VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 18499

Last change on this file since 18499 was 18154, checked in by vboxsync, 15 years ago

SUPR3HardenedVerify: restored correct column alignment.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 31.7 KB
Line 
1/* $Id: SUPR3HardenedVerify.cpp 18154 2009-03-23 16:58:21Z vboxsync $ */
2/** @file
3 * VirtualBox Support Library - Verification of Hardened Installation.
4 */
5
6/*
7 * Copyright (C) 2006-2008 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 *
26 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27 * Clara, CA 95054 USA or visit http://www.sun.com if you need
28 * additional information or have any questions.
29 */
30
31/*******************************************************************************
32* Header Files *
33*******************************************************************************/
34#if defined(RT_OS_OS2)
35# define INCL_BASE
36# define INCL_ERRORS
37# include <os2.h>
38# include <stdio.h>
39# include <stdlib.h>
40# include <unistd.h>
41# include <sys/fcntl.h>
42# include <sys/errno.h>
43# include <sys/syslimits.h>
44
45#elif defined(RT_OS_WINDOWS)
46# include <Windows.h>
47# include <stdio.h>
48
49#else /* UNIXes */
50# include <sys/types.h>
51# include <stdio.h>
52# include <stdlib.h>
53# include <dlfcn.h>
54# include <fcntl.h>
55# include <limits.h>
56# include <errno.h>
57# include <unistd.h>
58# include <sys/stat.h>
59# include <sys/time.h>
60# include <sys/fcntl.h>
61# include <stdio.h>
62# include <pwd.h>
63# ifdef RT_OS_DARWIN
64# include <mach-o/dyld.h>
65# endif
66
67#endif
68
69#include <VBox/sup.h>
70#include <VBox/err.h>
71#include <iprt/string.h>
72#include <iprt/param.h>
73
74#include "SUPLibInternal.h"
75
76
77
78
79/*******************************************************************************
80* Global Variables *
81*******************************************************************************/
82/**
83 * The files that gets verified.
84 *
85 * @todo This needs reviewing against the linux packages.
86 * @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
87 * the time being we're building the linux packages with SharedLib pointing to
88 * AppPrivArch (lazy bird).
89 */
90static SUPINSTFILE const g_aSupInstallFiles[] =
91{
92 /* type, dir, fOpt, "pszFile" */
93 /* ---------------------------------------------------------------------- */
94 { kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
95 { kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
96 { kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
97
98 { kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
99 { kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
100 { kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
101
102 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
103 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
104 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
105#if HC_ARCH_BITS == 32
106 { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
107 { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
108#endif
109 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
110 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
111 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
112
113//#ifdef VBOX_WITH_DEBUGGER_GUI
114 { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
115 { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
116//#endif
117
118//#ifdef VBOX_WITH_SHARED_CLIPBOARD
119 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
120//#endif
121//#ifdef VBOX_WITH_SHARED_FOLDERS
122 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
123//#endif
124//#ifdef VBOX_WITH_GUEST_PROPS
125 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
126//#endif
127 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
128 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
129 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
130 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
131
132 { kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
133
134#ifdef VBOX_WITH_MAIN
135 { kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
136 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxSettings" SUPLIB_DLL_SUFF },
137 #ifdef RT_OS_WINDOWS
138 { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
139 #else
140 { kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
141 { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
142 { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
143 { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
144 { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
145 { kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
146 #endif
147#endif
148
149//#ifdef VBOX_WITH_VRDP
150 { kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
151 { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
152//#endif
153
154//#ifdef VBOX_WITH_HEADLESS
155 { kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
156 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
157 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
158//#endif
159
160//#ifdef VBOX_WITH_QTGUI
161 { kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
162 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
163# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
164 { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
165# endif
166//#endif
167
168//#ifdef VBOX_WITH_VBOXSDL
169 { kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
170 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
171//#endif
172
173//#ifdef VBOX_WITH_VBOXBFE
174 { kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
175 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
176//#endif
177
178//#ifdef VBOX_WITH_WEBSERVICES
179 { kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
180//#endif
181
182#ifdef RT_OS_LINUX
183 { kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
184#endif
185
186//#ifdef VBOX_WITH_NETFLT
187 { kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
188 { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
189//#endif
190};
191
192
193/** Array parallel to g_aSupInstallFiles containing per-file status info. */
194static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
195
196/** Array index by install directory specifier containing info about verified directories. */
197static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
198
199
200/**
201 * Assembles the path to a dirtory.
202 *
203 * @returns VINF_SUCCESS on success, some error code on failure (fFatal
204 * decides whether it returns or not).
205 *
206 * @param enmDir The directory.
207 * @param pszDst Where to assemble the path.
208 * @param cchDst The size of the buffer.
209 * @param fFatal Whether failures should be treated as fatal (true) or not (false).
210 */
211static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
212{
213 int rc;
214 switch (enmDir)
215 {
216 case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
217 case kSupID_Bin:
218 rc = supR3HardenedPathProgram(pszDst, cchDst);
219 break;
220 case kSupID_SharedLib:
221 rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
222 break;
223 case kSupID_AppPrivArch:
224 rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
225 break;
226 case kSupID_AppPrivArchComp:
227 rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
228 if (RT_SUCCESS(rc))
229 {
230 size_t off = strlen(pszDst);
231 if (cchDst - off >= sizeof("/components"))
232 memcpy(&pszDst[off], "/components", sizeof("/components"));
233 else
234 rc = VERR_BUFFER_OVERFLOW;
235 }
236 break;
237 case kSupID_AppPrivNoArch:
238 rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
239 break;
240 default:
241 return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
242 "supR3HardenedMakePath: enmDir=%d\n", enmDir);
243 }
244 if (RT_FAILURE(rc))
245 supR3HardenedError(rc, fFatal,
246 "supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
247 return rc;
248}
249
250
251
252/**
253 * Assembles the path to a file table entry, with or without the actual filename.
254 *
255 * @returns VINF_SUCCESS on success, some error code on failure (fFatal
256 * decides whether it returns or not).
257 *
258 * @param pFile The file table entry.
259 * @param pszDst Where to assemble the path.
260 * @param cchDst The size of the buffer.
261 * @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
262 * @param fFatal Whether failures should be treated as fatal (true) or not (false).
263 */
264static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
265{
266 /*
267 * Combine supR3HardenedMakePath and the filename.
268 */
269 int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
270 if (RT_SUCCESS(rc))
271 {
272 size_t cchFile = strlen(pFile->pszFile);
273 size_t off = strlen(pszDst);
274 if (cchDst - off >= cchFile + 2)
275 {
276 pszDst[off++] = '/';
277 memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
278 }
279 else
280 rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
281 "supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
282 pFile->pszFile, (long)off);
283 }
284 return rc;
285}
286
287
288/**
289 * Verifies a directory.
290 *
291 * @returns VINF_SUCCESS on success. On failure, an error code is returned if
292 * fFatal is clear and if it's set the function wont return.
293 * @param enmDir The directory specifier.
294 * @param fFatal Whether validation failures should be treated as
295 * fatal (true) or not (false).
296 */
297DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
298{
299 /*
300 * Validate the index just to be on the safe side...
301 */
302 if (enmDir <= kSupID_Invalid || enmDir >= kSupID_End)
303 return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
304 "supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
305
306 /*
307 * Already validated?
308 */
309 if (g_aSupVerifiedDirs[enmDir].fValidated)
310 return VINF_SUCCESS; /** @todo revalidate? */
311
312 /* initialize the entry. */
313 if (g_aSupVerifiedDirs[enmDir].hDir != 0)
314 supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
315 "supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
316 (void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
317 g_aSupVerifiedDirs[enmDir].hDir = -1;
318 g_aSupVerifiedDirs[enmDir].fValidated = false;
319
320 /*
321 * Make the path and open the directory.
322 */
323 char szPath[RTPATH_MAX];
324 int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
325 if (RT_SUCCESS(rc))
326 {
327#if defined(RT_OS_WINDOWS)
328 HANDLE hDir = CreateFile(szPath,
329 GENERIC_READ,
330 FILE_SHARE_READ | FILE_SHARE_DELETE | FILE_SHARE_WRITE,
331 NULL,
332 OPEN_ALWAYS,
333 FILE_ATTRIBUTE_NORMAL | FILE_FLAG_BACKUP_SEMANTICS,
334 NULL);
335 if (hDir != INVALID_HANDLE_VALUE)
336 {
337 /** @todo check the type */
338 /* That's all on windows, for now at least... */
339 g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
340 g_aSupVerifiedDirs[enmDir].fValidated = true;
341 }
342 else
343 {
344 int err = GetLastError();
345 rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
346 "supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
347 szPath, err);
348 }
349#else /* UNIXY */
350 int fd = open(szPath, O_RDONLY, 0);
351 if (fd >= 0)
352 {
353 /*
354 * On unixy systems we'll make sure the directory is owned by root
355 * and not writable by the group and user.
356 */
357 struct stat st;
358 if (!fstat(fd, &st))
359 {
360
361 if ( st.st_uid == 0
362 && !(st.st_mode & (S_IWGRP | S_IWOTH))
363 && S_ISDIR(st.st_mode))
364 {
365 g_aSupVerifiedDirs[enmDir].hDir = fd;
366 g_aSupVerifiedDirs[enmDir].fValidated = true;
367 }
368 else
369 {
370 if (!S_ISDIR(st.st_mode))
371 rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
372 "supR3HardenedVerifyDir: \"%s\" is not a directory\n",
373 szPath, (long)st.st_uid);
374 else if (st.st_uid)
375 rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
376 "supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
377 szPath, (long)st.st_uid);
378 else
379 rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
380 "supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
381 szPath, (long)st.st_mode);
382 close(fd);
383 }
384 }
385 else
386 {
387 int err = errno;
388 rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
389 "supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
390 szPath, strerror(err), err);
391 close(fd);
392 }
393 }
394 else
395 {
396 int err = errno;
397 rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
398 "supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
399 szPath, strerror(err), err);
400 }
401#endif /* UNIXY */
402 }
403
404 return rc;
405}
406
407
408/**
409 * Verifies a file entry.
410 *
411 * @returns VINF_SUCCESS on success. On failure, an error code is returned if
412 * fFatal is clear and if it's set the function wont return.
413 *
414 * @param iFile The file table index of the file to be verified.
415 * @param fFatal Whether validation failures should be treated as
416 * fatal (true) or not (false).
417 * @param fLeaveFileOpen Whether the file should be left open.
418 */
419static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
420{
421 PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
422 PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
423
424 /*
425 * Already done?
426 */
427 if (pVerified->fValidated)
428 return VINF_SUCCESS; /** @todo revalidate? */
429
430
431 /* initialize the entry. */
432 if (pVerified->hFile != 0)
433 supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
434 "supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
435 (void *)pVerified->hFile, pFile->pszFile);
436 pVerified->hFile = -1;
437 pVerified->fValidated = false;
438
439 /*
440 * Verify the directory then proceed to open it.
441 * (This'll make sure the directory is opened and that we can (later)
442 * use openat if we wish.)
443 */
444 int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
445 if (RT_SUCCESS(rc))
446 {
447 char szPath[RTPATH_MAX];
448 int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
449 if (RT_SUCCESS(rc))
450 {
451#if defined(RT_OS_WINDOWS)
452 HANDLE hFile = CreateFile(szPath,
453 GENERIC_READ,
454 FILE_SHARE_READ,
455 NULL,
456 OPEN_ALWAYS,
457 FILE_ATTRIBUTE_NORMAL,
458 NULL);
459 if (hFile != INVALID_HANDLE_VALUE)
460 {
461 /** @todo Check the type, and verify the signature (separate function so we can skip it). */
462 {
463 /* it's valid. */
464 if (fLeaveFileOpen)
465 pVerified->hFile = (intptr_t)hFile;
466 else
467 CloseHandle(hFile);
468 pVerified->fValidated = true;
469 }
470 }
471 else
472 {
473 int err = GetLastError();
474 if (!pFile->fOptional || err != ERROR_FILE_NOT_FOUND)
475 rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
476 "supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
477 szPath, err);
478 }
479#else /* UNIXY */
480 int fd = open(szPath, O_RDONLY, 0);
481 if (fd >= 0)
482 {
483 /*
484 * On unixy systems we'll make sure the directory is owned by root
485 * and not writable by the group and user.
486 */
487 struct stat st;
488 if (!fstat(fd, &st))
489 {
490 if ( st.st_uid == 0
491 && !(st.st_mode & (S_IWGRP | S_IWOTH))
492 && S_ISREG(st.st_mode))
493 {
494 /* it's valid. */
495 if (fLeaveFileOpen)
496 pVerified->hFile = fd;
497 else
498 close(fd);
499 pVerified->fValidated = true;
500 }
501 else
502 {
503 if (!S_ISREG(st.st_mode))
504 rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
505 "supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
506 szPath, (long)st.st_uid);
507 else if (st.st_uid)
508 rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
509 "supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
510 szPath, (long)st.st_uid);
511 else
512 rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
513 "supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
514 szPath, (long)st.st_mode);
515 close(fd);
516 }
517 }
518 else
519 {
520 int err = errno;
521 rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
522 "supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
523 szPath, strerror(err), err);
524 close(fd);
525 }
526 }
527 else
528 {
529 int err = errno;
530 if (!pFile->fOptional || err != ENOENT)
531 rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
532 "supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
533 szPath, strerror(err), err);
534 }
535#endif /* UNIXY */
536 }
537 }
538
539 return rc;
540}
541
542
543/**
544 * Verifies that the specified table entry matches the given filename.
545 *
546 * @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
547 * error is returned or we terminate the application.
548 *
549 * @param iFile The file table index.
550 * @param pszFilename The filename.
551 * @param fFatal Whether validation failures should be treated as
552 * fatal (true) or not (false).
553 */
554static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
555{
556 PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
557
558 /*
559 * Construct the full path for the file table entry
560 * and compare it with the specified file.
561 */
562 char szName[RTPATH_MAX];
563 int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /*fWithFilename*/, fFatal);
564 if (RT_FAILURE(rc))
565 return rc;
566#if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
567 if (stricmp(szName, pszFilename))
568#else
569 if (strcmp(szName, pszFilename))
570#endif
571 {
572 /*
573 * Normalize the two paths and compare again.
574 */
575 rc = VERR_NOT_SAME_DEVICE;
576#if defined(RT_OS_WINDOWS)
577 LPSTR pszIgnored;
578 char szName2[RTPATH_MAX];
579 if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
580 && GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
581 if (!stricmp(szName2, szName))
582 rc = VINF_SUCCESS;
583#else
584 AssertCompile(RTPATH_MAX >= PATH_MAX);
585 char szName2[RTPATH_MAX];
586 if ( realpath(szName, szName2) != NULL
587 && realpath(pszFilename, szName) != NULL)
588 if (!strcmp(szName2, szName))
589 rc = VINF_SUCCESS;
590#endif
591
592 if (RT_FAILURE(rc))
593 {
594 supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /*fWithFilename*/, fFatal);
595 return supR3HardenedError(rc, fFatal,
596 "supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
597 pszFilename, szName);
598 }
599 }
600
601 /*
602 * Check more stuff like the stat info if it's an already open file?
603 */
604
605
606
607 return VINF_SUCCESS;
608}
609
610
611/**
612 * Verifies a file.
613 *
614 * @returns VINF_SUCCESS on success.
615 * VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
616 * On verfication failure, an error code will be returned when fFatal is clear,
617 * otherwise the program will be termindated.
618 *
619 * @param pszFilename The filename.
620 * @param fFatal Whether validation failures should be treated as
621 * fatal (true) or not (false).
622 */
623DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
624{
625 /*
626 * Lookup the file and check if it's the same file.
627 */
628 const char *pszName = supR3HardenedPathFilename(pszFilename);
629 for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
630 if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
631 {
632 int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
633 if (RT_SUCCESS(rc))
634 rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
635 return rc;
636 }
637
638 return VERR_NOT_FOUND;
639}
640
641
642/**
643 * Verifies a program, worker for supR3HardenedVerifyAll.
644 *
645 * @returns See supR3HardenedVerifyAll.
646 * @param pszProgName See supR3HardenedVerifyAll.
647 * @param fFatal See supR3HardenedVerifyAll.
648 */
649static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
650{
651 /*
652 * Search the table looking for the executable and the DLL/DYLIB/SO.
653 */
654 int rc = VINF_SUCCESS;
655 bool fExe = false;
656 bool fDll = false;
657 size_t const cchProgName = strlen(pszProgName);
658 for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
659 if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
660 {
661 if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
662 && !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
663 {
664 /* This only has to be found (once). */
665 if (fDll)
666 rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
667 "supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
668 fDll = true;
669 }
670 else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
671 && !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
672 {
673 /* Here we'll have to check that the specific program is the same as the entry. */
674 if (fExe)
675 rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
676 "supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
677 fExe = true;
678
679 char szFilename[RTPATH_MAX];
680 int rc2 = supR3HardenedPathProgram(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
681 if (RT_SUCCESS(rc2))
682 {
683 strcat(szFilename, "/");
684 strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
685 supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
686 }
687 else
688 rc = supR3HardenedError(rc2, fFatal,
689 "supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
690 }
691 }
692
693 /*
694 * Check the findings.
695 */
696 if (!fDll && !fExe)
697 rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
698 "supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
699 else if (!fExe)
700 rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
701 "supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
702 else if (!fDll)
703 rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
704 "supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
705 return rc;
706}
707
708
709
710/**
711 * Verifies all the known files.
712 *
713 * @returns VINF_SUCCESS on success.
714 * On verfication failure, an error code will be returned when fFatal is clear,
715 * otherwise the program will be termindated.
716 *
717 * @param fFatal Whether validation failures should be treated as
718 * fatal (true) or not (false).
719 * @param fLeaveFilesOpen If set, all the verfied files are left open.
720 * @param pszProgName Optional program name. This is used by SUPR3HardenedMain
721 * to verify that both the executable and corresponding
722 * DLL/DYLIB/SO are valid.
723 */
724DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
725{
726 /*
727 * The verify all the files.
728 */
729 int rc = VINF_SUCCESS;
730 for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
731 {
732 int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
733 if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
734 rc = rc2;
735 }
736
737 /*
738 * Verify the program name if specified, that is to say, just check that
739 * it's in the table (=> we've already verified it).
740 */
741 if (pszProgName)
742 {
743 int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
744 if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
745 rc2 = rc;
746 }
747
748 return rc;
749}
750
751
752/**
753 * Gets the pre-init data for the hand-over to the other version
754 * of this code.
755 *
756 * The reason why we pass this information on is that it contains
757 * open directories and files. Later it may include even more info
758 * (int the verified arrays mostly).
759 *
760 * The receiver is supR3HardenedRecvPreInitData.
761 *
762 * @param pPreInitData Where to store it.
763 */
764DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
765{
766 pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
767 pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
768 pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
769
770 pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
771 pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
772}
773
774
775/**
776 * Receives the pre-init data from the static executable stub.
777 *
778 * @returns VBox status code. Will not bitch on failure since the
779 * runtime isn't ready for it, so that is left to the exe stub.
780 *
781 * @param pPreInitData The hand-over data.
782 */
783DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
784{
785 /*
786 * Compare the array lengths and the contents of g_aSupInstallFiles.
787 */
788 if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
789 || pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
790 return VERR_VERSION_MISMATCH;
791 SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
792 for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
793 if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
794 || g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
795 || g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
796 || strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
797 return VERR_VERSION_MISMATCH;
798
799 /*
800 * Check that we're not called out of order.
801 * If dynamic linking it screwed up, we may end up here.
802 */
803 if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
804 || ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
805 return VERR_WRONG_ORDER;
806
807 /*
808 * Copy the verification data over.
809 */
810 memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
811 memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
812 return VINF_SUCCESS;
813}
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use