# include <priv.h>
446# endif
447# include <pwd.h>
448# ifdef RT_OS_DARWIN
449# include <mach-o/dyld.h>
450# endif
451
452#endif
453
454#include <VBox/sup.h>
455#include <VBox/err.h>
456#ifdef RT_OS_WINDOWS
457# include <VBox/version.h>
458# include <iprt/utf16.h>
459#endif
460#include <iprt/ctype.h>
461#include <iprt/string.h>
462#include <iprt/initterm.h>
463#include <iprt/param.h>
464#include <iprt/path.h>
465
466#include "SUPLibInternal.h"
467
468
469/*********************************************************************************************************************************
470* Defined Constants And Macros *
471*********************************************************************************************************************************/
472/* This mess is temporary after eliminating a define duplicated in SUPLibInternal.h. */
473#if !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_L4)
474# ifndef SUP_HARDENED_SUID
475# error "SUP_HARDENED_SUID is NOT defined?!?"
476# endif
477#else
478# ifdef SUP_HARDENED_SUID
479# error "SUP_HARDENED_SUID is defined?!?"
480# endif
481#endif
482
483/** @def SUP_HARDENED_SYM
484 * Decorate a symbol that's resolved dynamically.
485 */
486#ifdef RT_OS_OS2
487# define SUP_HARDENED_SYM(sym) "_" sym
488#else
489# define SUP_HARDENED_SYM(sym) sym
490#endif
491
492
493/*********************************************************************************************************************************
494* Structures and Typedefs *
495*********************************************************************************************************************************/
496/** @see RTR3InitEx */
497typedef DECLCALLBACKTYPE(int, FNRTR3INITEX,(uint32_t iVersion, uint32_t fFlags, int cArgs,
498 char **papszArgs, const char *pszProgramPath));
499typedef FNRTR3INITEX *PFNRTR3INITEX;
500
501/** @see RTLogRelPrintf */
502typedef DECLCALLBACKTYPE(void, FNRTLOGRELPRINTF,(const char *pszFormat, ...));
503typedef FNRTLOGRELPRINTF *PFNRTLOGRELPRINTF;
504
505
506/**
507 * Descriptor of an environment variable to purge.
508 */
509typedef struct SUPENVPURGEDESC
510{
511 /** Name of the environment variable to purge. */
512 const char *pszEnv;
513 /** The length of the variable name. */
514 uint8_t cchEnv;
515 /** Flag whether a failure in purging the variable leads to
516 * a fatal error resulting in an process exit. */
517 bool fPurgeErrFatal;
518} SUPENVPURGEDESC;
519/** Pointer to a environment variable purge descriptor. */
520typedef SUPENVPURGEDESC *PSUPENVPURGEDESC;
521/** Pointer to a const environment variable purge descriptor. */
522typedef const SUPENVPURGEDESC *PCSUPENVPURGEDESC;
523
524/**
525 * Descriptor of an command line argument to purge.
526 */
527typedef struct SUPARGPURGEDESC
528{
529 /** Name of the argument to purge. */
530 const char *pszArg;
531 /** The length of the argument name. */
532 uint8_t cchArg;
533 /** Flag whether the argument is followed by an extra argument
534 * which must be purged too */
535 bool fTakesValue;
536} SUPARGPURGEDESC;
537/** Pointer to a environment variable purge descriptor. */
538typedef SUPARGPURGEDESC *PSUPARGPURGEDESC;
539/** Pointer to a const environment variable purge descriptor. */
540typedef const SUPARGPURGEDESC *PCSUPARGPURGEDESC;
541
542
543/*********************************************************************************************************************************
544* Global Variables *
545*********************************************************************************************************************************/
546/** The pre-init data we pass on to SUPR3 (residing in VBoxRT). */
547static SUPPREINITDATA g_SupPreInitData;
548/** The program executable path. */
549#ifndef RT_OS_WINDOWS
550static
551#endif
552char g_szSupLibHardenedExePath[RTPATH_MAX];
553/** The application bin directory path. */
554static char g_szSupLibHardenedAppBinPath[RTPATH_MAX];
555/** The offset into g_szSupLibHardenedExePath of the executable name. */
556static size_t g_offSupLibHardenedExecName;
557/** The length of the executable name in g_szSupLibHardenedExePath. */
558static size_t g_cchSupLibHardenedExecName;
559
560/** The program name. */
561static const char *g_pszSupLibHardenedProgName;
562/** The flags passed to SUPR3HardenedMain - SUPSECMAIN_FLAGS_XXX. */
563static uint32_t g_fSupHardenedMain;
564
565#ifdef SUP_HARDENED_SUID
566/** The real UID at startup. */
567static uid_t g_uid;
568/** The real GID at startup. */
569static gid_t g_gid;
570# ifdef RT_OS_LINUX
571static uint32_t g_uCaps;
572static uint32_t g_uCapsVersion;
573# endif
574#endif
575
576/** The startup log file. */
577#ifdef RT_OS_WINDOWS
578static HANDLE g_hStartupLog = NULL;
579#else
580static int g_hStartupLog = -1;
581#endif
582/** The number of bytes we've written to the startup log. */
583static uint32_t volatile g_cbStartupLog = 0;
584
585/** The current SUPR3HardenedMain state / location. */
586SUPR3HARDENEDMAINSTATE g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED;
587AssertCompileSize(g_enmSupR3HardenedMainState, sizeof(uint32_t));
588
589#ifdef RT_OS_WINDOWS
590/** Pointer to VBoxRT's RTLogRelPrintf function so we can write errors to the
591 * release log at runtime. */
592static PFNRTLOGRELPRINTF g_pfnRTLogRelPrintf = NULL;
593/** Log volume name (for attempting volume flush). */
594static RTUTF16 g_wszStartupLogVol[16];
595#endif
596
597/** Environment variables to purge from the process because
598 * they are known to be harmful. */
599static const SUPENVPURGEDESC g_aSupEnvPurgeDescs[] =
600{
601 /* pszEnv fPurgeErrFatal */
602 /* Qt related environment variables: */
603 { RT_STR_TUPLE("QT_QPA_PLATFORM_PLUGIN_PATH"), true },
604 { RT_STR_TUPLE("QT_PLUGIN_PATH"), true },
605 /* ALSA related environment variables: */
606 { RT_STR_TUPLE("ALSA_MIXER_SIMPLE_MODULES"), true },
607 { RT_STR_TUPLE("LADSPA_PATH"), true },
608};
609
610/** Arguments to purge from the argument vector because
611 * they are known to be harmful. */
612static const SUPARGPURGEDESC g_aSupArgPurgeDescs[] =
613{
614 /* pszArg fTakesValue */
615 /* Qt related environment variables: */
616 { RT_STR_TUPLE("-platformpluginpath"), true },
617};
618
619
620/*********************************************************************************************************************************
621* Internal Functions *
622*********************************************************************************************************************************/
623#ifdef SUP_HARDENED_SUID
624static void supR3HardenedMainDropPrivileges(void);
625#endif
626static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName);
627
628
629/**
630 * Safely copy one or more strings into the given buffer.
631 *
632 * @returns VINF_SUCCESS or VERR_BUFFER_OVERFLOW.
633 * @param pszDst The destionation buffer.
634 * @param cbDst The size of the destination buffer.
635 * @param ... One or more zero terminated strings, ending with
636 * a NULL.
637 */
638static int suplibHardenedStrCopyEx(char *pszDst, size_t cbDst, ...)
639{
640 int rc = VINF_SUCCESS;
641
642 if (cbDst == 0)
643 return VERR_BUFFER_OVERFLOW;
644
645 va_list va;
646 va_start(va, cbDst);
647 for (;;)
648 {
649 const char *pszSrc = va_arg(va, const char *);
650 if (!pszSrc)
651 break;
652
653 size_t cchSrc = suplibHardenedStrLen(pszSrc);
654 if (cchSrc < cbDst)
655 {
656 suplibHardenedMemCopy(pszDst, pszSrc, cchSrc);
657 pszDst += cchSrc;
658 cbDst -= cchSrc;
659 }
660 else
661 {
662 rc = VERR_BUFFER_OVERFLOW;
663 if (cbDst > 1)
664 {
665 suplibHardenedMemCopy(pszDst, pszSrc, cbDst - 1);
666 pszDst += cbDst - 1;
667 cbDst = 1;
668 }
669 }
670 *pszDst = '\0';
671 }
672 va_end(va);
673
674 return rc;
675}
676
677
678/**
679 * Exit current process in the quickest possible fashion.
680 *
681 * @param rcExit The exit code.
682 */
683DECLHIDDEN(DECL_NO_RETURN(void)) suplibHardenedExit(RTEXITCODE rcExit)
684{
685 for (;;)
686 {
687#ifdef RT_OS_WINDOWS
688 if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
689 ExitProcess(rcExit);
690 if (RtlExitUserProcess != NULL)
691 RtlExitUserProcess(rcExit);
692 NtTerminateProcess(NtCurrentProcess(), rcExit);
693#else
694 _Exit(rcExit);
695#endif
696 }
697}
698
699
700/**
701 * Writes a substring to standard error.
702 *
703 * @param pch The start of the substring.
704 * @param cch The length of the substring.
705 */
706static void suplibHardenedPrintStrN(const char *pch, size_t cch)
707{
708#ifdef RT_OS_WINDOWS
709 HANDLE hStdOut = NtCurrentPeb()->ProcessParameters->StandardOutput;
710 if (hStdOut != NULL)
711 {
712 if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
713 {
714 DWORD cbWritten;
715 WriteFile(hStdOut, pch, (DWORD)cch, &cbWritten, NULL);
716 }
717 /* Windows 7 and earlier uses fake handles, with the last two bits set ((hStdOut & 3) == 3). */
718 else if (NtWriteFile != NULL && ((uintptr_t)hStdOut & 3) == 0)
719 {
720 IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
721 NtWriteFile(hStdOut, NULL /*Event*/, NULL /*ApcRoutine*/, NULL /*ApcContext*/,
722 &Ios, (PVOID)pch, (ULONG)cch, NULL /*ByteOffset*/, NULL /*Key*/);
723 }
724 }
725#else
726 int res = write(2, pch, cch);
727 NOREF(res);
728#endif
729}
730
731
732/**
733 * Writes a string to standard error.
734 *
735 * @param psz The string.
736 */
737static void suplibHardenedPrintStr(const char *psz)
738{
739 suplibHardenedPrintStrN(psz, suplibHardenedStrLen(psz));
740}
741
742
743/**
744 * Writes a char to standard error.
745 *
746 * @param ch The character value to write.
747 */
748static void suplibHardenedPrintChr(char ch)
749{
750 suplibHardenedPrintStrN(&ch, 1);
751}
752
753#ifndef IPRT_NO_CRT
754
755/**
756 * Writes a decimal number to stdard error.
757 *
758 * @param uValue The value.
759 */
760static void suplibHardenedPrintDecimal(uint64_t uValue)
761{
762 char szBuf[64];
763 char *pszEnd = &szBuf[sizeof(szBuf) - 1];
764 char *psz = pszEnd;
765
766 *psz-- = '\0';
767
768 do
769 {
770 *psz-- = '0' + (uValue % 10);
771 uValue /= 10;
772 } while (uValue > 0);
773
774 psz++;
775 suplibHardenedPrintStrN(psz, pszEnd - psz);
776}
777
778
779/**
780 * Writes a hexadecimal or octal number to standard error.
781 *
782 * @param uValue The value.
783 * @param uBase The base (16 or 8).
784 * @param fFlags Format flags.
785 */
786static void suplibHardenedPrintHexOctal(uint64_t uValue, unsigned uBase, uint32_t fFlags)
787{
788 static char const s_achDigitsLower[17] = "0123456789abcdef";
789 static char const s_achDigitsUpper[17] = "0123456789ABCDEF";
790 const char *pchDigits = !(fFlags & RTSTR_F_CAPITAL) ? s_achDigitsLower : s_achDigitsUpper;
791 unsigned cShift = uBase == 16 ? 4 : 3;
792 unsigned fDigitMask = uBase == 16 ? 0xf : 7;
793 char szBuf[64];
794 char *pszEnd = &szBuf[sizeof(szBuf) - 1];
795 char *psz = pszEnd;
796
797 *psz-- = '\0';
798
799 do
800 {
801 *psz-- = pchDigits[uValue & fDigitMask];
802 uValue >>= cShift;
803 } while (uValue > 0);
804
805 if ((fFlags & RTSTR_F_SPECIAL) && uBase == 16)
806 {
807 *psz-- = !(fFlags & RTSTR_F_CAPITAL) ? 'x' : 'X';
808 *psz-- = '0';
809 }
810
811 psz++;
812 suplibHardenedPrintStrN(psz, pszEnd - psz);
813}
814
815
816/**
817 * Writes a wide character string to standard error.
818 *
819 * @param pwsz The string.
820 */
821static void suplibHardenedPrintWideStr(PCRTUTF16 pwsz)
822{
823 for (;;)
824 {
825 RTUTF16 wc = *pwsz++;
826 if (!wc)
827 return;
828 if ( (wc < 0x7f && wc >= 0x20)
829 || wc == '\n'
830 || wc == '\r')
831 suplibHardenedPrintChr((char)wc);
832 else
833 {
834 suplibHardenedPrintStrN(RT_STR_TUPLE("\\x"));
835 suplibHardenedPrintHexOctal(wc, 16, 0);
836 }
837 }
838}
839
840#else /* IPRT_NO_CRT */
841
842/** Buffer structure used by suplibHardenedOutput. */
843struct SUPLIBHARDENEDOUTPUTBUF
844{
845 size_t off;
846 char szBuf[2048];
847};
848
849/** Callback for RTStrFormatV, see FNRTSTROUTPUT. */
850static DECLCALLBACK(size_t) suplibHardenedOutput(void *pvArg, const char *pachChars, size_t cbChars)
851{
852 SUPLIBHARDENEDOUTPUTBUF *pBuf = (SUPLIBHARDENEDOUTPUTBUF *)pvArg;
853 size_t cbTodo = cbChars;
854 for (;;)
855 {
856 size_t cbSpace = sizeof(pBuf->szBuf) - pBuf->off - 1;
857
858 /* Flush the buffer? */
859 if ( cbSpace == 0
860 || (cbTodo == 0 && pBuf->off))
861 {
862 suplibHardenedPrintStrN(pBuf->szBuf, pBuf->off);
863# ifdef RT_OS_WINDOWS
864 if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
865 OutputDebugString(pBuf->szBuf);
866# endif
867 pBuf->off = 0;
868 cbSpace = sizeof(pBuf->szBuf) - 1;
869 }
870
871 /* Copy the string into the buffer. */
872 if (cbTodo == 1)
873 {
874 pBuf->szBuf[pBuf->off++] = *pachChars;
875 break;
876 }
877 if (cbSpace >= cbTodo)
878 {
879 memcpy(&pBuf->szBuf[pBuf->off], pachChars, cbTodo);
880 pBuf->off += cbTodo;
881 break;
882 }
883 memcpy(&pBuf->szBuf[pBuf->off], pachChars, cbSpace);
884 pBuf->off += cbSpace;
885 cbTodo -= cbSpace;
886 }
887 pBuf->szBuf[pBuf->off] = '\0';
888
889 return cbChars;
890}
891
892#endif /* IPRT_NO_CRT */
893
894/**
895 * Simple printf to standard error.
896 *
897 * @param pszFormat The format string.
898 * @param va Arguments to format.
899 */
900DECLHIDDEN(void) suplibHardenedPrintFV(const char *pszFormat, va_list va)
901{
902#ifdef IPRT_NO_CRT
903 /*
904 * Use buffered output here to avoid character mixing on the windows
905 * console and to enable us to use OutputDebugString.
906 */
907 SUPLIBHARDENEDOUTPUTBUF Buf;
908 Buf.off = 0;
909 Buf.szBuf[0] = '\0';
910 RTStrFormatV(suplibHardenedOutput, &Buf, NULL, NULL, pszFormat, va);
911
912#else /* !IPRT_NO_CRT */
913 /*
914 * Format loop.
915 */
916 char ch;
917 const char *pszLast = pszFormat;
918 for (;;)
919 {
920 ch = *pszFormat;
921 if (!ch)
922 break;
923 pszFormat++;
924
925 if (ch == '%')
926 {
927 /*
928 * Format argument.
929 */
930
931 /* Flush unwritten bits. */
932 if (pszLast != pszFormat - 1)
933 suplibHardenedPrintStrN(pszLast, pszFormat - pszLast - 1);
934 pszLast = pszFormat;
935 ch = *pszFormat++;
936
937 /* flags. */
938 uint32_t fFlags = 0;
939 for (;;)
940 {
941 if (ch == '#') fFlags |= RTSTR_F_SPECIAL;
942 else if (ch == '-') fFlags |= RTSTR_F_LEFT;
943 else if (ch == '+') fFlags |= RTSTR_F_PLUS;
944 else if (ch == ' ') fFlags |= RTSTR_F_BLANK;
945 else if (ch == '0') fFlags |= RTSTR_F_ZEROPAD;
946 else if (ch == '\'') fFlags |= RTSTR_F_THOUSAND_SEP;
947 else break;
948 ch = *pszFormat++;
949 }
950
951 /* Width and precision - ignored. */
952 while (RT_C_IS_DIGIT(ch))
953 ch = *pszFormat++;
954 if (ch == '*')
955 va_arg(va, int);
956 if (ch == '.')
957 {
958 do ch = *pszFormat++;
959 while (RT_C_IS_DIGIT(ch));
960 if (ch == '*')
961 va_arg(va, int);
962 }
963
964 /* Size. */
965 char chArgSize = 0;
966 switch (ch)
967 {
968 case 'z':
969 case 'L':
970 case 'j':
971 case 't':
972 chArgSize = ch;
973 ch = *pszFormat++;
974 break;
975
976 case 'l':
977 chArgSize = ch;
978 ch = *pszFormat++;
979 if (ch == 'l')
980 {
981 chArgSize = 'L';
982 ch = *pszFormat++;
983 }
984 break;
985
986 case 'h':
987 chArgSize = ch;
988 ch = *pszFormat++;
989 if (ch == 'h')
990 {
991 chArgSize = 'H';
992 ch = *pszFormat++;
993 }
994 break;
995 }
996
997 /*
998 * Do type specific formatting.
999 */
1000 switch (ch)
1001 {
1002 case 'c':
1003 ch = (char)va_arg(va, int);
1004 suplibHardenedPrintChr(ch);
1005 break;
1006
1007 case 's':
1008 if (chArgSize == 'l')
1009 {
1010 PCRTUTF16 pwszStr = va_arg(va, PCRTUTF16 );
1011 if (RT_VALID_PTR(pwszStr))
1012 suplibHardenedPrintWideStr(pwszStr);
1013 else
1014 suplibHardenedPrintStr("<NULL>");
1015 }
1016 else
1017 {
1018 const char *pszStr = va_arg(va, const char *);
1019 if (!RT_VALID_PTR(pszStr))
1020 pszStr = "<NULL>";
1021 suplibHardenedPrintStr(pszStr);
1022 }
1023 break;
1024
1025 case 'd':
1026 case 'i':
1027 {
1028 int64_t iValue;
1029 if (chArgSize == 'L' || chArgSize == 'j')
1030 iValue = va_arg(va, int64_t);
1031 else if (chArgSize == 'l')
1032 iValue = va_arg(va, signed long);
1033 else if (chArgSize == 'z' || chArgSize == 't')
1034 iValue = va_arg(va, intptr_t);
1035 else
1036 iValue = va_arg(va, signed int);
1037 if (iValue < 0)
1038 {
1039 suplibHardenedPrintChr('-');
1040 iValue = -iValue;
1041 }
1042 suplibHardenedPrintDecimal(iValue);
1043 break;
1044 }
1045
1046 case 'p':
1047 case 'x':
1048 case 'X':
1049 case 'u':
1050 case 'o':
1051 {
1052 unsigned uBase = 10;
1053 uint64_t uValue;
1054
1055 switch (ch)
1056 {
1057 case 'p':
1058 fFlags |= RTSTR_F_ZEROPAD; /* Note not standard behaviour (but I like it this way!) */
1059 uBase = 16;
1060 break;
1061 case 'X':
1062 fFlags |= RTSTR_F_CAPITAL;
1063 RT_FALL_THRU();
1064 case 'x':
1065 uBase = 16;
1066 break;
1067 case 'u':
1068 uBase = 10;
1069 break;
1070 case 'o':
1071 uBase = 8;
1072 break;
1073 }
1074
1075 if (ch == 'p' || chArgSize == 'z' || chArgSize == 't')
1076 uValue = va_arg(va, uintptr_t);
1077 else if (chArgSize == 'L' || chArgSize == 'j')
1078 uValue = va_arg(va, uint64_t);
1079 else if (chArgSize == 'l')
1080 uValue = va_arg(va, unsigned long);
1081 else
1082 uValue = va_arg(va, unsigned int);
1083
1084 if (uBase == 10)
1085 suplibHardenedPrintDecimal(uValue);
1086 else
1087 suplibHardenedPrintHexOctal(uValue, uBase, fFlags);
1088 break;
1089 }
1090
1091 case 'R':
1092 if (pszFormat[0] == 'r' && pszFormat[1] == 'c')
1093 {
1094 int iValue = va_arg(va, int);
1095 if (iValue < 0)
1096 {
1097 suplibHardenedPrintChr('-');
1098 iValue = -iValue;
1099 }
1100 suplibHardenedPrintDecimal(iValue);
1101 pszFormat += 2;
1102 break;
1103 }
1104 RT_FALL_THRU();
1105
1106 /*
1107 * Custom format.
1108 */
1109 default:
1110 suplibHardenedPrintStr("[bad format: ");
1111 suplibHardenedPrintStrN(pszLast, pszFormat - pszLast);
1112 suplibHardenedPrintChr(']');
1113 break;
1114 }
1115
1116 /* continue */
1117 pszLast = pszFormat;
1118 }
1119 }
1120
1121 /* Flush the last bits of the string. */
1122 if (pszLast != pszFormat)
1123 suplibHardenedPrintStrN(pszLast, pszFormat - pszLast);
1124#endif /* !IPRT_NO_CRT */
1125}
1126
1127
1128/**
1129 * Prints to standard error.
1130 *
1131 * @param pszFormat The format string.
1132 * @param ... Arguments to format.
1133 */
1134DECLHIDDEN(void) suplibHardenedPrintF(const char *pszFormat, ...)
1135{
1136 va_list va;
1137 va_start(va, pszFormat);
1138 suplibHardenedPrintFV(pszFormat, va);
1139 va_end(va);
1140}
1141
1142
1143/**
1144 * @copydoc RTPathStripFilename
1145 */
1146static void suplibHardenedPathStripFilename(char *pszPath)
1147{
1148 char *psz = pszPath;
1149 char *pszLastSep = pszPath;
1150
1151 for (;; psz++)
1152 {
1153 switch (*psz)
1154 {
1155 /* handle separators. */
1156#if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
1157 case ':':
1158 pszLastSep = psz + 1;
1159 break;
1160
1161 case '\\':
1162#endif
1163 case '/':
1164 pszLastSep = psz;
1165 break;
1166
1167 /* the end */
1168 case '\0':
1169 if (pszLastSep == pszPath)
1170 *pszLastSep++ = '.';
1171 *pszLastSep = '\0';
1172 return;
1173 }
1174 }
1175 /* will never get here */
1176}
1177
1178
1179DECLHIDDEN(char *) supR3HardenedPathFilename(const char *pszPath)
1180{
1181 const char *psz = pszPath;
1182 const char *pszLastComp = pszPath;
1183
1184 for (;; psz++)
1185 {
1186 switch (*psz)
1187 {
1188 /* handle separators. */
1189#if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
1190 case ':':
1191 pszLastComp = psz + 1;
1192 break;
1193
1194 case '\\':
1195#endif
1196 case '/':
1197 pszLastComp = psz + 1;
1198 break;
1199
1200 /* the end */
1201 case '\0':
1202 if (*pszLastComp)
1203 return (char *)(void *)pszLastComp;
1204 return NULL;
1205 }
1206 }
1207
1208 /* will never get here */
1209}
1210
1211
1212DECLHIDDEN(int) supR3HardenedPathAppPrivateNoArch(char *pszPath, size_t cchPath)
1213{
1214#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE)
1215 const char *pszSrcPath = RTPATH_APP_PRIVATE;
1216 size_t cchPathPrivateNoArch = suplibHardenedStrLen(pszSrcPath);
1217 if (cchPathPrivateNoArch >= cchPath)
1218 supR3HardenedFatal("supR3HardenedPathAppPrivateNoArch: Buffer overflow, %zu >= %zu\n", cchPathPrivateNoArch, cchPath);
1219 suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathPrivateNoArch + 1);
1220 return VINF_SUCCESS;
1221
1222#else
1223 return supR3HardenedPathAppBin(pszPath, cchPath);
1224#endif
1225}
1226
1227
1228DECLHIDDEN(int) supR3HardenedPathAppPrivateArch(char *pszPath, size_t cchPath)
1229{
1230#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE_ARCH)
1231 const char *pszSrcPath = RTPATH_APP_PRIVATE_ARCH;
1232 size_t cchPathPrivateArch = suplibHardenedStrLen(pszSrcPath);
1233 if (cchPathPrivateArch >= cchPath)
1234 supR3HardenedFatal("supR3HardenedPathAppPrivateArch: Buffer overflow, %zu >= %zu\n", cchPathPrivateArch, cchPath);
1235 suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathPrivateArch + 1);
1236 return VINF_SUCCESS;
1237
1238#else
1239 return supR3HardenedPathAppBin(pszPath, cchPath);
1240#endif
1241}
1242
1243
1244DECLHIDDEN(int) supR3HardenedPathAppSharedLibs(char *pszPath, size_t cchPath)
1245{
1246#if !defined(RT_OS_WINDOWS) && defined(RTPATH_SHARED_LIBS)
1247 const char *pszSrcPath = RTPATH_SHARED_LIBS;
1248 size_t cchPathSharedLibs = suplibHardenedStrLen(pszSrcPath);
1249 if (cchPathSharedLibs >= cchPath)
1250 supR3HardenedFatal("supR3HardenedPathAppSharedLibs: Buffer overflow, %zu >= %zu\n", cchPathSharedLibs, cchPath);
1251 suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathSharedLibs + 1);
1252 return VINF_SUCCESS;
1253
1254#else
1255 return supR3HardenedPathAppBin(pszPath, cchPath);
1256#endif
1257}
1258
1259
1260DECLHIDDEN(int) supR3HardenedPathAppDocs(char *pszPath, size_t cchPath)
1261{
1262#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_DOCS)
1263 const char *pszSrcPath = RTPATH_APP_DOCS;
1264 size_t cchPathAppDocs = suplibHardenedStrLen(pszSrcPath);
1265 if (cchPathAppDocs >= cchPath)
1266 supR3HardenedFatal("supR3HardenedPathAppDocs: Buffer overflow, %zu >= %zu\n", cchPathAppDocs, cchPath);
1267 suplibHardenedMemCopy(pszPath, pszSrcPath, cchPathAppDocs + 1);
1268 return VINF_SUCCESS;
1269
1270#else
1271 return supR3HardenedPathAppBin(pszPath, cchPath);
1272#endif
1273}
1274
1275
1276/**
1277 * Returns the full path to the executable in g_szSupLibHardenedExePath.
1278 */
1279static void supR3HardenedGetFullExePath(void)
1280{
1281 /*
1282 * Get the program filename.
1283 *
1284 * Most UNIXes have no API for obtaining the executable path, but provides a symbolic
1285 * link in the proc file system that tells who was exec'ed. The bad thing about this
1286 * is that we have to use readlink, one of the weirder UNIX APIs.
1287 *
1288 * Darwin, OS/2 and Windows all have proper APIs for getting the program file name.
1289 */
1290#if defined(RT_OS_LINUX) || defined(RT_OS_FREEBSD) || defined(RT_OS_SOLARIS)
1291# ifdef RT_OS_LINUX
1292 int cchLink = readlink("/proc/self/exe", &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
1293
1294# elif defined(RT_OS_SOLARIS)
1295 char szFileBuf[PATH_MAX + 1];
1296 sprintf(szFileBuf, "/proc/%ld/path/a.out", (long)getpid());
1297 int cchLink = readlink(szFileBuf, &g_szSupLibHardenedExePath[0], sizeof(g_szSupLibHardenedExePath) - 1);
1298
1299# else /* RT_OS_FREEBSD */
1300 int aiName[4];
1301 aiName[0] = CTL_KERN;
1302 aiName[1] = KERN_PROC;
1303 aiName[2] = KERN_PROC_PATHNAME;
1304 aiName[3] = getpid();
1305
1306 size_t cbPath = sizeof(g_szSupLibHardenedExePath);
1307 if (sysctl(aiName, RT_ELEMENTS(aiName), g_szSupLibHardenedExePath, &cbPath, NULL, 0) < 0)
1308 supR3HardenedFatal("supR3HardenedExecDir: sysctl failed\n");
1309 g_szSupLibHardenedExePath[sizeof(g_szSupLibHardenedExePath) - 1] = '\0';
1310 int cchLink = suplibHardenedStrLen(g_szSupLibHardenedExePath); /* paranoid? can't we use cbPath? */
1311
1312# endif
1313 if (cchLink < 0 || cchLink == sizeof(g_szSupLibHardenedExePath) - 1)
1314 supR3HardenedFatal("supR3HardenedExecDir: couldn't read \"%s\", errno=%d cchLink=%d\n",
1315 g_szSupLibHardenedExePath, errno, cchLink);
1316 g_szSupLibHardenedExePath[cchLink] = '\0';
1317
1318#elif defined(RT_OS_OS2) || defined(RT_OS_L4)
1319 _execname(g_szSupLibHardenedExePath, sizeof(g_szSupLibHardenedExePath));
1320
1321#elif defined(RT_OS_DARWIN)
1322 const char *pszImageName = _dyld_get_image_name(0);
1323 if (!pszImageName)
1324 supR3HardenedFatal("supR3HardenedExecDir: _dyld_get_image_name(0) failed\n");
1325 size_t cchImageName = suplibHardenedStrLen(pszImageName);
1326 if (!cchImageName || cchImageName >= sizeof(g_szSupLibHardenedExePath))
1327 supR3HardenedFatal("supR3HardenedExecDir: _dyld_get_image_name(0) failed, cchImageName=%d\n", cchImageName);
1328 suplibHardenedMemCopy(g_szSupLibHardenedExePath, pszImageName, cchImageName + 1);
1329 /** @todo abspath the string or this won't work:
1330 * cd /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/ && ./VirtualBoxVM --startvm name */
1331
1332#elif defined(RT_OS_WINDOWS)
1333 char *pszDst = g_szSupLibHardenedExePath;
1334 int rc = RTUtf16ToUtf8Ex(g_wszSupLibHardenedExePath, RTSTR_MAX, &pszDst, sizeof(g_szSupLibHardenedExePath), NULL);
1335 if (RT_FAILURE(rc))
1336 supR3HardenedFatal("supR3HardenedExecDir: RTUtf16ToUtf8Ex failed, rc=%Rrc\n", rc);
1337#else
1338# error needs porting.
1339#endif
1340
1341 /*
1342 * Determine the application binary directory location.
1343 */
1344 suplibHardenedStrCopy(g_szSupLibHardenedAppBinPath, g_szSupLibHardenedExePath);
1345 suplibHardenedPathStripFilename(g_szSupLibHardenedAppBinPath);
1346
1347 g_offSupLibHardenedExecName = suplibHardenedStrLen(g_szSupLibHardenedAppBinPath);
1348 while (RTPATH_IS_SEP(g_szSupLibHardenedExePath[g_offSupLibHardenedExecName]))
1349 g_offSupLibHardenedExecName++;
1350 g_cchSupLibHardenedExecName = suplibHardenedStrLen(&g_szSupLibHardenedExePath[g_offSupLibHardenedExecName]);
1351
1352 if (g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_HARDENED_MAIN_CALLED)
1353 supR3HardenedFatal("supR3HardenedExecDir: Called before SUPR3HardenedMain! (%d)\n", g_enmSupR3HardenedMainState);
1354 switch (g_fSupHardenedMain & SUPSECMAIN_FLAGS_LOC_MASK)
1355 {
1356 case SUPSECMAIN_FLAGS_LOC_APP_BIN:
1357 break;
1358 case SUPSECMAIN_FLAGS_LOC_TESTCASE:
1359 suplibHardenedPathStripFilename(g_szSupLibHardenedAppBinPath);
1360 break;
1361#ifdef RT_OS_DARWIN
1362 case SUPSECMAIN_FLAGS_LOC_OSX_HLP_APP:
1363 {
1364 /* We must ascend to the parent bundle's Contents directory then decend into its MacOS: */
1365 static const RTSTRTUPLE s_aComponentsToSkip[] =
1366 { { RT_STR_TUPLE("MacOS") }, { RT_STR_TUPLE("Contents") }, { NULL /*some.app*/, 0 }, { RT_STR_TUPLE("Resources") } };
1367 size_t cchPath = suplibHardenedStrLen(g_szSupLibHardenedAppBinPath);
1368 for (uintptr_t i = 0; i < RT_ELEMENTS(s_aComponentsToSkip); i++)
1369 {
1370 while (cchPath > 1 && g_szSupLibHardenedAppBinPath[cchPath - 1] == '/')
1371 cchPath--;
1372 size_t const cchMatch = s_aComponentsToSkip[i].cch;
1373 if (cchMatch > 0)
1374 {
1375 if ( cchPath >= cchMatch + sizeof("VirtualBox.app/Contents")
1376 && g_szSupLibHardenedAppBinPath[cchPath - cchMatch - 1] == '/'
1377 && suplibHardenedMemComp(&g_szSupLibHardenedAppBinPath[cchPath - cchMatch],
1378 s_aComponentsToSkip[i].psz, cchMatch) == 0)
1379 cchPath -= cchMatch;
1380 else
1381 supR3HardenedFatal("supR3HardenedExecDir: Bad helper app path (tail component #%u '%s'): %s\n",
1382 i, s_aComponentsToSkip[i].psz, g_szSupLibHardenedAppBinPath);
1383 }
1384 else if ( cchPath > g_cchSupLibHardenedExecName + sizeof("VirtualBox.app/Contents/Resources/.app")
1385 && suplibHardenedMemComp(&g_szSupLibHardenedAppBinPath[cchPath - 4], ".app", 4) == 0
1386 && suplibHardenedMemComp(&g_szSupLibHardenedAppBinPath[cchPath - 4 - g_cchSupLibHardenedExecName],
1387 &g_szSupLibHardenedExePath[g_offSupLibHardenedExecName],
1388 g_cchSupLibHardenedExecName) == 0)
1389 cchPath -= g_cchSupLibHardenedExecName + 4;
1390 else
1391 supR3HardenedFatal("supR3HardenedExecDir: Bad helper app path (tail component #%u '%s.app'): %s\n",
1392 i, &g_szSupLibHardenedExePath[g_offSupLibHardenedExecName], g_szSupLibHardenedAppBinPath);
1393 }
1394 suplibHardenedMemCopy(&g_szSupLibHardenedAppBinPath[cchPath], "MacOS", sizeof("MacOS"));
1395 break;
1396 }
1397#endif /* RT_OS_DARWIN */
1398 default:
1399 supR3HardenedFatal("supR3HardenedExecDir: Unknown program binary location: %#x\n", g_fSupHardenedMain);
1400 }
1401}
1402
1403
1404#ifdef RT_OS_LINUX
1405/**
1406 * Checks if we can read /proc/self/exe.
1407 *
1408 * This is used on linux to see if we have to call init
1409 * with program path or not.
1410 *
1411 * @returns true / false.
1412 */
1413static bool supR3HardenedMainIsProcSelfExeAccssible(void)
1414{
1415 char szPath[RTPATH_MAX];
1416 int cchLink = readlink("/proc/self/exe", szPath, sizeof(szPath));
1417 return cchLink != -1;
1418}
1419#endif /* RT_OS_LINUX */
1420
1421
1422
1423/**
1424 * @remarks not quite like RTPathExecDir actually...
1425 */
1426DECLHIDDEN(int) supR3HardenedPathAppBin(char *pszPath, size_t cchPath)
1427{
1428 /*
1429 * Lazy init (probably not required).
1430 */
1431 if (!g_szSupLibHardenedAppBinPath[0])
1432 supR3HardenedGetFullExePath();
1433
1434 /*
1435 * Calc the length and check if there is space before copying.
1436 */
1437 size_t cch = suplibHardenedStrLen(g_szSupLibHardenedAppBinPath) + 1;
1438 if (cch <= cchPath)
1439 {
1440 suplibHardenedMemCopy(pszPath, g_szSupLibHardenedAppBinPath, cch + 1);
1441 return VINF_SUCCESS;
1442 }
1443
1444 supR3HardenedFatal("supR3HardenedPathAppBin: Buffer too small (%u < %u)\n", cchPath, cch);
1445 /* not reached */
1446}
1447
1448
1449#ifdef RT_OS_WINDOWS
1450extern "C" uint32_t g_uNtVerCombined;
1451#endif
1452
1453DECLHIDDEN(void) supR3HardenedOpenLog(int *pcArgs, char **papszArgs)
1454{
1455 static const char s_szLogOption[] = "--sup-hardening-log=";
1456
1457 /*
1458 * Scan the argument vector.
1459 */
1460 int cArgs = *pcArgs;
1461 for (int iArg = 1; iArg < cArgs; iArg++)
1462 if (strncmp(papszArgs[iArg], s_szLogOption, sizeof(s_szLogOption) - 1) == 0)
1463 {
1464#ifdef RT_OS_WINDOWS
1465 const char *pszLogFile = &papszArgs[iArg][sizeof(s_szLogOption) - 1];
1466#endif
1467
1468 /*
1469 * Drop the argument from the vector (has trailing NULL entry).
1470 */
1471// memmove(&papszArgs[iArg], &papszArgs[iArg + 1], (cArgs - iArg) * sizeof(papszArgs[0]));
1472 *pcArgs -= 1;
1473 cArgs -= 1;
1474
1475 /*
1476 * Open the log file, unless we've already opened one.
1477 * First argument takes precedence
1478 */
1479#ifdef RT_OS_WINDOWS
1480 if (g_hStartupLog == NULL)
1481 {
1482 int rc = RTNtPathOpen(pszLogFile,
1483 GENERIC_WRITE | SYNCHRONIZE,
1484 FILE_ATTRIBUTE_NORMAL,
1485 FILE_SHARE_READ | FILE_SHARE_WRITE,
1486 FILE_OPEN_IF,
1487 FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
1488 OBJ_CASE_INSENSITIVE,
1489 &g_hStartupLog,
1490 NULL);
1491 if (RT_SUCCESS(rc))
1492 {
1493// SUP_DPRINTF(("Log file opened: " VBOX_VERSION_STRING "r%u g_hStartupLog=%p g_uNtVerCombined=%#x\n",
1494// VBOX_SVN_REV, g_hStartupLog, g_uNtVerCombined));
1495
1496 /*
1497 * If the path contains a drive volume, save it so we can
1498 * use it to flush the volume containing the log file.
1499 */
1500 if (RT_C_IS_ALPHA(pszLogFile[0]) && pszLogFile[1] == ':')
1501 {
1502// RTUtf16CopyAscii(g_wszStartupLogVol, RT_ELEMENTS(g_wszStartupLogVol), "\\??\\");
1503 g_wszStartupLogVol[sizeof("\\??\\") - 1] = RT_C_TO_UPPER(pszLogFile[0]);
1504 g_wszStartupLogVol[sizeof("\\??\\") + 0] = ':';
1505 g_wszStartupLogVol[sizeof("\\??\\") + 1] = '\0';
1506 }
1507 }
1508 else
1509 g_hStartupLog = NULL;
1510 }
1511#else
1512 /* Just some mumbo jumbo to shut up the compiler. */
1513 g_hStartupLog -= 1;
1514 g_cbStartupLog += 1;
1515 //g_hStartupLog = open()
1516#endif
1517 }
1518}
1519
1520
1521DECLHIDDEN(void) supR3HardenedLogV(const char *pszFormat, va_list va)
1522{
1523#ifdef RT_OS_WINDOWS
1524 if ( g_hStartupLog != NULL
1525 && g_cbStartupLog < 16*_1M)
1526 {
1527 char szBuf[5120];
1528 PCLIENT_ID pSelfId = &((PTEB)NtCurrentTeb())->ClientId;
1529 size_t cchPrefix = RTStrPrintf(szBuf, sizeof(szBuf), "%x.%x: ", pSelfId->UniqueProcess, pSelfId->UniqueThread);
1530 size_t cch = RTStrPrintfV(&szBuf[cchPrefix], sizeof(szBuf) - cchPrefix, pszFormat, va) + cchPrefix;
1531
1532 if ((size_t)cch >= sizeof(szBuf))
1533 cch = sizeof(szBuf) - 1;
1534
1535 if (!cch || szBuf[cch - 1] != '\n')
1536 szBuf[cch++] = '\n';
1537
1538 ASMAtomicAddU32(&g_cbStartupLog, (uint32_t)cch);
1539
1540 IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
1541 LARGE_INTEGER Offset;
1542 Offset.QuadPart = -1; /* Write to end of file. */
1543 NtWriteFile(g_hStartupLog, NULL /*Event*/, NULL /*ApcRoutine*/, NULL /*ApcContext*/,
1544 &Ios, szBuf, (ULONG)cch, &Offset, NULL /*Key*/);
1545 }
1546#else
1547 RT_NOREF(pszFormat, va);
1548 /* later */
1549#endif
1550}
1551
1552
1553DECLHIDDEN(void) supR3HardenedLog(const char *pszFormat, ...)
1554{
1555 va_list va;
1556 va_start(va, pszFormat);
1557 supR3HardenedLogV(pszFormat, va);
1558 va_end(va);
1559}
1560
1561
1562DECLHIDDEN(void) supR3HardenedLogFlush(void)
1563{
1564#ifdef RT_OS_WINDOWS
1565 if ( g_hStartupLog != NULL
1566 && g_cbStartupLog < 16*_1M)
1567 {
1568 IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
1569 NTSTATUS rcNt = NtFlushBuffersFile(g_hStartupLog, &Ios);
1570
1571 /*
1572 * Try flush the volume containing the log file too.
1573 */
1574 if (g_wszStartupLogVol[0])
1575 {
1576 HANDLE hLogVol = RTNT_INVALID_HANDLE_VALUE;
1577 UNICODE_STRING NtName;
1578 NtName.Buffer = g_wszStartupLogVol;
1579 NtName.Length = (USHORT)(RTUtf16Len(g_wszStartupLogVol) * sizeof(RTUTF16));
1580 NtName.MaximumLength = NtName.Length + 1;
1581 OBJECT_ATTRIBUTES ObjAttr;
1582 InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/);
1583 RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
1584 rcNt = NtCreateFile(&hLogVol,
1585 GENERIC_WRITE | GENERIC_READ | SYNCHRONIZE | FILE_READ_ATTRIBUTES,
1586 &ObjAttr,
1587 &Ios,
1588 NULL /* Allocation Size*/,
1589 0 /*FileAttributes*/,
1590 FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
1591 FILE_OPEN,
1592 FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
1593 NULL /*EaBuffer*/,
1594 0 /*EaLength*/);
1595 if (NT_SUCCESS(rcNt))
1596 rcNt = Ios.Status;
1597 if (NT_SUCCESS(rcNt))
1598 {
1599 RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
1600 rcNt = NtFlushBuffersFile(hLogVol, &Ios);
1601 NtClose(hLogVol);
1602 }
1603 else
1604 {
1605 /* This may have sideeffects similar to what we want... */
1606 hLogVol = RTNT_INVALID_HANDLE_VALUE;
1607 RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
1608 rcNt = NtCreateFile(&hLogVol,
1609 GENERIC_READ | SYNCHRONIZE | FILE_READ_ATTRIBUTES,
1610 &ObjAttr,
1611 &Ios,
1612 NULL /* Allocation Size*/,
1613 0 /*FileAttributes*/,
1614 FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
1615 FILE_OPEN,
1616 FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
1617 NULL /*EaBuffer*/,
1618 0 /*EaLength*/);
1619 if (NT_SUCCESS(rcNt) && NT_SUCCESS(Ios.Status))
1620 NtClose(hLogVol);
1621 }
1622 }
1623 }
1624#else
1625 /* later */
1626#endif
1627}
1628
1629
1630/**
1631 * Prints the message prefix.
1632 */
1633static void suplibHardenedPrintPrefix(void)
1634{
1635 if (g_pszSupLibHardenedProgName)
1636 suplibHardenedPrintStr(g_pszSupLibHardenedProgName);
1637 suplibHardenedPrintStr(": ");
1638}
1639
1640
1641DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatalMsgV(const char *pszWhere, SUPINITOP enmWhat, int rc,
1642 const char *pszMsgFmt, va_list va)
1643{
1644 /*
1645 * First to the log.
1646 */
1647 supR3HardenedLog("Error %d in %s! (enmWhat=%d)\n", rc, pszWhere, enmWhat);
1648 va_list vaCopy;
1649 va_copy(vaCopy, va);
1650 supR3HardenedLogV(pszMsgFmt, vaCopy);
1651 va_end(vaCopy);
1652
1653#ifdef RT_OS_WINDOWS
1654 /*
1655 * The release log.
1656 */
1657 if (g_pfnRTLogRelPrintf)
1658 {
1659 va_copy(vaCopy, va);
1660 g_pfnRTLogRelPrintf("supR3HardenedFatalMsgV: %s enmWhat=%d rc=%Rrc (%#x)\n", pszWhere, enmWhat, rc);
1661 g_pfnRTLogRelPrintf("supR3HardenedFatalMsgV: %N\n", pszMsgFmt, &vaCopy);
1662 va_end(vaCopy);
1663 }
1664#endif
1665
1666 /*
1667 * Then to the console.
1668 */
1669 suplibHardenedPrintPrefix();
1670 suplibHardenedPrintF("Error %d in %s!\n", rc, pszWhere);
1671
1672 suplibHardenedPrintPrefix();
1673 va_copy(vaCopy, va);
1674 suplibHardenedPrintFV(pszMsgFmt, vaCopy);
1675 va_end(vaCopy);
1676 suplibHardenedPrintChr('\n');
1677
1678 switch (enmWhat)
1679 {
1680 case kSupInitOp_Driver:
1681 suplibHardenedPrintChr('\n');
1682 suplibHardenedPrintPrefix();
1683 suplibHardenedPrintStr("Tip! Make sure the kernel module is loaded. It may also help to reinstall VirtualBox.\n");
1684 break;
1685
1686 case kSupInitOp_Misc:
1687 case kSupInitOp_IPRT:
1688 case kSupInitOp_Integrity:
1689 case kSupInitOp_RootCheck:
1690 suplibHardenedPrintChr('\n');
1691 suplibHardenedPrintPrefix();
1692 suplibHardenedPrintStr("Tip! It may help to reinstall VirtualBox.\n");
1693 break;
1694
1695 default:
1696 /* no hints here */
1697 break;
1698 }
1699
1700 /*
1701 * Finally, TrustedError if appropriate.
1702 */
1703 if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
1704 {
1705#ifdef SUP_HARDENED_SUID
1706 /* Drop any root privileges we might be holding, this won't return
1707 if it fails but end up calling supR3HardenedFatal[V]. */
1708 supR3HardenedMainDropPrivileges();
1709#endif
1710 /* Close the driver, if we succeeded opening it. Both because
1711 TrustedError may be untrustworthy and because the driver deosn't
1712 like us if we fork(). @bugref{8838} */
1713 suplibOsTerm(&g_SupPreInitData.Data);
1714
1715 /*
1716 * Now try resolve and call the TrustedError entry point if we can find it.
1717 * Note! Loader involved, so we must guard against loader hooks calling us.
1718 */
1719 static volatile bool s_fRecursive = false;
1720 if (!s_fRecursive)
1721 {
1722 s_fRecursive = true;
1723
1724 PFNSUPTRUSTEDERROR pfnTrustedError = supR3HardenedMainGetTrustedError(g_pszSupLibHardenedProgName);
1725 if (pfnTrustedError)
1726 {
1727 /* We'll fork before we make the call because that way the session management
1728 in main will see us exiting immediately (if it's involved with us) and possibly
1729 get an error back to the API / user. */
1730#if !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2) && /* @bugref{10170}: */ !defined(RT_OS_DARWIN)
1731 int pid = fork();
1732 if (pid <= 0)
1733#endif
1734 {
1735 pfnTrustedError(pszWhere, enmWhat, rc, pszMsgFmt, va);
1736 }
1737 }
1738
1739 s_fRecursive = false;
1740 }
1741 }
1742#if defined(RT_OS_WINDOWS)
1743 /*
1744 * Report the error to the parent if this happens during early VM init.
1745 */
1746 else if ( g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED
1747 && g_enmSupR3HardenedMainState != SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED)
1748 supR3HardenedWinReportErrorToParent(pszWhere, enmWhat, rc, pszMsgFmt, va);
1749#endif
1750
1751 /*
1752 * Quit
1753 */
1754 suplibHardenedExit(RTEXITCODE_FAILURE);
1755}
1756
1757
1758DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatalMsg(const char *pszWhere, SUPINITOP enmWhat, int rc,
1759 const char *pszMsgFmt, ...)
1760{
1761 va_list va;
1762 va_start(va, pszMsgFmt);
1763 supR3HardenedFatalMsgV(pszWhere, enmWhat, rc, pszMsgFmt, va);
1764 /* not reached */
1765}
1766
1767
1768DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatalV(const char *pszFormat, va_list va)
1769{
1770 supR3HardenedLog("Fatal error:\n");
1771 va_list vaCopy;
1772 va_copy(vaCopy, va);
1773 supR3HardenedLogV(pszFormat, vaCopy);
1774 va_end(vaCopy);
1775
1776#if defined(RT_OS_WINDOWS)
1777 /*
1778 * Report the error to the parent if this happens during early VM init.
1779 */
1780 if ( g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED
1781 && g_enmSupR3HardenedMainState != SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED)
1782 supR3HardenedWinReportErrorToParent(NULL, kSupInitOp_Invalid, VERR_INTERNAL_ERROR, pszFormat, va);
1783 else
1784#endif
1785 {
1786#ifdef RT_OS_WINDOWS
1787 if (g_pfnRTLogRelPrintf)
1788 {
1789 va_copy(vaCopy, va);
1790 g_pfnRTLogRelPrintf("supR3HardenedFatalV: %N", pszFormat, &vaCopy);
1791 va_end(vaCopy);
1792 }
1793#endif
1794
1795 suplibHardenedPrintPrefix();
1796 suplibHardenedPrintFV(pszFormat, va);
1797 }
1798
1799 suplibHardenedExit(RTEXITCODE_FAILURE);
1800}
1801
1802
1803DECL_NO_RETURN(DECLHIDDEN(void)) supR3HardenedFatal(const char *pszFormat, ...)
1804{
1805 va_list va;
1806 va_start(va, pszFormat);
1807 supR3HardenedFatalV(pszFormat, va);
1808 /* not reached */
1809}
1810
1811
1812DECLHIDDEN(int) supR3HardenedErrorV(int rc, bool fFatal, const char *pszFormat, va_list va)
1813{
1814 if (fFatal)
1815 supR3HardenedFatalV(pszFormat, va);
1816
1817 supR3HardenedLog("Error (rc=%d):\n", rc);
1818 va_list vaCopy;
1819 va_copy(vaCopy, va);
1820 supR3HardenedLogV(pszFormat, vaCopy);
1821 va_end(vaCopy);
1822
1823#ifdef RT_OS_WINDOWS
1824 if (g_pfnRTLogRelPrintf)
1825 {
1826 va_copy(vaCopy, va);
1827 g_pfnRTLogRelPrintf("supR3HardenedErrorV: %N", pszFormat, &vaCopy);
1828 va_end(vaCopy);
1829 }
1830#endif
1831
1832 suplibHardenedPrintPrefix();
1833 suplibHardenedPrintFV(pszFormat, va);
1834
1835 return rc;
1836}
1837
1838
1839DECLHIDDEN(int) supR3HardenedError(int rc, bool fFatal, const char *pszFormat, ...)
1840{
1841 va_list va;
1842 va_start(va, pszFormat);
1843 supR3HardenedErrorV(rc, fFatal, pszFormat, va);
1844 va_end(va);
1845 return rc;
1846}
1847
1848
1849
1850/**
1851 * Attempts to open /dev/vboxdrv (or equvivalent).
1852 *
1853 * @remarks This function will not return on failure.
1854 */
1855DECLHIDDEN(void) supR3HardenedMainOpenDevice(void)
1856{
1857 RTERRINFOSTATIC ErrInfo;
1858 SUPINITOP enmWhat = kSupInitOp_Driver;
1859 uint32_t fFlags = SUPR3INIT_F_UNRESTRICTED;
1860 if (g_fSupHardenedMain & SUPSECMAIN_FLAGS_DRIVERLESS)
1861 fFlags |= SUPR3INIT_F_DRIVERLESS;
1862 if (g_fSupHardenedMain & SUPSECMAIN_FLAGS_DRIVERLESS_IEM_ALLOWED)
1863 fFlags |= SUPR3INIT_F_DRIVERLESS_IEM_ALLOWED;
1864#ifdef VBOX_WITH_DRIVERLESS_NEM_FALLBACK
1865 if (g_fSupHardenedMain & SUPSECMAIN_FLAGS_DRIVERLESS_NEM_FALLBACK)
1866 fFlags |= SUPR3INIT_F_DRIVERLESS_NEM_FALLBACK;
1867#endif
1868 int rc = suplibOsInit(&g_SupPreInitData.Data, false /*fPreInit*/, fFlags, &enmWhat, RTErrInfoInitStatic(&ErrInfo));
1869 if (RT_SUCCESS(rc))
1870 return;
1871
1872 if (RTErrInfoIsSet(&ErrInfo.Core))
1873 supR3HardenedFatalMsg("suplibOsInit", enmWhat, rc, "%s", ErrInfo.szMsg);
1874
1875 switch (rc)
1876 {
1877 /** @todo better messages! */
1878 case VERR_VM_DRIVER_NOT_INSTALLED:
1879 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel driver not installed");
1880 case VERR_VM_DRIVER_NOT_ACCESSIBLE:
1881 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel driver not accessible");
1882 case VERR_VM_DRIVER_LOAD_ERROR:
1883 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "VERR_VM_DRIVER_LOAD_ERROR");
1884 case VERR_VM_DRIVER_OPEN_ERROR:
1885 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "VERR_VM_DRIVER_OPEN_ERROR");
1886 case VERR_VM_DRIVER_VERSION_MISMATCH:
1887 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel driver version mismatch");
1888 case VERR_ACCESS_DENIED:
1889 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "VERR_ACCESS_DENIED");
1890 case VERR_NO_MEMORY:
1891 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Kernel memory allocation/mapping failed");
1892 case VERR_SUPDRV_HARDENING_EVIL_HANDLE:
1893 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPDRV_HARDENING_EVIL_HANDLE");
1894 case VERR_SUPLIB_NT_PROCESS_UNTRUSTED_0:
1895 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPLIB_NT_PROCESS_UNTRUSTED_0");
1896 case VERR_SUPLIB_NT_PROCESS_UNTRUSTED_1:
1897 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPLIB_NT_PROCESS_UNTRUSTED_1");
1898 case VERR_SUPLIB_NT_PROCESS_UNTRUSTED_2:
1899 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Integrity, rc, "VERR_SUPLIB_NT_PROCESS_UNTRUSTED_2");
1900 default:
1901 supR3HardenedFatalMsg("suplibOsInit", kSupInitOp_Driver, rc, "Unknown rc=%d (%Rrc)", rc, rc);
1902 }
1903}
1904
1905
1906#ifdef SUP_HARDENED_SUID
1907
1908/**
1909 * Grabs extra non-root capabilities / privileges that we might require.
1910 *
1911 * This is currently only used for being able to do ICMP from the NAT engine
1912 * and for being able to raise thread scheduling priority
1913 *
1914 * @note We still have root privileges at the time of this call.
1915 */
1916static void supR3HardenedMainGrabCapabilites(void)
1917{
1918# if defined(RT_OS_LINUX)
1919 /*
1920 * We are about to drop all our privileges. Remove all capabilities but
1921 * keep the cap_net_raw capability for ICMP sockets for the NAT stack,
1922 * also keep cap_sys_nice capability for priority tweaking.
1923 */
1924 if (g_uCaps != 0)
1925 {
1926# ifdef USE_LIB_PCAP
1927 /* XXX cap_net_bind_service */
1928 if (!cap_set_proc(cap_from_text("all-eip cap_net_raw+ep cap_sys_nice+ep")))
1929 prctl(PR_SET_KEEPCAPS, 1 /*keep=*/, 0, 0, 0);
1930 prctl(PR_SET_DUMPABLE, 1 /*dump*/, 0, 0, 0);
1931# else
1932 cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
1933 cap_user_data_t cap = (cap_user_data_t)alloca(2 /*_LINUX_CAPABILITY_U32S_3*/ * sizeof(*cap));
1934 memset(hdr, 0, sizeof(*hdr));
1935 capget(hdr, NULL);
1936 if ( hdr->version != 0x19980330 /* _LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_U32S_1 = 1 */
1937 && hdr->version != 0x20071026 /* _LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_U32S_2 = 2 */
1938 && hdr->version != 0x20080522 /* _LINUX_CAPABILITY_VERSION_3, _LINUX_CAPABILITY_U32S_3 = 2 */)
1939 hdr->version = _LINUX_CAPABILITY_VERSION;
1940 g_uCapsVersion = hdr->version;
1941 memset(cap, 0, 2 /* _LINUX_CAPABILITY_U32S_3 */ * sizeof(*cap));
1942 cap->effective = g_uCaps;
1943 cap->permitted = g_uCaps;
1944 if (!capset(hdr, cap))
1945 prctl(PR_SET_KEEPCAPS, 1 /*keep*/, 0, 0, 0);
1946 prctl(PR_SET_DUMPABLE, 1 /*dump*/, 0, 0, 0);
1947# endif /* !USE_LIB_PCAP */
1948 }
1949
1950# elif defined(RT_OS_SOLARIS)
1951 /*
1952 * Add net_icmpaccess privilege to effective privileges and limit
1953 * permitted privileges before completely dropping root privileges.
1954 * This requires dropping root privileges temporarily to get the normal
1955 * user's privileges.
1956 */
1957 seteuid(g_uid);
1958 priv_set_t *pPrivEffective = priv_allocset();
1959 priv_set_t *pPrivNew = priv_allocset();
1960 if (pPrivEffective && pPrivNew)
1961 {
1962 int rc = getppriv(PRIV_EFFECTIVE, pPrivEffective);
1963 seteuid(0);
1964 if (!rc)
1965 {
1966 priv_copyset(pPrivEffective, pPrivNew);
1967 rc = priv_addset(pPrivNew, PRIV_NET_ICMPACCESS);
1968 if (!rc)
1969 {
1970 /* Order is important, as one can't set a privilege which is
1971 * not in the permitted privilege set. */
1972 rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivNew);
1973 if (rc)
1974 supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
1975 rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivNew);
1976 if (rc)
1977 supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
1978 }
1979 else
1980 supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to add NET_ICMPACCESS privilege.\n");
1981 }
1982 }
1983 else
1984 {
1985 /* for memory allocation failures just continue */
1986 seteuid(0);
1987 }
1988
1989 if (pPrivEffective)
1990 priv_freeset(pPrivEffective);
1991 if (pPrivNew)
1992 priv_freeset(pPrivNew);
1993# endif
1994}
1995
1996/*
1997 * Look at the environment for some special options.
1998 */
1999static void supR3GrabOptions(void)
2000{
2001# ifdef RT_OS_LINUX
2002 g_uCaps = 0;
2003
2004 /*
2005 * Do _not_ perform any capability-related system calls for root processes
2006 * (leaving g_uCaps at 0).
2007 * (Hint: getuid gets the real user id, not the effective.)
2008 */
2009 if (getuid() != 0)
2010 {
2011 /*
2012 * CAP_NET_RAW.
2013 * Default: enabled.
2014 * Can be disabled with 'export VBOX_HARD_CAP_NET_RAW=0'.
2015 */
2016 const char *pszOpt = getenv("VBOX_HARD_CAP_NET_RAW");
2017 if ( !pszOpt
2018 || memcmp(pszOpt, "0", sizeof("0")) != 0)
2019 g_uCaps = CAP_TO_MASK(CAP_NET_RAW);
2020
2021 /*
2022 * CAP_NET_BIND_SERVICE.
2023 * Default: disabled.
2024 * Can be enabled with 'export VBOX_HARD_CAP_NET_BIND_SERVICE=1'.
2025 */
2026 pszOpt = getenv("VBOX_HARD_CAP_NET_BIND_SERVICE");
2027 if ( pszOpt
2028 && memcmp(pszOpt, "0", sizeof("0")) != 0)
2029 g_uCaps |= CAP_TO_MASK(CAP_NET_BIND_SERVICE);
2030
2031 /*
2032 * CAP_SYS_NICE.
2033 * Default: enabled.
2034 * Can be disabled with 'export VBOX_HARD_CAP_SYS_NICE=0'.
2035 */
2036 pszOpt = getenv("VBOX_HARD_CAP_SYS_NICE");
2037 if ( !pszOpt
2038 || memcmp(pszOpt, "0", sizeof("0")) != 0)
2039 g_uCaps |= CAP_TO_MASK(CAP_SYS_NICE);
2040 }
2041# endif
2042}
2043
2044/**
2045 * Drop any root privileges we might be holding.
2046 */
2047static void supR3HardenedMainDropPrivileges(void)
2048{
2049 /*
2050 * Try use setre[ug]id since this will clear the save uid/gid and thus
2051 * leave fewer traces behind that libs like GTK+ may pick up.
2052 */
2053 uid_t euid, ruid, suid;
2054 gid_t egid, rgid, sgid;
2055# if defined(RT_OS_DARWIN)
2056 /* The really great thing here is that setreuid isn't available on
2057 OS X 10.4, libc emulates it. While 10.4 have a slightly different and
2058 non-standard setuid implementation compared to 10.5, the following
2059 works the same way with both version since we're super user (10.5 req).
2060 The following will set all three variants of the group and user IDs. */
2061 setgid(g_gid);
2062 setuid(g_uid);
2063 euid = geteuid();
2064 ruid = suid = getuid();
2065 egid = getegid();
2066 rgid = sgid = getgid();
2067
2068# elif defined(RT_OS_SOLARIS)
2069 /* Solaris doesn't have setresuid, but the setreuid interface is BSD
2070 compatible and will set the saved uid to euid when we pass it a ruid
2071 that isn't -1 (which we do). */
2072 setregid(g_gid, g_gid);
2073 setreuid(g_uid, g_uid);
2074 euid = geteuid();
2075 ruid = suid = getuid();
2076 egid = getegid();
2077 rgid = sgid = getgid();
2078
2079# else
2080 /* This is the preferred one, full control no questions about semantics.
2081 PORTME: If this isn't work, try join one of two other gangs above. */
2082 int res = setresgid(g_gid, g_gid, g_gid);
2083 NOREF(res);
2084 res = setresuid(g_uid, g_uid, g_uid);
2085 NOREF(res);
2086 if (getresuid(&ruid, &euid, &suid) != 0)
2087 {
2088 euid = geteuid();
2089 ruid = suid = getuid();
2090 }
2091 if (getresgid(&rgid, &egid, &sgid) != 0)
2092 {
2093 egid = getegid();
2094 rgid = sgid = getgid();
2095 }
2096# endif
2097
2098
2099 /* Check that it worked out all right. */
2100 if ( euid != g_uid
2101 || ruid != g_uid
2102 || suid != g_uid
2103 || egid != g_gid
2104 || rgid != g_gid
2105 || sgid != g_gid)
2106 supR3HardenedFatal("SUPR3HardenedMain: failed to drop root privileges!"
2107 " (euid=%d ruid=%d suid=%d egid=%d rgid=%d sgid=%d; wanted uid=%d and gid=%d)\n",
2108 euid, ruid, suid, egid, rgid, sgid, g_uid, g_gid);
2109
2110# if RT_OS_LINUX
2111 /*
2112 * Re-enable the cap_net_raw and cap_sys_nice capabilities which were disabled during setresuid.
2113 */
2114 if (g_uCaps != 0)
2115 {
2116# ifdef USE_LIB_PCAP
2117 /** @todo Warn if that does not work? */
2118 /* XXX cap_net_bind_service */
2119 cap_set_proc(cap_from_text("cap_net_raw+ep cap_sys_nice+ep"));
2120# else
2121 cap_user_header_t hdr = (cap_user_header_t)alloca(sizeof(*hdr));
2122 cap_user_data_t cap = (cap_user_data_t)alloca(2 /* _LINUX_CAPABILITY_U32S_3 */ * sizeof(*cap));
2123 memset(hdr, 0, sizeof(*hdr));
2124 hdr->version = g_uCapsVersion;
2125 memset(cap, 0, 2 /* _LINUX_CAPABILITY_U32S_3 */ * sizeof(*cap));
2126 cap->effective = g_uCaps;
2127 cap->permitted = g_uCaps;
2128 /** @todo Warn if that does not work? */
2129 capset(hdr, cap);
2130# endif /* !USE_LIB_PCAP */
2131 }
2132# endif
2133}
2134
2135#endif /* SUP_HARDENED_SUID */
2136
2137/**
2138 * Purge the process environment from any environment vairable which can lead
2139 * to loading untrusted binaries compromising the process address space.
2140 *
2141 * @param envp The initial environment vector. (Can be NULL.)
2142 */
2143static void supR3HardenedMainPurgeEnvironment(char **envp)
2144{
2145 for (unsigned i = 0; i < RT_ELEMENTS(g_aSupEnvPurgeDescs); i++)
2146 {
2147 /*
2148 * Update the initial environment vector, just in case someone actually cares about it.
2149 */
2150 if (envp)
2151 {
2152 const char * const pszEnv = g_aSupEnvPurgeDescs[i].pszEnv;
2153 size_t const cchEnv = g_aSupEnvPurgeDescs[i].cchEnv;
2154 unsigned iSrc = 0;
2155 unsigned iDst = 0;
2156 char *pszTmp;
2157
2158 while ((pszTmp = envp[iSrc]) != NULL)
2159 {
2160 if ( memcmp(pszTmp, pszEnv, cchEnv) != 0
2161 || (pszTmp[cchEnv] != '=' && pszTmp[cchEnv] != '\0'))
2162 {
2163 if (iDst != iSrc)
2164 envp[iDst] = pszTmp;
2165 iDst++;
2166 }
2167 else
2168 SUP_DPRINTF(("supR3HardenedMainPurgeEnvironment: dropping envp[%d]=%s\n", iSrc, pszTmp));
2169 iSrc++;
2170 }
2171
2172 if (iDst != iSrc)
2173 while (iDst <= iSrc)
2174 envp[iDst++] = NULL;
2175 }
2176
2177 /*
2178 * Remove from the process environment if present.
2179 */
2180#ifndef RT_OS_WINDOWS
2181 const char *pszTmp = getenv(g_aSupEnvPurgeDescs[i].pszEnv);
2182 if (pszTmp != NULL)
2183 {
2184 if (unsetenv((char *)g_aSupEnvPurgeDescs[i].pszEnv) == 0)
2185 SUP_DPRINTF(("supR3HardenedMainPurgeEnvironment: dropped %s\n", pszTmp));
2186 else
2187 if (g_aSupEnvPurgeDescs[i].fPurgeErrFatal)
2188 supR3HardenedFatal("SUPR3HardenedMain: failed to purge %s environment variable! (errno=%d %s)\n",
2189 g_aSupEnvPurgeDescs[i].pszEnv, errno, strerror(errno));
2190 else
2191 SUP_DPRINTF(("supR3HardenedMainPurgeEnvironment: dropping %s failed! errno=%d\n", pszTmp, errno));
2192 }
2193#else
2194 /** @todo Call NT API to do the same. */
2195#endif
2196 }
2197}
2198
2199
2200/**
2201 * Returns the argument purge descriptor of the given argument if available.
2202 *
2203 * @retval 0 if it should not be purged.
2204 * @retval 1 if it only the current argument should be purged.
2205 * @retval 2 if the argument and the following (if present) should be purged.
2206 * @param pszArg The argument to look for.
2207 */
2208static unsigned supR3HardenedMainShouldPurgeArg(const char *pszArg)
2209{
2210 for (unsigned i = 0; i < RT_ELEMENTS(g_aSupArgPurgeDescs); i++)
2211 {
2212 size_t const cchPurge = g_aSupArgPurgeDescs[i].cchArg;
2213 if (!memcmp(pszArg, g_aSupArgPurgeDescs[i].pszArg, cchPurge))
2214 {
2215 if (pszArg[cchPurge] == '\0')
2216 return 1 + g_aSupArgPurgeDescs[i].fTakesValue;
2217 if ( g_aSupArgPurgeDescs[i].fTakesValue
2218 && (pszArg[cchPurge] == ':' || pszArg[cchPurge] == '='))
2219 return 1;
2220 }
2221 }
2222
2223 return 0;
2224}
2225
2226
2227/**
2228 * Purges any command line arguments considered harmful.
2229 *
2230 * @param cArgsOrig The original number of arguments.
2231 * @param papszArgsOrig The original argument vector.
2232 * @param pcArgsNew Where to store the new number of arguments on success.
2233 * @param ppapszArgsNew Where to store the pointer to the purged argument vector.
2234 */
2235static void supR3HardenedMainPurgeArgs(int cArgsOrig, char **papszArgsOrig, int *pcArgsNew, char ***ppapszArgsNew)
2236{
2237 int iDst = 0;
2238#ifdef RT_OS_WINDOWS
2239 char **papszArgsNew = papszArgsOrig; /* We allocated this, no need to allocate again. */
2240#else
2241 char **papszArgsNew = (char **)malloc((cArgsOrig + 1) * sizeof(char *));
2242#endif
2243 if (papszArgsNew)
2244 {
2245 for (int iSrc = 0; iSrc < cArgsOrig; iSrc++)
2246 {
2247 unsigned cPurgedArgs = supR3HardenedMainShouldPurgeArg(papszArgsOrig[iSrc]);
2248 if (!cPurgedArgs)
2249 papszArgsNew[iDst++] = papszArgsOrig[iSrc];
2250 else
2251 iSrc += cPurgedArgs - 1;
2252 }
2253
2254 papszArgsNew[iDst] = NULL; /* The array is NULL terminated, just like envp. */
2255 }
2256 else
2257 supR3HardenedFatal("SUPR3HardenedMain: failed to allocate memory for purged command line!\n");
2258 *pcArgsNew = iDst;
2259 *ppapszArgsNew = papszArgsNew;
2260
2261#ifdef RT_OS_WINDOWS
2262 /** @todo Update command line pointers in PEB, wont really work without it. */
2263#endif
2264}
2265
2266
2267/**
2268 * Loads the VBoxRT DLL/SO/DYLIB, hands it the open driver,
2269 * and calls RTR3InitEx.
2270 *
2271 * @param fFlags The SUPR3HardenedMain fFlags argument, passed to supR3PreInit.
2272 *
2273 * @remarks VBoxRT contains both IPRT and SUPR3.
2274 * @remarks This function will not return on failure.
2275 */
2276static void supR3HardenedMainInitRuntime(uint32_t fFlags)
2277{
2278 /*
2279 * Construct the name.
2280 */
2281 char szPath[RTPATH_MAX];
2282 supR3HardenedPathAppSharedLibs(szPath, sizeof(szPath) - sizeof("/VBoxRT" SUPLIB_DLL_SUFF));
2283 suplibHardenedStrCat(szPath, "/VBoxRT" SUPLIB_DLL_SUFF);
2284
2285 /*
2286 * Open it and resolve the symbols.
2287 */
2288#if defined(RT_OS_WINDOWS)
2289 HMODULE hMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, false /*fSystem32Only*/, g_fSupHardenedMain);
2290 if (!hMod)
2291 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
2292 "LoadLibrary \"%s\" failed (rc=%d)",
2293 szPath, RtlGetLastWin32Error());
2294 PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)GetProcAddress(hMod, SUP_HARDENED_SYM("RTR3InitEx"));
2295 if (!pfnRTInitEx)
2296 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2297 "Entrypoint \"RTR3InitEx\" not found in \"%s\" (rc=%d)",
2298 szPath, RtlGetLastWin32Error());
2299
2300 PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)GetProcAddress(hMod, SUP_HARDENED_SYM("supR3PreInit"));
2301 if (!pfnSUPPreInit)
2302 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2303 "Entrypoint \"supR3PreInit\" not found in \"%s\" (rc=%d)",
2304 szPath, RtlGetLastWin32Error());
2305
2306 g_pfnRTLogRelPrintf = (PFNRTLOGRELPRINTF)GetProcAddress(hMod, SUP_HARDENED_SYM("RTLogRelPrintf"));
2307 Assert(g_pfnRTLogRelPrintf); /* Not fatal in non-strict builds. */
2308
2309#else
2310 /* the dlopen crowd */
2311 void *pvMod = dlopen(szPath, RTLD_NOW | RTLD_GLOBAL);
2312 if (!pvMod)
2313 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_MODULE_NOT_FOUND,
2314 "dlopen(\"%s\",) failed: %s",
2315 szPath, dlerror());
2316 PFNRTR3INITEX pfnRTInitEx = (PFNRTR3INITEX)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("RTR3InitEx"));
2317 if (!pfnRTInitEx)
2318 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2319 "Entrypoint \"RTR3InitEx\" not found in \"%s\"!\ndlerror: %s",
2320 szPath, dlerror());
2321 PFNSUPR3PREINIT pfnSUPPreInit = (PFNSUPR3PREINIT)(uintptr_t)dlsym(pvMod, SUP_HARDENED_SYM("supR3PreInit"));
2322 if (!pfnSUPPreInit)
2323 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, VERR_SYMBOL_NOT_FOUND,
2324 "Entrypoint \"supR3PreInit\" not found in \"%s\"!\ndlerror: %s",
2325 szPath, dlerror());
2326#endif
2327
2328 /*
2329 * Make the calls.
2330 */
2331 supR3HardenedGetPreInitData(&g_SupPreInitData);
2332 int rc = pfnSUPPreInit(&g_SupPreInitData, fFlags);
2333 if (RT_FAILURE(rc))
2334 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
2335 "supR3PreInit failed with rc=%d", rc);
2336
2337 /* Get the executable path for the IPRT init on linux if /proc/self/exe isn't accessible. */
2338 const char *pszExePath = NULL;
2339#ifdef RT_OS_LINUX
2340 if (!supR3HardenedMainIsProcSelfExeAccssible())
2341 pszExePath = g_szSupLibHardenedExePath;
2342#endif
2343
2344 /* Assemble the IPRT init flags. We could probably just pass RTR3INIT_FLAGS_TRY_SUPLIB
2345 here and be done with it, but it's not too much hazzle to convert fFlags 1:1. */
2346 uint32_t fRtInit = 0;
2347 if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
2348 {
2349 if (fFlags & SUPSECMAIN_FLAGS_DRIVERLESS)
2350 fRtInit |= (SUPR3INIT_F_DRIVERLESS << RTR3INIT_FLAGS_SUPLIB_SHIFT) | RTR3INIT_FLAGS_TRY_SUPLIB;
2351 if (fFlags & SUPSECMAIN_FLAGS_DRIVERLESS_IEM_ALLOWED)
2352 fRtInit |= (SUPR3INIT_F_DRIVERLESS_IEM_ALLOWED << RTR3INIT_FLAGS_SUPLIB_SHIFT) | RTR3INIT_FLAGS_TRY_SUPLIB;
2353#ifdef VBOX_WITH_DRIVERLESS_NEM_FALLBACK
2354 if (fFlags & SUPSECMAIN_FLAGS_DRIVERLESS_NEM_FALLBACK)
2355 fRtInit |= (SUPR3INIT_F_DRIVERLESS_NEM_FALLBACK << RTR3INIT_FLAGS_SUPLIB_SHIFT) | RTR3INIT_FLAGS_TRY_SUPLIB;
2356#endif
2357 if (!(fRtInit & RTR3INIT_FLAGS_TRY_SUPLIB))
2358 fRtInit |= RTR3INIT_FLAGS_SUPLIB;
2359 }
2360
2361 /* Now do the IPRT init. */
2362 rc = pfnRTInitEx(RTR3INIT_VER_CUR, fRtInit, 0 /*cArgs*/, NULL /*papszArgs*/, pszExePath);
2363 if (RT_FAILURE(rc))
2364 supR3HardenedFatalMsg("supR3HardenedMainInitRuntime", kSupInitOp_IPRT, rc,
2365 "RTR3InitEx failed with rc=%d (fRtFlags=%#x)", rc, fRtInit);
2366
2367#if defined(RT_OS_WINDOWS)
2368 /*
2369 * Windows: Create thread that terminates the process when the parent stub
2370 * process terminates (VBoxNetDHCP, Ctrl-C, etc).
2371 */
2372 if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
2373 supR3HardenedWinCreateParentWatcherThread(hMod);
2374#endif
2375}
2376
2377
2378/**
2379 * Construct the path to the DLL/SO/DYLIB containing the actual program.
2380 *
2381 * @returns VBox status code.
2382 * @param pszProgName The program name.
2383 * @param fMainFlags The flags passed to SUPR3HardenedMain.
2384 * @param pszPath The output buffer.
2385 * @param cbPath The size of the output buffer, in bytes. Must be at
2386 * least 128 bytes!
2387 */
2388static int supR3HardenedMainGetTrustedLib(const char *pszProgName, uint32_t fMainFlags, char *pszPath, size_t cbPath)
2389{
2390 supR3HardenedPathAppPrivateArch(pszPath, sizeof(cbPath) - 10);
2391 const char *pszSubDirSlash;
2392 switch (g_fSupHardenedMain & SUPSECMAIN_FLAGS_LOC_MASK)
2393 {
2394 case SUPSECMAIN_FLAGS_LOC_APP_BIN:
2395#ifdef RT_OS_DARWIN
2396 case SUPSECMAIN_FLAGS_LOC_OSX_HLP_APP:
2397#endif
2398 pszSubDirSlash = "/";
2399 break;
2400 case SUPSECMAIN_FLAGS_LOC_TESTCASE:
2401 pszSubDirSlash = "/testcase/";
2402 break;
2403 default:
2404 pszSubDirSlash = "/";
2405 supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Unknown program binary location: %#x\n", g_fSupHardenedMain);
2406 }
2407#ifdef RT_OS_DARWIN
2408 if (fMainFlags & SUPSECMAIN_FLAGS_OSX_VM_APP)
2409 pszProgName = "VirtualBox";
2410#else
2411 RT_NOREF1(fMainFlags);
2412#endif
2413 size_t cch = suplibHardenedStrLen(pszPath);
2414 return suplibHardenedStrCopyEx(&pszPath[cch], cbPath - cch, pszSubDirSlash, pszProgName, SUPLIB_DLL_SUFF, NULL);
2415}
2416
2417
2418/**
2419 * Loads the DLL/SO/DYLIB containing the actual program and
2420 * resolves the TrustedError symbol.
2421 *
2422 * This is very similar to supR3HardenedMainGetTrustedMain().
2423 *
2424 * @returns Pointer to the trusted error symbol if it is exported, NULL
2425 * and no error messages otherwise.
2426 * @param pszProgName The program name.
2427 */
2428static PFNSUPTRUSTEDERROR supR3HardenedMainGetTrustedError(const char *pszProgName)
2429{
2430 /*
2431 * Don't bother if the main() function didn't advertise any TrustedError
2432 * export. It's both a waste of time and may trigger additional problems,
2433 * confusing or obscuring the original issue.
2434 */
2435 if (!(g_fSupHardenedMain & SUPSECMAIN_FLAGS_TRUSTED_ERROR))
2436 return NULL;
2437
2438 /*
2439 * Construct the name.
2440 */
2441 char szPath[RTPATH_MAX];
2442 supR3HardenedMainGetTrustedLib(pszProgName, g_fSupHardenedMain, szPath, sizeof(szPath));
2443
2444 /*
2445 * Open it and resolve the symbol.
2446 */
2447#if defined(RT_OS_WINDOWS)
2448 supR3HardenedWinEnableThreadCreation();
2449 HMODULE hMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, false /*fSystem32Only*/, 0 /*fMainFlags*/);
2450 if (!hMod)
2451 return NULL;
2452 FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedError"));
2453 if (!pfn)
2454 return NULL;
2455 return (PFNSUPTRUSTEDERROR)pfn;
2456
2457#else
2458 /* the dlopen crowd */
2459 void *pvMod = dlopen(szPath, RTLD_NOW | RTLD_GLOBAL);
2460 if (!pvMod)
2461 return NULL;
2462 void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedError"));
2463 if (!pvSym)
2464 return NULL;
2465 return (PFNSUPTRUSTEDERROR)(uintptr_t)pvSym;
2466#endif
2467}
2468
2469
2470/**
2471 * Loads the DLL/SO/DYLIB containing the actual program and
2472 * resolves the TrustedMain symbol.
2473 *
2474 * @returns Pointer to the trusted main of the actual program.
2475 * @param pszProgName The program name.
2476 * @param fMainFlags The flags passed to SUPR3HardenedMain.
2477 * @remarks This function will not return on failure.
2478 */
2479static PFNSUPTRUSTEDMAIN supR3HardenedMainGetTrustedMain(const char *pszProgName, uint32_t fMainFlags)
2480{
2481 /*
2482 * Construct the name.
2483 */
2484 char szPath[RTPATH_MAX];
2485 supR3HardenedMainGetTrustedLib(pszProgName, fMainFlags, szPath, sizeof(szPath));
2486
2487 /*
2488 * Open it and resolve the symbol.
2489 */
2490#if defined(RT_OS_WINDOWS)
2491 HMODULE hMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, false /*fSystem32Only*/, 0 /*fMainFlags*/);
2492 if (!hMod)
2493 supR3HardenedFatal("supR3HardenedMainGetTrustedMain: LoadLibrary \"%s\" failed, rc=%d\n",
2494 szPath, RtlGetLastWin32Error());
2495 FARPROC pfn = GetProcAddress(hMod, SUP_HARDENED_SYM("TrustedMain"));
2496 if (!pfn)
2497 supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\" (rc=%d)\n",
2498 szPath, RtlGetLastWin32Error());
2499 return (PFNSUPTRUSTEDMAIN)pfn;
2500
2501#else
2502 /* the dlopen crowd */
2503 void *pvMod = dlopen(szPath, RTLD_NOW | RTLD_GLOBAL);
2504 if (!pvMod)
2505 supR3HardenedFatal("supR3HardenedMainGetTrustedMain: dlopen(\"%s\",) failed: %s\n",
2506 szPath, dlerror());
2507 void *pvSym = dlsym(pvMod, SUP_HARDENED_SYM("TrustedMain"));
2508 if (!pvSym)
2509 supR3HardenedFatal("supR3HardenedMainGetTrustedMain: Entrypoint \"TrustedMain\" not found in \"%s\"!\ndlerror: %s\n",
2510 szPath, dlerror());
2511 return (PFNSUPTRUSTEDMAIN)(uintptr_t)pvSym;
2512#endif
2513}
2514
2515
2516DECLHIDDEN(int) SUPR3HardenedMain(const char *pszProgName, uint32_t fFlags, int argc, char **argv, char **envp)
2517{
2518 SUP_DPRINTF(("SUPR3HardenedMain: pszProgName=%s fFlags=%#x\n", pszProgName, fFlags));
2519 g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_HARDENED_MAIN_CALLED;
2520
2521 /*
2522 * Note! At this point there is no IPRT, so we will have to stick
2523 * to basic CRT functions that everyone agree upon.
2524 */
2525 g_pszSupLibHardenedProgName = pszProgName;
2526 g_fSupHardenedMain = fFlags;
2527 g_SupPreInitData.u32Magic = SUPPREINITDATA_MAGIC;
2528 g_SupPreInitData.u32EndMagic = SUPPREINITDATA_MAGIC;
2529#ifdef RT_OS_WINDOWS
2530 if (!g_fSupEarlyProcessInit)
2531#endif
2532 g_SupPreInitData.Data.hDevice = SUP_HDEVICE_NIL;
2533
2534 /*
2535 * Determine the full exe path as we'll be needing it for the verify all
2536 * call(s) below. (We have to do this early on Linux because we * *might*
2537 * not be able to access /proc/self/exe after the seteuid call.)
2538 */
2539 supR3HardenedGetFullExePath();
2540#ifdef RT_OS_WINDOWS
2541 supR3HardenedWinInitAppBin(fFlags);
2542#endif
2543
2544#ifdef SUP_HARDENED_SUID
2545 /*
2546 * Grab any options from the environment.
2547 */
2548 supR3GrabOptions();
2549
2550 /*
2551 * Check that we're root, if we aren't then the installation is butchered.
2552 */
2553 g_uid = getuid();
2554 g_gid = getgid();
2555 if (geteuid() != 0 /* root */)
2556 supR3HardenedFatalMsg("SUPR3HardenedMain", kSupInitOp_RootCheck, VERR_PERMISSION_DENIED,
2557 "Effective UID is not root (euid=%d egid=%d uid=%d gid=%d)",
2558 geteuid(), getegid(), g_uid, g_gid);
2559#endif /* SUP_HARDENED_SUID */
2560
2561#ifdef RT_OS_WINDOWS
2562 /*
2563 * Windows: First respawn. On Windows we will respawn the process twice to establish
2564 * something we can put some kind of reliable trust in. The first respawning aims
2565 * at dropping compatibility layers and process "security" solutions.
2566 */
2567 if ( !g_fSupEarlyProcessInit
2568 && !(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV)
2569 && supR3HardenedWinIsReSpawnNeeded(1 /*iWhich*/, argc, argv))
2570 {
2571 SUP_DPRINTF(("SUPR3HardenedMain: Respawn #1\n"));
2572 supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV | SUPSECMAIN_FLAGS_FIRST_PROCESS, false /*fAvastKludge*/);
2573 supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
2574 return supR3HardenedWinReSpawn(1 /*iWhich*/);
2575 }
2576
2577 /*
2578 * Windows: Initialize the image verification global data so we can verify the
2579 * signature of the process image and hook the core of the DLL loader API so we
2580 * can check the signature of all DLLs mapped into the process. (Already done
2581 * by early VM process init.)
2582 */
2583 if (!g_fSupEarlyProcessInit)
2584 supR3HardenedWinInit(fFlags, true /*fAvastKludge*/);
2585#endif /* RT_OS_WINDOWS */
2586
2587 /*
2588 * Validate the installation.
2589 */
2590 supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
2591
2592 /*
2593 * The next steps are only taken if we actually need to access the support
2594 * driver. (Already done by early process init.)
2595 */
2596 if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
2597 {
2598#ifdef RT_OS_WINDOWS
2599 /*
2600 * Windows: Must have done early process init if we get here.
2601 */
2602 if (!g_fSupEarlyProcessInit)
2603 supR3HardenedFatalMsg("SUPR3HardenedMain", kSupInitOp_Integrity, VERR_WRONG_ORDER,
2604 "Early process init was somehow skipped.");
2605
2606 /*
2607 * Windows: The second respawn. This time we make a special arrangement
2608 * with vboxdrv to monitor access to the new process from its inception.
2609 */
2610 if (supR3HardenedWinIsReSpawnNeeded(2 /* iWhich*/, argc, argv))
2611 {
2612 SUP_DPRINTF(("SUPR3HardenedMain: Respawn #2\n"));
2613 return supR3HardenedWinReSpawn(2 /* iWhich*/);
2614 }
2615 SUP_DPRINTF(("SUPR3HardenedMain: Final process, opening VBoxDrv...\n"));
2616 supR3HardenedWinFlushLoaderCache();
2617
2618#else
2619 /*
2620 * Open the vboxdrv device.
2621 */
2622 supR3HardenedMainOpenDevice();
2623#endif /* !RT_OS_WINDOWS */
2624 }
2625
2626#ifdef RT_OS_WINDOWS
2627 /*
2628 * Windows: Enable the use of windows APIs to verify images at load time.
2629 */
2630 supR3HardenedWinEnableThreadCreation();
2631 supR3HardenedWinFlushLoaderCache();
2632 supR3HardenedWinResolveVerifyTrustApiAndHookThreadCreation(g_pszSupLibHardenedProgName);
2633 g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_WIN_VERIFY_TRUST_READY;
2634#else /* !RT_OS_WINDOWS */
2635# if defined(RT_OS_DARWIN)
2636 supR3HardenedDarwinInit();
2637# elif !defined(RT_OS_FREEBSD) /** @todo Portme. */
2638 /*
2639 * Posix: Hook the load library interface interface.
2640 */
2641 supR3HardenedPosixInit();
2642# endif
2643#endif /* !RT_OS_WINDOWS */
2644
2645#ifdef SUP_HARDENED_SUID
2646 /*
2647 * Grab additional capabilities / privileges.
2648 */
2649 supR3HardenedMainGrabCapabilites();
2650
2651 /*
2652 * Drop any root privileges we might be holding (won't return on failure)
2653 */
2654 supR3HardenedMainDropPrivileges();
2655#endif
2656
2657 /*
2658 * Purge any environment variables and command line arguments considered harmful.
2659 */
2660 /** @todo May need to move this to a much earlier stage on windows. */
2661 supR3HardenedMainPurgeEnvironment(envp);
2662 supR3HardenedMainPurgeArgs(argc, argv, &argc, &argv);
2663
2664 /*
2665 * Load the IPRT, hand the SUPLib part the open driver and
2666 * call RTR3InitEx.
2667 */
2668 SUP_DPRINTF(("SUPR3HardenedMain: Load Runtime...\n"));
2669 g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_INIT_RUNTIME;
2670 supR3HardenedMainInitRuntime(fFlags);
2671#ifdef RT_OS_WINDOWS
2672 supR3HardenedWinModifyDllSearchPath(fFlags, g_szSupLibHardenedAppBinPath);
2673#endif
2674
2675 /*
2676 * Load the DLL/SO/DYLIB containing the actual program
2677 * and pass control to it.
2678 */
2679 SUP_DPRINTF(("SUPR3HardenedMain: Load TrustedMain...\n"));
2680 g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_GET_TRUSTED_MAIN;
2681 PFNSUPTRUSTEDMAIN pfnTrustedMain = supR3HardenedMainGetTrustedMain(pszProgName, fFlags);
2682
2683 SUP_DPRINTF(("SUPR3HardenedMain: Calling TrustedMain (%p)...\n", pfnTrustedMain));
2684 g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN;
2685 return pfnTrustedMain(argc, argv, envp);
2686}
2687
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette