Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/sys/kern/kern_verifiedexec.c

367 lines
11 KiB
C
Raw Blame History

/* $NetBSD: kern_verifiedexec.c,v 1.7 2003/11/18 13:13:03 martin Exp $ */
/*-
* Copyright (c) 2001, 2002 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Brett Lymn and Jason R Fink
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by the NetBSD
* Foundation, Inc. and its contributors.
* 4. Neither the name of The NetBSD Foundation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.7 2003/11/18 13:13:03 martin Exp $");
#include <sys/param.h>
#include <sys/mount.h>
#include <sys/malloc.h>
#include <sys/vnode.h>
#include <sys/exec.h>
#include <sys/md5.h>
#include <sys/sha1.h>
#include <sys/verified_exec.h>
/* Set the buffer to a single page for md5 and sha1 */
#define BUF_SIZE PAGE_SIZE
extern LIST_HEAD(veriexec_devhead, veriexec_dev_list) veriexec_dev_head;
static int
md5_fingerprint(struct vnode *vp, struct veriexec_inode_list *ip,
struct proc *p, u_quad_t file_size, char *fingerprint);
static int
sha1_fingerprint(struct vnode *vp, struct veriexec_inode_list *ip,
struct proc *p, u_quad_t file_size, char *fingerprint);
/*
* md5_fingerprint:
* Evaluate the md5 fingerprint of the given file.
*
*/
static int
md5_fingerprint(struct vnode *vp, struct veriexec_inode_list *ip,
struct proc *p, u_quad_t file_size, char *fingerprint)
{
u_quad_t j;
MD5_CTX md5context;
char *filebuf;
size_t resid;
int count, error;
filebuf = malloc(BUF_SIZE, M_TEMP, M_WAITOK);
MD5Init(&md5context);
for (j = 0; j < file_size; j+= BUF_SIZE) {
if ((j + BUF_SIZE) > file_size) {
count = file_size - j;
} else
count = BUF_SIZE;
error = vn_rdwr(UIO_READ, vp, filebuf, count, j,
UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
if (error) {
free(filebuf, M_TEMP);
return error;
}
MD5Update(&md5context, filebuf, (unsigned int) count);
}
MD5Final(fingerprint, &md5context);
free(filebuf, M_TEMP);
return 0;
}
static int
sha1_fingerprint(struct vnode *vp, struct veriexec_inode_list *ip,
struct proc *p, u_quad_t file_size, char *fingerprint)
{
u_quad_t j;
SHA1_CTX sha1context;
char *filebuf;
size_t resid;
int count, error;
filebuf = malloc(BUF_SIZE, M_TEMP, M_WAITOK);
SHA1Init(&sha1context);
for (j = 0; j < file_size; j+= BUF_SIZE) {
if ((j + BUF_SIZE) > file_size) {
count = file_size - j;
} else
count = BUF_SIZE;
error = vn_rdwr(UIO_READ, vp, filebuf, count, j,
UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
if (error) {
free(filebuf, M_TEMP);
return error;
}
SHA1Update(&sha1context, filebuf, (unsigned int) count);
}
SHA1Final(fingerprint, &sha1context);
free(filebuf, M_TEMP);
return 0;
}
/*
* evaluate_fingerprint:
* Check the fingerprint type for the given file and evaluate the
* fingerprint for that file. It is assumed that fingerprint has sufficient
* storage to hold the resulting fingerprint string.
*
*/
int
evaluate_fingerprint(struct vnode *vp, struct veriexec_inode_list *ip,
struct proc *p, u_quad_t file_size, char *fingerprint)
{
int error;
switch (ip->fp_type) {
case FINGERPRINT_TYPE_MD5:
error = md5_fingerprint(vp, ip, p, file_size, fingerprint);
break;
case FINGERPRINT_TYPE_SHA1:
error = sha1_fingerprint(vp, ip, p, file_size, fingerprint);
break;
default:
error = EINVAL;
break;
}
return error;
}
/*
* fingerprintcmp:
* Compare the two given fingerprints to see if they are the same
* Differing fingerprint methods may have differing lengths which
* is handled by this routine. This function follows the convention
* of other cmp functions and returns 0 if the fingerprints match and
* 1 if they don't.
*/
int
fingerprintcmp(struct veriexec_inode_list *ip, unsigned char *digest)
{
switch(ip->fp_type) {
case FINGERPRINT_TYPE_MD5:
return memcmp(ip->fingerprint, digest, MD5_FINGERPRINTLEN);
break;
case FINGERPRINT_TYPE_SHA1:
return memcmp(ip->fingerprint, digest, SHA1_FINGERPRINTLEN);
break;
default:
/* unknown fingerprint type, just fail it after whining */
printf("fingerprintcmp: unknown fingerprint type\n");
return 1;
break;
}
}
/*
* get_veriexec_inode:
* Search the given verified exec fingerprint list for the given
* fileid. If it exists then return a pointer to the list entry,
* otherwise return NULL. If found_dev is non-NULL set this to true
* iff the given device has a fingerprint list.
*
*/
struct veriexec_inode_list *
get_veriexec_inode(struct veriexec_devhead *head, long fsid, long fileid,
char *found_dev)
{
struct veriexec_dev_list *lp;
struct veriexec_inode_list *ip;
ip = NULL;
if (found_dev != NULL)
*found_dev = 0;
#ifdef VERIFIED_EXEC_DEBUG
printf("searching for file %lu on device %lu\n", fileid, fsid);
#endif
for (lp = LIST_FIRST(head); lp != NULL; lp = LIST_NEXT(lp, entries))
if (lp->id == fsid)
break;
if (lp != NULL) {
#ifdef VERIFIED_EXEC_DEBUG
printf("found matching dev number %lu\n", lp->id);
#endif
if (found_dev != NULL)
*found_dev = 1;
for (ip = LIST_FIRST(&(lp->inode_head)); ip != NULL;
ip = LIST_NEXT(ip, entries))
if (ip->inode == fileid)
break;
}
return ip;
}
/*
* check veriexec:
* check a file signature and return a status to check_exec.
*/
int
check_veriexec(struct proc *p, struct vnode *vp, struct exec_package *epp,
int direct_exec)
{
int error;
char digest[MAXFINGERPRINTLEN], found_dev;
struct veriexec_inode_list *ip;
error = 0;
found_dev = 0;
if (vp->fp_status == FINGERPRINT_INVALID) {
#ifdef VERIFIED_EXEC_DEBUG
printf("looking for loaded signature\n");
#endif
ip = get_veriexec_inode(&veriexec_dev_head, epp->ep_vap->va_fsid,
epp->ep_vap->va_fileid, &found_dev);
if (found_dev == 0) {
#ifdef VERIFIED_EXEC_DEBUG
printf("No device entry found\n");
#endif
vp->fp_status = FINGERPRINT_NODEV;
}
if (ip != NULL) {
#ifdef VERIFIED_EXEC_DEBUG
printf("found matching inode number %lu\n", ip->inode);
#endif
error = evaluate_fingerprint(vp, ip, p,
epp->ep_vap->va_size,
digest);
if (error)
return error;
if (fingerprintcmp(ip, digest) == 0) {
if (ip->type == VERIEXEC_DIRECT) {
#ifdef VERIFIED_EXEC_DEBUG
printf("Evaluated fingerprint matches\n");
#endif
vp->fp_status = FINGERPRINT_VALID;
} else {
#ifdef VERIFIED_EXEC_DEBUG
printf("Evaluated indirect fingerprint matches\n");
#endif
vp->fp_status = FINGERPRINT_INDIRECT;
}
} else {
#ifdef VERIFIED_EXEC_DEBUG
printf("Evaluated fingerprint match failed\n");
#endif
vp->fp_status = FINGERPRINT_NOMATCH;
}
} else {
#ifdef VERIFIED_EXEC_DEBUG
printf("No fingerprint entry found\n");
#endif
vp->fp_status = FINGERPRINT_NOENTRY;
}
}
switch (vp->fp_status) {
case FINGERPRINT_INVALID: /* should not happen */
printf("Got unexpected FINGERPRINT_INVALID!!!\n");
error = EPERM;
break;
case FINGERPRINT_VALID: /* is ok - report so if debug is on */
#ifdef VERIFIED_EXEC_DEBUG
printf("Fingerprint matches\n");
#endif
break;
case FINGERPRINT_INDIRECT: /* fingerprint ok but need to check
for direct execution */
if (direct_exec == 1) {
printf("Attempt to execute %s (dev %lu, inode %lu) "
"directly by pid %u (ppid %u, gppid %u)\n",
epp->ep_name, epp->ep_vap->va_fsid,
epp->ep_vap->va_fileid, p->p_pid,
p->p_pptr->p_pid, p->p_pptr->p_pptr->p_pid);
if (securelevel > 1)
error = EPERM;
}
break;
case FINGERPRINT_NOMATCH: /* does not match - whine about it */
printf("Fingerprint for %s (dev %lu, inode %lu) does not "
"match loaded value\n",
epp->ep_name, epp->ep_vap->va_fsid,
epp->ep_vap->va_fileid);
if (securelevel > 1)
error = EPERM;
break;
case FINGERPRINT_NOENTRY: /* no entry in the list, complain */
printf("No fingerprint for %s (dev %lu, inode %lu)\n",
epp->ep_name, epp->ep_vap->va_fsid,
epp->ep_vap->va_fileid);
if (securelevel > 1)
error = EPERM;
break;
case FINGERPRINT_NODEV: /* no signatures for the device, complain */
#ifdef VERIFIED_EXEC_DEBUG
printf("No signatures for device %lu\n",
epp->ep_vap->va_fsid);
#endif
if (securelevel > 1)
error = EPERM;
break;
default: /* this should never happen. */
printf("Invalid fp_status field for vnode %p\n", vp);
error = EPERM;
}
return error;
}
Reference in New Issue View Git Blame Copy Permalink