SUPR3HardenedVerify.cpp@ 28545

Last change on this file since 28545 was 28545, checked in by vboxsync, 15 years ago
fixed VBoxGuesControlSvc for hardened builds
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 31.7 KB

Line
1	/* $Id: SUPR3HardenedVerify.cpp 28545 2010-04-21 08:26:16Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39	# include <stdlib.h>
40	# include <unistd.h>
41	# include <sys/fcntl.h>
42	# include <sys/errno.h>
43	# include <sys/syslimits.h>
44
45	#elif defined(RT_OS_WINDOWS)
46	# include <Windows.h>
47	# include <stdio.h>
48
49	#else /* UNIXes */
50	# include <sys/types.h>
51	# include <stdio.h>
52	# include <stdlib.h>
53	# include <dlfcn.h>
54	# include <fcntl.h>
55	# include <limits.h>
56	# include <errno.h>
57	# include <unistd.h>
58	# include <sys/stat.h>
59	# include <sys/time.h>
60	# include <sys/fcntl.h>
61	# include <stdio.h>
62	# include <pwd.h>
63	# ifdef RT_OS_DARWIN
64	# include <mach-o/dyld.h>
65	# endif
66
67	#endif
68
69	#include <VBox/sup.h>
70	#include <VBox/err.h>
71	#include <iprt/string.h>
72	#include <iprt/param.h>
73
74	#include "SUPLibInternal.h"
75
76
77
78
79	/*******************************************************************************
80	* Global Variables *
81	*******************************************************************************/
82	/**
83	* The files that gets verified.
84	*
85	* @todo This needs reviewing against the linux packages.
86	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
87	* the time being we're building the linux packages with SharedLib pointing to
88	* AppPrivArch (lazy bird).
89	*/
90	static SUPINSTFILE const g_aSupInstallFiles[] =
91	{
92	/* type, dir, fOpt, "pszFile" */
93	/* ---------------------------------------------------------------------- */
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
96	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
97
98	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
99	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
100	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
101
102	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
103	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
104	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
105	#if HC_ARCH_BITS == 32
106	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
107	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
108	#endif
109	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
110	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
112
113	//#ifdef VBOX_WITH_DEBUGGER_GUI
114	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
115	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
116	//#endif
117
118	//#ifdef VBOX_WITH_SHARED_CLIPBOARD
119	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
120	//#endif
121	//#ifdef VBOX_WITH_SHARED_FOLDERS
122	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
123	//#endif
124	//#ifdef VBOX_WITH_GUEST_PROPS
125	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
126	//#endif
127	//#ifdef VBOX_WITH_GUEST_CONTROL
128	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestControlSvc" SUPLIB_DLL_SUFF },
129	//#endif
130	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
131	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
132	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
133	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
134
135	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
136
137	#ifdef VBOX_WITH_MAIN
138	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
139	#ifdef RT_OS_WINDOWS
140	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
141	#else
142	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
143	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
144	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
145	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
146	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
147	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
148	#endif
149	#endif
150
151	//#ifdef VBOX_WITH_VRDP
152	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
153	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
154	//#endif
155
156	//#ifdef VBOX_WITH_HEADLESS
157	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
158	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
159	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxFFmpegFB" SUPLIB_DLL_SUFF },
160	//#endif
161
162	//#ifdef VBOX_WITH_QTGUI
163	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
164	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
165	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
166	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
167	# endif
168	//#endif
169
170	//#ifdef VBOX_WITH_VBOXSDL
171	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
172	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
173	//#endif
174
175	//#ifdef VBOX_WITH_VBOXBFE
176	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
177	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
178	//#endif
179
180	//#ifdef VBOX_WITH_WEBSERVICES
181	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
182	//#endif
183
184	#ifdef RT_OS_LINUX
185	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
186	#endif
187
188	//#ifdef VBOX_WITH_NETFLT
189	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
190	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
191	//#endif
192	};
193
194
195	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
196	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
197
198	/** Array index by install directory specifier containing info about verified directories. */
199	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
200
201
202	/**
203	* Assembles the path to a dirtory.
204	*
205	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
206	* decides whether it returns or not).
207	*
208	* @param enmDir The directory.
209	* @param pszDst Where to assemble the path.
210	* @param cchDst The size of the buffer.
211	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
212	*/
213	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
214	{
215	int rc;
216	switch (enmDir)
217	{
218	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
219	case kSupID_Bin:
220	rc = supR3HardenedPathExecDir(pszDst, cchDst);
221	break;
222	case kSupID_SharedLib:
223	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
224	break;
225	case kSupID_AppPrivArch:
226	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
227	break;
228	case kSupID_AppPrivArchComp:
229	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
230	if (RT_SUCCESS(rc))
231	{
232	size_t off = strlen(pszDst);
233	if (cchDst - off >= sizeof("/components"))
234	memcpy(&pszDst[off], "/components", sizeof("/components"));
235	else
236	rc = VERR_BUFFER_OVERFLOW;
237	}
238	break;
239	case kSupID_AppPrivNoArch:
240	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
241	break;
242	default:
243	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
244	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
245	}
246	if (RT_FAILURE(rc))
247	supR3HardenedError(rc, fFatal,
248	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
249	return rc;
250	}
251
252
253
254	/**
255	* Assembles the path to a file table entry, with or without the actual filename.
256	*
257	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
258	* decides whether it returns or not).
259	*
260	* @param pFile The file table entry.
261	* @param pszDst Where to assemble the path.
262	* @param cchDst The size of the buffer.
263	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
264	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
265	*/
266	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
267	{
268	/*
269	* Combine supR3HardenedMakePath and the filename.
270	*/
271	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
272	if (RT_SUCCESS(rc))
273	{
274	size_t cchFile = strlen(pFile->pszFile);
275	size_t off = strlen(pszDst);
276	if (cchDst - off >= cchFile + 2)
277	{
278	pszDst[off++] = '/';
279	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
280	}
281	else
282	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
283	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
284	pFile->pszFile, (long)off);
285	}
286	return rc;
287	}
288
289
290	/**
291	* Verifies a directory.
292	*
293	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
294	* fFatal is clear and if it's set the function wont return.
295	* @param enmDir The directory specifier.
296	* @param fFatal Whether validation failures should be treated as
297	* fatal (true) or not (false).
298	*/
299	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
300	{
301	/*
302	* Validate the index just to be on the safe side...
303	*/
304	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
305	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
306	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
307
308	/*
309	* Already validated?
310	*/
311	if (g_aSupVerifiedDirs[enmDir].fValidated)
312	return VINF_SUCCESS; /** @todo revalidate? */
313
314	/* initialize the entry. */
315	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
316	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
317	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
318	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
319	g_aSupVerifiedDirs[enmDir].hDir = -1;
320	g_aSupVerifiedDirs[enmDir].fValidated = false;
321
322	/*
323	* Make the path and open the directory.
324	*/
325	char szPath[RTPATH_MAX];
326	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
327	if (RT_SUCCESS(rc))
328	{
329	#if defined(RT_OS_WINDOWS)
330	HANDLE hDir = CreateFile(szPath,
331	GENERIC_READ,
332	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
333	NULL,
334	OPEN_ALWAYS,
335	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
336	NULL);
337	if (hDir != INVALID_HANDLE_VALUE)
338	{
339	/** @todo check the type */
340	/* That's all on windows, for now at least... */
341	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
342	g_aSupVerifiedDirs[enmDir].fValidated = true;
343	}
344	else
345	{
346	int err = GetLastError();
347	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
348	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
349	szPath, err);
350	}
351	#else /* UNIXY */
352	int fd = open(szPath, O_RDONLY, 0);
353	if (fd >= 0)
354	{
355	/*
356	* On unixy systems we'll make sure the directory is owned by root
357	* and not writable by the group and user.
358	*/
359	struct stat st;
360	if (!fstat(fd, &st))
361	{
362
363	if ( st.st_uid == 0
364	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
365	&& S_ISDIR(st.st_mode))
366	{
367	g_aSupVerifiedDirs[enmDir].hDir = fd;
368	g_aSupVerifiedDirs[enmDir].fValidated = true;
369	}
370	else
371	{
372	if (!S_ISDIR(st.st_mode))
373	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
374	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
375	szPath, (long)st.st_uid);
376	else if (st.st_uid)
377	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
378	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
379	szPath, (long)st.st_uid);
380	else
381	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
382	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
383	szPath, (long)st.st_mode);
384	close(fd);
385	}
386	}
387	else
388	{
389	int err = errno;
390	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
391	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
392	szPath, strerror(err), err);
393	close(fd);
394	}
395	}
396	else
397	{
398	int err = errno;
399	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
400	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
401	szPath, strerror(err), err);
402	}
403	#endif /* UNIXY */
404	}
405
406	return rc;
407	}
408
409
410	/**
411	* Verifies a file entry.
412	*
413	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
414	* fFatal is clear and if it's set the function wont return.
415	*
416	* @param iFile The file table index of the file to be verified.
417	* @param fFatal Whether validation failures should be treated as
418	* fatal (true) or not (false).
419	* @param fLeaveFileOpen Whether the file should be left open.
420	*/
421	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
422	{
423	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
424	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
425
426	/*
427	* Already done?
428	*/
429	if (pVerified->fValidated)
430	return VINF_SUCCESS; /** @todo revalidate? */
431
432
433	/* initialize the entry. */
434	if (pVerified->hFile != 0)
435	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
436	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
437	(void *)pVerified->hFile, pFile->pszFile);
438	pVerified->hFile = -1;
439	pVerified->fValidated = false;
440
441	/*
442	* Verify the directory then proceed to open it.
443	* (This'll make sure the directory is opened and that we can (later)
444	* use openat if we wish.)
445	*/
446	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
447	if (RT_SUCCESS(rc))
448	{
449	char szPath[RTPATH_MAX];
450	rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
451	if (RT_SUCCESS(rc))
452	{
453	#if defined(RT_OS_WINDOWS)
454	HANDLE hFile = CreateFile(szPath,
455	GENERIC_READ,
456	FILE_SHARE_READ,
457	NULL,
458	OPEN_ALWAYS,
459	FILE_ATTRIBUTE_NORMAL,
460	NULL);
461	if (hFile != INVALID_HANDLE_VALUE)
462	{
463	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
464	{
465	/* it's valid. */
466	if (fLeaveFileOpen)
467	pVerified->hFile = (intptr_t)hFile;
468	else
469	CloseHandle(hFile);
470	pVerified->fValidated = true;
471	}
472	}
473	else
474	{
475	int err = GetLastError();
476	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
477	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
478	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
479	szPath, err);
480	}
481	#else /* UNIXY */
482	int fd = open(szPath, O_RDONLY, 0);
483	if (fd >= 0)
484	{
485	/*
486	* On unixy systems we'll make sure the directory is owned by root
487	* and not writable by the group and user.
488	*/
489	struct stat st;
490	if (!fstat(fd, &st))
491	{
492	if ( st.st_uid == 0
493	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
494	&& S_ISREG(st.st_mode))
495	{
496	/* it's valid. */
497	if (fLeaveFileOpen)
498	pVerified->hFile = fd;
499	else
500	close(fd);
501	pVerified->fValidated = true;
502	}
503	else
504	{
505	if (!S_ISREG(st.st_mode))
506	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
507	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
508	szPath, (long)st.st_uid);
509	else if (st.st_uid)
510	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
511	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
512	szPath, (long)st.st_uid);
513	else
514	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
515	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
516	szPath, (long)st.st_mode);
517	close(fd);
518	}
519	}
520	else
521	{
522	int err = errno;
523	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
524	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
525	szPath, strerror(err), err);
526	close(fd);
527	}
528	}
529	else
530	{
531	int err = errno;
532	if (!pFile->fOptional \|\| err != ENOENT)
533	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
534	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
535	szPath, strerror(err), err);
536	}
537	#endif /* UNIXY */
538	}
539	}
540
541	return rc;
542	}
543
544
545	/**
546	* Verifies that the specified table entry matches the given filename.
547	*
548	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
549	* error is returned or we terminate the application.
550	*
551	* @param iFile The file table index.
552	* @param pszFilename The filename.
553	* @param fFatal Whether validation failures should be treated as
554	* fatal (true) or not (false).
555	*/
556	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
557	{
558	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
559
560	/*
561	* Construct the full path for the file table entry
562	* and compare it with the specified file.
563	*/
564	char szName[RTPATH_MAX];
565	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
566	if (RT_FAILURE(rc))
567	return rc;
568	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
569	if (stricmp(szName, pszFilename))
570	#else
571	if (strcmp(szName, pszFilename))
572	#endif
573	{
574	/*
575	* Normalize the two paths and compare again.
576	*/
577	rc = VERR_NOT_SAME_DEVICE;
578	#if defined(RT_OS_WINDOWS)
579	LPSTR pszIgnored;
580	char szName2[RTPATH_MAX];
581	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
582	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
583	if (!stricmp(szName2, szName))
584	rc = VINF_SUCCESS;
585	#else
586	AssertCompile(RTPATH_MAX >= PATH_MAX);
587	char szName2[RTPATH_MAX];
588	if ( realpath(szName, szName2) != NULL
589	&& realpath(pszFilename, szName) != NULL)
590	if (!strcmp(szName2, szName))
591	rc = VINF_SUCCESS;
592	#endif
593
594	if (RT_FAILURE(rc))
595	{
596	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
597	return supR3HardenedError(rc, fFatal,
598	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
599	pszFilename, szName);
600	}
601	}
602
603	/*
604	* Check more stuff like the stat info if it's an already open file?
605	*/
606
607
608
609	return VINF_SUCCESS;
610	}
611
612
613	/**
614	* Verifies a file.
615	*
616	* @returns VINF_SUCCESS on success.
617	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
618	* On verfication failure, an error code will be returned when fFatal is clear,
619	* otherwise the program will be termindated.
620	*
621	* @param pszFilename The filename.
622	* @param fFatal Whether validation failures should be treated as
623	* fatal (true) or not (false).
624	*/
625	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
626	{
627	/*
628	* Lookup the file and check if it's the same file.
629	*/
630	const char *pszName = supR3HardenedPathFilename(pszFilename);
631	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
632	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
633	{
634	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
635	if (RT_SUCCESS(rc))
636	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
637	return rc;
638	}
639
640	return VERR_NOT_FOUND;
641	}
642
643
644	/**
645	* Verifies a program, worker for supR3HardenedVerifyAll.
646	*
647	* @returns See supR3HardenedVerifyAll.
648	* @param pszProgName See supR3HardenedVerifyAll.
649	* @param fFatal See supR3HardenedVerifyAll.
650	*/
651	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
652	{
653	/*
654	* Search the table looking for the executable and the DLL/DYLIB/SO.
655	*/
656	int rc = VINF_SUCCESS;
657	bool fExe = false;
658	bool fDll = false;
659	size_t const cchProgName = strlen(pszProgName);
660	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
661	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
662	{
663	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
664	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
665	{
666	/* This only has to be found (once). */
667	if (fDll)
668	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
669	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
670	fDll = true;
671	}
672	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
673	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
674	{
675	/* Here we'll have to check that the specific program is the same as the entry. */
676	if (fExe)
677	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
678	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
679	fExe = true;
680
681	char szFilename[RTPATH_MAX];
682	int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
683	if (RT_SUCCESS(rc2))
684	{
685	strcat(szFilename, "/");
686	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
687	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
688	}
689	else
690	rc = supR3HardenedError(rc2, fFatal,
691	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
692	}
693	}
694
695	/*
696	* Check the findings.
697	*/
698	if (!fDll && !fExe)
699	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
700	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
701	else if (!fExe)
702	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
703	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
704	else if (!fDll)
705	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
706	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
707	return rc;
708	}
709
710
711
712	/**
713	* Verifies all the known files.
714	*
715	* @returns VINF_SUCCESS on success.
716	* On verfication failure, an error code will be returned when fFatal is clear,
717	* otherwise the program will be termindated.
718	*
719	* @param fFatal Whether validation failures should be treated as
720	* fatal (true) or not (false).
721	* @param fLeaveFilesOpen If set, all the verfied files are left open.
722	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
723	* to verify that both the executable and corresponding
724	* DLL/DYLIB/SO are valid.
725	*/
726	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
727	{
728	/*
729	* The verify all the files.
730	*/
731	int rc = VINF_SUCCESS;
732	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
733	{
734	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
735	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
736	rc = rc2;
737	}
738
739	/*
740	* Verify the program name if specified, that is to say, just check that
741	* it's in the table (=> we've already verified it).
742	*/
743	if (pszProgName)
744	{
745	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
746	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
747	rc2 = rc;
748	}
749
750	return rc;
751	}
752
753
754	/**
755	* Gets the pre-init data for the hand-over to the other version
756	* of this code.
757	*
758	* The reason why we pass this information on is that it contains
759	* open directories and files. Later it may include even more info
760	* (int the verified arrays mostly).
761	*
762	* The receiver is supR3HardenedRecvPreInitData.
763	*
764	* @param pPreInitData Where to store it.
765	*/
766	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
767	{
768	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
769	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
770	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
771
772	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
773	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
774	}
775
776
777	/**
778	* Receives the pre-init data from the static executable stub.
779	*
780	* @returns VBox status code. Will not bitch on failure since the
781	* runtime isn't ready for it, so that is left to the exe stub.
782	*
783	* @param pPreInitData The hand-over data.
784	*/
785	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
786	{
787	/*
788	* Compare the array lengths and the contents of g_aSupInstallFiles.
789	*/
790	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
791	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
792	return VERR_VERSION_MISMATCH;
793	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
794	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
795	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
796	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
797	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
798	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
799	return VERR_VERSION_MISMATCH;
800
801	/*
802	* Check that we're not called out of order.
803	* If dynamic linking it screwed up, we may end up here.
804	*/
805	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
806	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
807	return VERR_WRONG_ORDER;
808
809	/*
810	* Copy the verification data over.
811	*/
812	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
813	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
814	return VINF_SUCCESS;
815	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 28545

Download in other formats: