SUPR3HardenedVerify.cpp@ 13344

最後變更在這個檔案從13344是 13344,由 vboxsync 提交於 16 年前
SUPR3HardenedVerify: SharedCrOpenGL.so as optional. Removed unnecessary define.
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 30.9 KB

行
1	/* $Id: SUPR3HardenedVerify.cpp 13344 2008-10-16 15:10:29Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Verification of Hardened Installation.
4	*/
5
6	/*
7	* Copyright (C) 2006-2008 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.alldomusa.eu.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#if defined(RT_OS_OS2)
35	# define INCL_BASE
36	# define INCL_ERRORS
37	# include <os2.h>
38	# include <stdio.h>
39
40	#elif defined(RT_OS_WINDOWS)
41	# include <Windows.h>
42	# include <stdio.h>
43
44	#else /* UNIXes */
45	# include <sys/types.h>
46	# include <stdio.h>
47	# include <stdlib.h>
48	# include <dlfcn.h>
49	# include <fcntl.h>
50	# include <limits.h>
51	# include <errno.h>
52	# include <unistd.h>
53	# include <sys/stat.h>
54	# include <sys/time.h>
55	# include <sys/fcntl.h>
56	# include <stdio.h>
57	# include <pwd.h>
58	# ifdef RT_OS_DARWIN
59	# include <mach-o/dyld.h>
60	# endif
61
62	#endif
63
64	#include <VBox/sup.h>
65	#include <VBox/err.h>
66	#include <iprt/string.h>
67	#include <iprt/param.h>
68
69	#include "SUPLibInternal.h"
70
71
72
73
74	/*******************************************************************************
75	* Global Variables *
76	*******************************************************************************/
77	/**
78	* The files that gets verified.
79	*
80	* @todo This needs reviewing against the linux packages.
81	* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
82	* the time being we're building the linux packages with SharedLib pointing to
83	* AppPrivArch (lazy bird).
84	*/
85	static SUPINSTFILE const g_aSupInstallFiles[] =
86	{
87	/* type, dir,fOptional, pszFile */
88	/* ---------------------------------------------------------------------- */
89	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
90	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
91	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
92
93	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMGC.gc" },
94	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
95	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
96
97	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
98	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
99	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
100	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
101	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
102	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
103
104	//#ifdef VBOX_WITH_DEBUGGER_GUI
105	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
106	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
107	//#endif
108
109	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
110	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
111	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
112	{ kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
113
114	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxManage" SUPLIB_EXE_SUFF },
115
116	{ kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
117	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxSettings" SUPLIB_DLL_SUFF },
118	#ifdef RT_OS_WINDOWS
119	/** @todo */
120	#else
121	{ kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
122	{ kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
123	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
124	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
125	{ kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
126	{ kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
127	#endif
128
129	//#ifdef VBOX_WITH_VRDP
130	{ kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
131	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
132	//#endif
133
134	//#ifdef VBOX_WITH_HEADLESS
135	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
136	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
137	//#endif
138
139	//#ifdef VBOX_WITH_QT4GUI
140	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
141	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
142	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
143	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
144	# endif
145	//#endif
146
147	//#ifdef VBOX_WITH_QTGUI
148	{ kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox3" SUPLIB_EXE_SUFF },
149	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox3" SUPLIB_DLL_SUFF },
150	# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
151	{ kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard3" SUPLIB_DLL_SUFF },
152	# endif
153	//#endif
154
155	//#ifdef VBOX_WITH_VBOXSDL
156	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
157	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
158	//#endif
159
160	//#ifdef VBOX_WITH_VBOXBFE
161	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxBFE" SUPLIB_EXE_SUFF },
162	{ kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxBFE" SUPLIB_DLL_SUFF },
163	//#endif
164
165	//#ifdef VBOX_WITH_WEBSERVICES
166	{ kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
167	//#endif
168
169	#ifdef RT_OS_LINUX
170	{ kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
171	#endif
172	};
173
174
175	/** Array parallel to g_aSupInstallFiles containing per-file status info. */
176	static SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
177
178	/** Array index by install directory specifier containing info about verified directories. */
179	static SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
180
181
182	/**
183	* Assembles the path to a dirtory.
184	*
185	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
186	* decides whether it returns or not).
187	*
188	* @param enmDir The directory.
189	* @param pszDst Where to assemble the path.
190	* @param cchDst The size of the buffer.
191	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
192	*/
193	static int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
194	{
195	int rc;
196	switch (enmDir)
197	{
198	case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
199	case kSupID_Bin:
200	rc = supR3HardenedPathProgram(pszDst, cchDst);
201	break;
202	case kSupID_SharedLib:
203	rc = supR3HardenedPathSharedLibs(pszDst, cchDst);
204	break;
205	case kSupID_AppPrivArch:
206	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
207	break;
208	case kSupID_AppPrivArchComp:
209	rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
210	if (RT_SUCCESS(rc))
211	{
212	size_t off = strlen(pszDst);
213	if (cchDst - off >= sizeof("/components"))
214	memcpy(&pszDst[off], "/components", sizeof("/components"));
215	else
216	rc = VERR_BUFFER_OVERFLOW;
217	}
218	break;
219	case kSupID_AppPrivNoArch:
220	rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
221	break;
222	default:
223	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
224	"supR3HardenedMakePath: enmDir=%d\n", enmDir);
225	}
226	if (RT_FAILURE(rc))
227	supR3HardenedError(rc, fFatal,
228	"supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
229	return rc;
230	}
231
232
233
234	/**
235	* Assembles the path to a file table entry, with or without the actual filename.
236	*
237	* @returns VINF_SUCCESS on success, some error code on failure (fFatal
238	* decides whether it returns or not).
239	*
240	* @param pFile The file table entry.
241	* @param pszDst Where to assemble the path.
242	* @param cchDst The size of the buffer.
243	* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
244	* @param fFatal Whether failures should be treated as fatal (true) or not (false).
245	*/
246	static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
247	{
248	/*
249	* Combine supR3HardenedMakePath and the filename.
250	*/
251	int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
252	if (RT_SUCCESS(rc))
253	{
254	size_t cchFile = strlen(pFile->pszFile);
255	size_t off = strlen(pszDst);
256	if (cchDst - off >= cchFile + 2)
257	{
258	pszDst[off++] = '/';
259	memcpy(&pszDst[off], pFile->pszFile, cchFile + 1);
260	}
261	else
262	rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
263	"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
264	pFile->pszFile, (long)off);
265	}
266	return rc;
267	}
268
269
270	/**
271	* Verifies a directory.
272	*
273	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
274	* fFatal is clear and if it's set the function wont return.
275	* @param enmDir The directory specifier.
276	* @param fFatal Whether validation failures should be treated as
277	* fatal (true) or not (false).
278	*/
279	DECLHIDDEN(int) supR3HardenedVerifyDir(SUPINSTDIR enmDir, bool fFatal)
280	{
281	/*
282	* Validate the index just to be on the safe side...
283	*/
284	if (enmDir <= kSupID_Invalid \|\| enmDir >= kSupID_End)
285	return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
286	"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
287
288	/*
289	* Already validated?
290	*/
291	if (g_aSupVerifiedDirs[enmDir].fValidated)
292	return VINF_SUCCESS; /** @todo revalidate? */
293
294	/* initialize the entry. */
295	if (g_aSupVerifiedDirs[enmDir].hDir != 0)
296	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
297	"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
298	(void *)g_aSupVerifiedDirs[enmDir].hDir, enmDir);
299	g_aSupVerifiedDirs[enmDir].hDir = -1;
300	g_aSupVerifiedDirs[enmDir].fValidated = false;
301
302	/*
303	* Make the path and open the directory.
304	*/
305	char szPath[RTPATH_MAX];
306	int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
307	if (RT_SUCCESS(rc))
308	{
309	#if defined(RT_OS_WINDOWS)
310	HANDLE hDir = CreateFile(szPath,
311	GENERIC_READ,
312	FILE_SHARE_READ \| FILE_SHARE_DELETE \| FILE_SHARE_WRITE,
313	NULL,
314	OPEN_ALWAYS,
315	FILE_ATTRIBUTE_NORMAL \| FILE_FLAG_BACKUP_SEMANTICS,
316	NULL);
317	if (hDir != INVALID_HANDLE_VALUE)
318	{
319	/** @todo check the type */
320	/* That's all on windows, for now at least... */
321	g_aSupVerifiedDirs[enmDir].hDir = (intptr_t)hDir;
322	g_aSupVerifiedDirs[enmDir].fValidated = true;
323	}
324	else
325	{
326	int err = GetLastError();
327	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
328	"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
329	szPath, err);
330	}
331	#else /* UNIXY */
332	int fd = open(szPath, O_RDONLY, 0);
333	if (fd >= 0)
334	{
335	/*
336	* On unixy systems we'll make sure the directory is owned by root
337	* and not writable by the group and user.
338	*/
339	struct stat st;
340	if (!fstat(fd, &st))
341	{
342
343	if ( st.st_uid == 0
344	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
345	&& S_ISDIR(st.st_mode))
346	{
347	g_aSupVerifiedDirs[enmDir].hDir = fd;
348	g_aSupVerifiedDirs[enmDir].fValidated = true;
349	}
350	else
351	{
352	if (!S_ISDIR(st.st_mode))
353	rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
354	"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
355	szPath, (long)st.st_uid);
356	else if (st.st_uid)
357	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
358	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
359	szPath, (long)st.st_uid);
360	else
361	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
362	"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
363	szPath, (long)st.st_mode);
364	close(fd);
365	}
366	}
367	else
368	{
369	int err = errno;
370	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
371	"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
372	szPath, strerror(err), err);
373	close(fd);
374	}
375	}
376	else
377	{
378	int err = errno;
379	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
380	"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
381	szPath, strerror(err), err);
382	}
383	#endif /* UNIXY */
384	}
385
386	return rc;
387	}
388
389
390	/**
391	* Verifies a file entry.
392	*
393	* @returns VINF_SUCCESS on success. On failure, an error code is returned if
394	* fFatal is clear and if it's set the function wont return.
395	*
396	* @param iFile The file table index of the file to be verified.
397	* @param fFatal Whether validation failures should be treated as
398	* fatal (true) or not (false).
399	* @param fLeaveFileOpen Whether the file should be left open.
400	*/
401	static int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen)
402	{
403	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
404	PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
405
406	/*
407	* Already done?
408	*/
409	if (pVerified->fValidated)
410	return VINF_SUCCESS; /** @todo revalidate? */
411
412
413	/* initialize the entry. */
414	if (pVerified->hFile != 0)
415	supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
416	"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
417	(void *)pVerified->hFile, pFile->pszFile);
418	pVerified->hFile = -1;
419	pVerified->fValidated = false;
420
421	/*
422	* Verify the directory then proceed to open it.
423	* (This'll make sure the directory is opened and that we can (later)
424	* use openat if we wish.)
425	*/
426	int rc = supR3HardenedVerifyDir(pFile->enmDir, fFatal);
427	if (RT_SUCCESS(rc))
428	{
429	char szPath[RTPATH_MAX];
430	int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true, fFatal);
431	if (RT_SUCCESS(rc))
432	{
433	#if defined(RT_OS_WINDOWS)
434	HANDLE hFile = CreateFile(szPath,
435	GENERIC_READ,
436	FILE_SHARE_READ,
437	NULL,
438	OPEN_ALWAYS,
439	FILE_ATTRIBUTE_NORMAL,
440	NULL);
441	if (hFile != INVALID_HANDLE_VALUE)
442	{
443	/** @todo Check the type, and verify the signature (separate function so we can skip it). */
444	{
445	/* it's valid. */
446	if (fLeaveFileOpen)
447	pVerified->hFile = (intptr_t)hFile;
448	else
449	CloseHandle(hFile);
450	pVerified->fValidated = true;
451	}
452	}
453	else
454	{
455	int err = GetLastError();
456	if (!pFile->fOptional \|\| err != ERROR_FILE_NOT_FOUND)
457	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
458	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
459	szPath, err);
460	}
461	#else /* UNIXY */
462	int fd = open(szPath, O_RDONLY, 0);
463	if (fd >= 0)
464	{
465	/*
466	* On unixy systems we'll make sure the directory is owned by root
467	* and not writable by the group and user.
468	*/
469	struct stat st;
470	if (!fstat(fd, &st))
471	{
472	if ( st.st_uid == 0
473	&& !(st.st_mode & (S_IWGRP \| S_IWOTH))
474	&& S_ISREG(st.st_mode))
475	{
476	/* it's valid. */
477	if (fLeaveFileOpen)
478	pVerified->hFile = fd;
479	else
480	close(fd);
481	pVerified->fValidated = true;
482	}
483	else
484	{
485	if (!S_ISREG(st.st_mode))
486	rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
487	"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
488	szPath, (long)st.st_uid);
489	else if (st.st_uid)
490	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
491	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
492	szPath, (long)st.st_uid);
493	else
494	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
495	"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
496	szPath, (long)st.st_mode);
497	close(fd);
498	}
499	}
500	else
501	{
502	int err = errno;
503	rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
504	"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
505	szPath, strerror(err), err);
506	close(fd);
507	}
508	}
509	else
510	{
511	int err = errno;
512	if (!pFile->fOptional \|\| err != ENOENT)
513	rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
514	"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
515	szPath, strerror(err), err);
516	}
517	#endif /* UNIXY */
518	}
519	}
520
521	return rc;
522	}
523
524
525	/**
526	* Verifies that the specified table entry matches the given filename.
527	*
528	* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
529	* error is returned or we terminate the application.
530	*
531	* @param iFile The file table index.
532	* @param pszFilename The filename.
533	* @param fFatal Whether validation failures should be treated as
534	* fatal (true) or not (false).
535	*/
536	static int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
537	{
538	PCSUPINSTFILE pFile = &g_aSupInstallFiles[iFile];
539
540	/*
541	* Construct the full path for the file table entry
542	* and compare it with the specified file.
543	*/
544	char szName[RTPATH_MAX];
545	int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
546	if (RT_FAILURE(rc))
547	return rc;
548	#if defined(RT_OS_WINDOWS) \|\| defined(RT_OS_OS2)
549	if (stricmp(szName, pszFilename))
550	#else
551	if (strcmp(szName, pszFilename))
552	#endif
553	{
554	/*
555	* Normalize the two paths and compare again.
556	*/
557	rc = VERR_NOT_SAME_DEVICE;
558	#if defined(RT_OS_WINDOWS)
559	LPSTR pszIgnored;
560	char szName2[RTPATH_MAX];
561	if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
562	&& GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
563	if (!stricmp(szName2, szName))
564	rc = VINF_SUCCESS;
565	#else
566	AssertCompile(RTPATH_MAX >= PATH_MAX);
567	char szName2[RTPATH_MAX];
568	if ( realpath(szName, szName2) != NULL
569	&& realpath(pszFilename, szName) != NULL)
570	if (!strcmp(szName2, szName))
571	rc = VINF_SUCCESS;
572	#endif
573
574	if (RT_FAILURE(rc))
575	{
576	supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /fWithFilename/, fFatal);
577	return supR3HardenedError(rc, fFatal,
578	"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
579	pszFilename, szName);
580	}
581	}
582
583	/*
584	* Check more stuff like the stat info if it's an already open file?
585	*/
586
587
588
589	return VINF_SUCCESS;
590	}
591
592
593	/**
594	* Verifies a file.
595	*
596	* @returns VINF_SUCCESS on success.
597	* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
598	* On verfication failure, an error code will be returned when fFatal is clear,
599	* otherwise the program will be termindated.
600	*
601	* @param pszFilename The filename.
602	* @param fFatal Whether validation failures should be treated as
603	* fatal (true) or not (false).
604	*/
605	DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, bool fFatal)
606	{
607	/*
608	* Lookup the file and check if it's the same file.
609	*/
610	const char *pszName = supR3HardenedPathFilename(pszFilename);
611	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
612	if (!strcmp(pszName, g_aSupInstallFiles[iFile].pszFile))
613	{
614	int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
615	if (RT_SUCCESS(rc))
616	rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */);
617	return rc;
618	}
619
620	return VERR_NOT_FOUND;
621	}
622
623
624	/**
625	* Verifies a program, worker for supR3HardenedVerifyAll.
626	*
627	* @returns See supR3HardenedVerifyAll.
628	* @param pszProgName See supR3HardenedVerifyAll.
629	* @param fFatal See supR3HardenedVerifyAll.
630	*/
631	static int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal)
632	{
633	/*
634	* Search the table looking for the executable and the DLL/DYLIB/SO.
635	*/
636	int rc = VINF_SUCCESS;
637	bool fExe = false;
638	bool fDll = false;
639	size_t const cchProgName = strlen(pszProgName);
640	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
641	if (!strncmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
642	{
643	if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
644	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
645	{
646	/* This only has to be found (once). */
647	if (fDll)
648	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
649	"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
650	fDll = true;
651	}
652	else if ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
653	&& !strcmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
654	{
655	/* Here we'll have to check that the specific program is the same as the entry. */
656	if (fExe)
657	rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
658	"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
659	fExe = true;
660
661	char szFilename[RTPATH_MAX];
662	int rc2 = supR3HardenedPathProgram(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
663	if (RT_SUCCESS(rc2))
664	{
665	strcat(szFilename, "/");
666	strcat(szFilename, g_aSupInstallFiles[iFile].pszFile);
667	supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
668	}
669	else
670	rc = supR3HardenedError(rc2, fFatal,
671	"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
672	}
673	}
674
675	/*
676	* Check the findings.
677	*/
678	if (!fDll && !fExe)
679	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
680	"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
681	else if (!fExe)
682	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
683	"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
684	else if (!fDll)
685	rc = supR3HardenedError(VERR_NOT_FOUND, fFatal,
686	"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
687	return rc;
688	}
689
690
691
692	/**
693	* Verifies all the known files.
694	*
695	* @returns VINF_SUCCESS on success.
696	* On verfication failure, an error code will be returned when fFatal is clear,
697	* otherwise the program will be termindated.
698	*
699	* @param fFatal Whether validation failures should be treated as
700	* fatal (true) or not (false).
701	* @param fLeaveFilesOpen If set, all the verfied files are left open.
702	* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
703	* to verify that both the executable and corresponding
704	* DLL/DYLIB/SO are valid.
705	*/
706	DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, bool fLeaveFilesOpen, const char *pszProgName)
707	{
708	/*
709	* The verify all the files.
710	*/
711	int rc = VINF_SUCCESS;
712	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
713	{
714	int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveFilesOpen);
715	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
716	rc = rc2;
717	}
718
719	/*
720	* Verify the program name if specified, that is to say, just check that
721	* it's in the table (=> we've already verified it).
722	*/
723	if (pszProgName)
724	{
725	int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal);
726	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
727	rc2 = rc;
728	}
729
730	return rc;
731	}
732
733
734	/**
735	* Gets the pre-init data for the hand-over to the other version
736	* of this code.
737	*
738	* The reason why we pass this information on is that it contains
739	* open directories and files. Later it may include even more info
740	* (int the verified arrays mostly).
741	*
742	* The receiver is supR3HardenedRecvPreInitData.
743	*
744	* @param pPreInitData Where to store it.
745	*/
746	DECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
747	{
748	pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
749	pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
750	pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
751
752	pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
753	pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
754	}
755
756
757	/**
758	* Receives the pre-init data from the static executable stub.
759	*
760	* @returns VBox status code. Will not bitch on failure since the
761	* runtime isn't ready for it, so that is left to the exe stub.
762	*
763	* @param pPreInitData The hand-over data.
764	*/
765	DECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
766	{
767	/*
768	* Compare the array lengths and the contents of g_aSupInstallFiles.
769	*/
770	if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
771	\|\| pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
772	return VERR_VERSION_MISMATCH;
773	SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
774	for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
775	if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
776	\|\| g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
777	\|\| g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
778	\|\| strcmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
779	return VERR_VERSION_MISMATCH;
780
781	/*
782	* Check that we're not called out of order.
783	* If dynamic linking it screwed up, we may end up here.
784	*/
785	if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
786	\|\| ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
787	return VERR_WRONG_ORDER;
788
789	/*
790	* Copy the verification data over.
791	*/
792	memcpy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));
793	memcpy(&g_aSupVerifiedDirs[0], pPreInitData->paVerifiedDirs, sizeof(g_aSupVerifiedDirs));
794	return VINF_SUCCESS;
795	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp@ 13344

以其他格式下載: