1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * VirtualBox Support Library - Verification of Hardened Installation.
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync * Copyright (C) 2006-2013 Oracle Corporation
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * available from http://www.virtualbox.org. This file is free software;
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * you can redistribute it and/or modify it under the terms of the GNU
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * General Public License (GPL) as published by the Free Software
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * The contents of this file may alternatively be used under the terms
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * of the Common Development and Distribution License Version 1.0
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * VirtualBox OSE distribution, in which case the provisions of the
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * CDDL are applicable instead of those of the GPL.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * You may elect to license modified versions of this file under the
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * terms and conditions of either the GPL or the CDDL or both.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync/*******************************************************************************
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync* Header Files *
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync*******************************************************************************/
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync#else /* UNIXes */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#if defined(RT_OS_WINDOWS) && defined(VBOX_WITH_HARDENING)
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync/*******************************************************************************
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync* Defined Constants And Macros *
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync*******************************************************************************/
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync/** The max path length acceptable for a trusted path. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Compare table file names with externally supplied names. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync/*******************************************************************************
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync* Global Variables *
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync*******************************************************************************/
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * The files that gets verified.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @todo This needs reviewing against the linux packages.
54d3b0107d9bf326fe6e0de92e012c791dbb1587vboxsync * @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * the time being we're building the linux packages with SharedLib pointing to
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * AppPrivArch (lazy bird).
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync /* type, dir, fOpt, "pszFile" */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync /* ---------------------------------------------------------------------- */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, false, "VMMR0.r0" },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDDR0.r0" },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, false, "VBoxDD2R0.r0" },
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync { kSupIFT_Rc, kSupID_AppPrivArch, false, "VMMGC.gc" },
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync { kSupIFT_Rc, kSupID_AppPrivArch, false, "VBoxDDGC.gc" },
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync { kSupIFT_Rc, kSupID_AppPrivArch, false, "VBoxDD2GC.gc" },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxRT" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxVMM" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxREM" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM32" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxREM64" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDD2" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxDDU" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync//#ifdef VBOX_WITH_DEBUGGER_GUI
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxDbg3" SUPLIB_DLL_SUFF },
9e293277b378073ce86910209a246b744b4caa2cvboxsync//#ifdef VBOX_WITH_SHARED_CLIPBOARD
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedClipboard" SUPLIB_DLL_SUFF },
9e293277b378073ce86910209a246b744b4caa2cvboxsync//#ifdef VBOX_WITH_SHARED_FOLDERS
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedFolders" SUPLIB_DLL_SUFF },
aabfd650b7e36e2c25a6d48b2a2bfd95fe93b65avboxsync//#ifdef VBOX_WITH_DRAG_AND_DROP
aabfd650b7e36e2c25a6d48b2a2bfd95fe93b65avboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxDragAndDropSvc" SUPLIB_DLL_SUFF },
9e293277b378073ce86910209a246b744b4caa2cvboxsync//#ifdef VBOX_WITH_GUEST_PROPS
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestPropSvc" SUPLIB_DLL_SUFF },
bdd15592ca3578b623ff588055a561f58b7e5586vboxsync//#ifdef VBOX_WITH_GUEST_CONTROL
bdd15592ca3578b623ff588055a561f58b7e5586vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxGuestControlSvc" SUPLIB_DLL_SUFF },
7f5e9cb0292dcce87c0a6794c775c14fb9c2a1e7vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHostChannel" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSharedCrOpenGL" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhostcrutil" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLhosterrorspu" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxOGLrenderspu" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VBoxManage" SUPLIB_EXE_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Exe, kSupID_AppBin, false, "VBoxSVC" SUPLIB_EXE_SUFF },
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxC" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Exe, kSupID_AppPrivArch, false, "VBoxXPCOMIPCD" SUPLIB_EXE_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_SharedLib, false, "VBoxXPCOM" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxXPCOMIPCC" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxC" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Dll, kSupID_AppPrivArchComp, false, "VBoxSVCM" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync { kSupIFT_Data, kSupID_AppPrivArchComp, false, "VBoxXPCOMBase.xpt" },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VRDPAuth" SUPLIB_DLL_SUFF },
b8908d384db2324f04a2f68a13e67ea32ebf609avboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxAuth" SUPLIB_DLL_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxVRDP" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync//#ifdef VBOX_WITH_HEADLESS
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VBoxHeadless" SUPLIB_EXE_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxHeadless" SUPLIB_DLL_SUFF },
b603b2af577731f9f825ba3681cd5b728bb1d1d4vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxVideoRecFB" SUPLIB_DLL_SUFF },
8e0c2ca3abd721979958f95b9af73b60665478c8vboxsync//#ifdef VBOX_WITH_QTGUI
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VirtualBox" SUPLIB_EXE_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VirtualBox" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync# if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_SharedLib, true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync//#ifdef VBOX_WITH_VBOXSDL
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VBoxSDL" SUPLIB_EXE_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxSDL" SUPLIB_DLL_SUFF },
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync//#ifdef VBOX_WITH_WEBSERVICES
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "vboxwebsrv" SUPLIB_EXE_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VBoxTunctl" SUPLIB_EXE_SUFF },
39592d8ff3243f6116c4e99be391bcf30a4ad187vboxsync//#ifdef VBOX_WITH_NETFLT
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetDHCP" SUPLIB_EXE_SUFF },
3ca89d9d8c4fc158ba28bdf82c9cc3697625ce12vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetDHCP" SUPLIB_DLL_SUFF },
6f6e182fde44ac8c4f95d8684e10fbbea937f26evboxsync//#ifdef VBOX_WITH_LWIP_NAT
20fc4a350a4a8e56ffaac6cf57dcd677a7ac36c5vboxsync { kSupIFT_Exe, kSupID_AppBin, true, "VBoxNetNAT" SUPLIB_EXE_SUFF },
20fc4a350a4a8e56ffaac6cf57dcd677a7ac36c5vboxsync { kSupIFT_Dll, kSupID_AppPrivArch, true, "VBoxNetNAT" SUPLIB_DLL_SUFF },
678e65f634668c9f9a0f45094277cd6b375484cavboxsync#if defined(VBOX_WITH_HARDENING) && defined(RT_OS_WINDOWS)
678e65f634668c9f9a0f45094277cd6b375484cavboxsync { kSupIFT_TestExe, kSupID_AppBin, true, a_szName SUPLIB_EXE_SUFF }, \
678e65f634668c9f9a0f45094277cd6b375484cavboxsync { kSupIFT_TestDll, kSupID_AppBin, true, a_szName SUPLIB_DLL_SUFF }
678e65f634668c9f9a0f45094277cd6b375484cavboxsync HARDENED_TESTCASE_BIN_ENTRY("tstPDMAsyncCompletion"),
678e65f634668c9f9a0f45094277cd6b375484cavboxsync HARDENED_TESTCASE_BIN_ENTRY("tstPDMAsyncCompletionStress"),
678e65f634668c9f9a0f45094277cd6b375484cavboxsync { kSupIFT_TestExe, kSupID_Testcase, true, a_szName SUPLIB_EXE_SUFF }, \
678e65f634668c9f9a0f45094277cd6b375484cavboxsync { kSupIFT_TestDll, kSupID_Testcase, true, a_szName SUPLIB_DLL_SUFF }
d84e3f7154abd56986d6ce98d9156769c7ae6587vboxsync HARDENED_TESTCASE_ENTRY("tstRTR0ThreadPreemptionDriver"),
678e65f634668c9f9a0f45094277cd6b375484cavboxsync HARDENED_TESTCASE_ENTRY("tstRTR0MemUserKernelDriver"),
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync/** Array parallel to g_aSupInstallFiles containing per-file status info. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncstatic SUPVERIFIEDFILE g_aSupVerifiedFiles[RT_ELEMENTS(g_aSupInstallFiles)];
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync/** Array index by install directory specifier containing info about verified directories. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncstatic SUPVERIFIEDDIR g_aSupVerifiedDirs[kSupID_End];
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync * Assembles the path to a directory.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS on success, some error code on failure (fFatal
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * decides whether it returns or not).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param enmDir The directory.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pszDst Where to assemble the path.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param cchDst The size of the buffer.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether failures should be treated as fatal (true) or not (false).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncstatic int supR3HardenedMakePath(SUPINSTDIR enmDir, char *pszDst, size_t cchDst, bool fFatal)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedPathAppPrivateArch(pszDst, cchDst);
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync suplibHardenedMemCopy(&pszDst[off], "/components", sizeof("/components"));
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedPathAppPrivateNoArch(pszDst, cchDst);
678e65f634668c9f9a0f45094277cd6b375484cavboxsync suplibHardenedMemCopy(&pszDst[off], "/testcase", sizeof("/testcase"));
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedMakePath: enmDir=%d rc=%d\n", enmDir, rc);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Assembles the path to a file table entry, with or without the actual filename.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS on success, some error code on failure (fFatal
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * decides whether it returns or not).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pFile The file table entry.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pszDst Where to assemble the path.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param cchDst The size of the buffer.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether failures should be treated as fatal (true) or not (false).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncstatic int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Combine supR3HardenedMakePath and the filename.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync int rc = supR3HardenedMakePath(pFile->enmDir, pszDst, cchDst, fFatal);
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync size_t cchFile = suplibHardenedStrLen(pFile->pszFile);
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync suplibHardenedMemCopy(&pszDst[off], pFile->pszFile, cchFile + 1);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_BUFFER_OVERFLOW, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Verifies a directory.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS on success. On failure, an error code is returned if
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fFatal is clear and if it's set the function wont return.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param enmDir The directory specifier.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether validation failures should be treated as
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fatal (true) or not (false).
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsyncDECLHIDDEN(int) supR3HardenedVerifyFixedDir(SUPINSTDIR enmDir, bool fFatal)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Validate the index just to be on the safe side...
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync if (enmDir <= kSupID_Invalid || enmDir >= kSupID_End)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Already validated?
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync /* initialize the entry. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Make the path and open the directory.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync int rc = supR3HardenedMakePath(enmDir, szPath, sizeof(szPath), fFatal);
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync FILE_SHARE_READ | FILE_SHARE_DELETE | FILE_SHARE_WRITE,
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync FILE_ATTRIBUTE_NORMAL | FILE_FLAG_BACKUP_SEMANTICS,
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync /** @todo check the type */
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync /* That's all on windows, for now at least... */
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync rc = VINF_SUCCESS; /* Optional directory, ignore if missing. */
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync "supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync "supR3HardenedVerifyDir: Failed to convert \"%s\" to UTF-16: err=%d\n", szPath, rc);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync#else /* UNIXY */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * On unixy systems we'll make sure the directory is owned by root
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * and not writable by the group and user.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_NOT_A_DIRECTORY, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyDir: \"%s\" is not a directory\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
678e65f634668c9f9a0f45094277cd6b375484cavboxsync rc = VINF_SUCCESS; /* Optional directory, ignore if missing. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync#endif /* UNIXY */
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Opens the file for verification.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @returns VINF_SUCCESS on success. On failure, an error code is returned if
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * fFatal is clear and if it's set the function wont return.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param pFile The file entry.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param fFatal Whether validation failures should be treated as
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * kl fatal (true) or not (false).
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param phFile The file handle, set to -1 if we failed to open
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * the file. The function may return VINF_SUCCESS
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * and a -1 handle if the file is optional.
2a076b740155a538ded6407c44aae5eff986a42fvboxsyncstatic int supR3HardenedVerifyFileOpen(PCSUPINSTFILE pFile, bool fFatal, intptr_t *phFile)
2a076b740155a538ded6407c44aae5eff986a42fvboxsync int rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true /*fWithFilename*/, fFatal);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync && (err != ERROR_PATH_NOT_FOUND || pFile->enmDir != kSupID_Testcase) ) )
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
2a076b740155a538ded6407c44aae5eff986a42fvboxsync "supR3HardenedVerifyFileInternal: Failed to open '%s': err=%d\n", szPath, err);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedError(rc, fFatal, "supR3HardenedVerifyFileInternal: Failed to convert '%s' to UTF-16: %Rrc\n",
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Worker for supR3HardenedVerifyFileInternal.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @returns VINF_SUCCESS on success. On failure, an error code is returned if
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * fFatal is clear and if it's set the function wont return.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param pFile The file entry.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param pVerified The verification record.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param fFatal Whether validation failures should be treated as
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * fatal (true) or not (false).
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param fLeaveFileOpen Whether the file should be left open.
2a076b740155a538ded6407c44aae5eff986a42fvboxsyncstatic int supR3HardenedVerifyFileSignature(PCSUPINSTFILE pFile, PSUPVERIFIEDFILE pVerified, bool fFatal, bool fLeaveFileOpen)
2a076b740155a538ded6407c44aae5eff986a42fvboxsync# if defined(VBOX_WITH_HARDENING) && !defined(IN_SUP_R3_STATIC) /* Latter: Not in VBoxCpuReport and friends. */
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Open the file if we have to.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedVerifyFileOpen(pFile, fFatal, &hFileOpened);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Verify the signature.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supHardenedWinVerifyImageByHandleNoName((HANDLE)hFile, fFlags, &ErrInfo);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedError(rc, fFatal, "supR3HardenedVerifyFileInternal: '%s': Image verify error rc=%Rrc: %s\n",
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Close the handle if we opened the file and we should close it.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync# else /* Not checking signatures. */
2a076b740155a538ded6407c44aae5eff986a42fvboxsync# endif /* Not checking signatures. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Verifies a file entry.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS on success. On failure, an error code is returned if
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fFatal is clear and if it's set the function wont return.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param iFile The file table index of the file to be verified.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether validation failures should be treated as
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fatal (true) or not (false).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fLeaveFileOpen Whether the file should be left open.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param fVerifyAll Set if this is an verify all call and we will
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * postpone signature checking.
2a076b740155a538ded6407c44aae5eff986a42fvboxsyncstatic int supR3HardenedVerifyFileInternal(int iFile, bool fFatal, bool fLeaveFileOpen, bool fVerifyAll)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync PSUPVERIFIEDFILE pVerified = &g_aSupVerifiedFiles[iFile];
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Already done validation? Do signature validation if we haven't yet.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync /** @todo revalidate? Check that the file hasn't been replace or similar. */
2a076b740155a538ded6407c44aae5eff986a42fvboxsync return supR3HardenedVerifyFileSignature(pFile, pVerified, fFatal, fLeaveFileOpen);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync /* initialize the entry. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Verify the directory then proceed to open it.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * (This'll make sure the directory is opened and that we can (later)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * use openat if we wish.)
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync int rc = supR3HardenedVerifyFixedDir(pFile->enmDir, fFatal);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedVerifyFileOpen(pFile, fFatal, &pVerified->hFile);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedVerifyFileSignature(pFile, pVerified, fFatal, fLeaveFileOpen);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync#else /* !RT_OS_WINDOWS */
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedMakeFilePath(pFile, szPath, sizeof(szPath), true /*fWithFilename*/, fFatal);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * On unixy systems we'll make sure the file is owned by root
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * and not writable by the group and user.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync /* it's valid. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_IS_A_DIRECTORY, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_ACCESS_DENIED, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_PATH_NOT_FOUND, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
2a076b740155a538ded6407c44aae5eff986a42fvboxsync#endif /* !RT_OS_WINDOWS */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Verifies that the specified table entry matches the given filename.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * error is returned or we terminate the application.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param iFile The file table index.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pszFilename The filename.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether validation failures should be treated as
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fatal (true) or not (false).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncstatic int supR3HardenedVerifySameFile(int iFile, const char *pszFilename, bool fFatal)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Construct the full path for the file table entry
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * and compare it with the specified file.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync int rc = supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /*fWithFilename*/, fFatal);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Normalize the two paths and compare again.
3c520cf6887d9039d9aa7cf3bbe81fd7de1ffd4cvboxsync char szName2[RTPATH_MAX]; /** @todo Must use UTF-16 here! Code is mixing UTF-8 and native. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync if ( GetFullPathName(szName, RT_ELEMENTS(szName2), &szName2[0], &pszIgnored)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync && GetFullPathName(pszFilename, RT_ELEMENTS(szName), &szName[0], &pszIgnored))
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync supR3HardenedMakeFilePath(pFile, szName, sizeof(szName), true /*fWithFilename*/, fFatal);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Check more stuff like the stat info if it's an already open file?
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Verifies a file.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS on success.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync * On verification failure, an error code will be returned when fFatal is clear,
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync * otherwise the program will be terminated.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pszFilename The filename.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether validation failures should be treated as
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fatal (true) or not (false).
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsyncDECLHIDDEN(int) supR3HardenedVerifyFixedFile(const char *pszFilename, bool fFatal)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Lookup the file and check if it's the same file.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync const char *pszName = supR3HardenedPathFilename(pszFilename);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (!SUP_COMP_FILENAME(pszName, g_aSupInstallFiles[iFile].pszFile))
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync int rc = supR3HardenedVerifySameFile(iFile, pszFilename, fFatal);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedVerifyFileInternal(iFile, fFatal, false /* fLeaveFileOpen */, false /* fVerifyAll */);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Verifies a program, worker for supR3HardenedVerifyAll.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns See supR3HardenedVerifyAll.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pszProgName See supR3HardenedVerifyAll.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal See supR3HardenedVerifyAll.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param fLeaveOpen The leave open setting used by
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * supR3HardenedVerifyAll.
2a076b740155a538ded6407c44aae5eff986a42fvboxsyncstatic int supR3HardenedVerifyProgram(const char *pszProgName, bool fFatal, bool fLeaveOpen)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Search the table looking for the executable and the DLL/DYLIB/SO.
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync size_t const cchProgName = suplibHardenedStrLen(pszProgName);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync if (!suplibHardenedStrNCmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
678e65f634668c9f9a0f45094277cd6b375484cavboxsync if ( ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
678e65f634668c9f9a0f45094277cd6b375484cavboxsync || g_aSupInstallFiles[iFile].enmType == kSupIFT_TestDll)
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync && !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync /* This only has to be found (once). */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
d5e31f0ab4e7c36082f8db5157c2acb6b36ecd97vboxsync rc = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveOpen,
d5e31f0ab4e7c36082f8db5157c2acb6b36ecd97vboxsync true /* fVerifyAll - check sign later, only final process need check it on load. */);
678e65f634668c9f9a0f45094277cd6b375484cavboxsync else if ( ( g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
678e65f634668c9f9a0f45094277cd6b375484cavboxsync || g_aSupInstallFiles[iFile].enmType == kSupIFT_TestExe)
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync && !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync /* Here we'll have to check that the specific program is the same as the entry. */
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync rc = supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync rc = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveOpen, false /* fVerifyAll */);
c77e7bff89c7639353778366984d51ff165ea0e3vboxsync int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync suplibHardenedStrCat(szFilename, g_aSupInstallFiles[iFile].pszFile);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync supR3HardenedVerifySameFile(iFile, szFilename, fFatal);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync "supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Check the findings.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync "supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync "supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync "supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Verifies all the known files (called from SUPR3HardenedMain).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VINF_SUCCESS on success.
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync * On verification failure, an error code will be returned when fFatal is clear,
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync * otherwise the program will be terminated.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param fFatal Whether validation failures should be treated as
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * fatal (true) or not (false).
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * @param pszProgName The program name. This is used to verify that
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * both the executable and corresponding
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * DLL/DYLIB/SO are valid.
2a076b740155a538ded6407c44aae5eff986a42fvboxsyncDECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, const char *pszProgName)
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * On windows
2a076b740155a538ded6407c44aae5eff986a42fvboxsync bool fLeaveOpen = false;
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * The verify all the files.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
2a076b740155a538ded6407c44aae5eff986a42fvboxsync int rc2 = supR3HardenedVerifyFileInternal(iFile, fFatal, fLeaveOpen, true /* fVerifyAll */);
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * Verify the program name, that is to say, check that it's in the table
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * (thus verified above) and verify the signature on platforms where we
2a076b740155a538ded6407c44aae5eff986a42fvboxsync * sign things.
2a076b740155a538ded6407c44aae5eff986a42fvboxsync int rc2 = supR3HardenedVerifyProgram(pszProgName, fFatal, fLeaveOpen);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Copies the N messages into the error buffer and returns @a rc.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns Returns @a rc
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param rc The return code.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param cMsgs The number of messages in the ellipsis.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param ... Message parts.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncstatic int supR3HardenedSetErrorN(int rc, PRTERRINFO pErrInfo, unsigned cMsgs, ...)
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync size_t cchMsg = VALID_PTR(pszMsg) ? suplibHardenedStrLen(pszMsg) : 0;
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Copies the three messages into the error buffer and returns @a rc.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns Returns @a rc
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param rc The return code.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszMsg1 The first message part.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszMsg2 The second message part.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszMsg3 The third message part.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncstatic int supR3HardenedSetError3(int rc, PRTERRINFO pErrInfo, const char *pszMsg1,
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetErrorN(rc, pErrInfo, 3, pszMsg1, pszMsg2, pszMsg3);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Copies the two messages into the error buffer and returns @a rc.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns Returns @a rc
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param rc The return code.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszMsg1 The first message part.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszMsg2 The second message part.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncstatic int supR3HardenedSetError2(int rc, PRTERRINFO pErrInfo, const char *pszMsg1,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync const char *pszMsg2)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetErrorN(rc, pErrInfo, 2, pszMsg1, pszMsg2);
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * Copies the error message to the error buffer and returns @a rc.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @returns Returns @a rc
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param rc The return code.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param pszMsg The message.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncstatic int supR3HardenedSetError(int rc, PRTERRINFO pErrInfo, const char *pszMsg)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetErrorN(rc, pErrInfo, 1, pszMsg);
f7f5cd7b1e530eb5636da51c974b48ae0c1775b3vboxsync#endif /* SOME_UNUSED_FUNCTION */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Output from a successfull supR3HardenedVerifyPathSanity call.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** The length of the path in szCopy. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** The number of path components. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** Set if the path ends with slash, indicating that it's a directory
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * reference and not a file reference. The slash has been removed from
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * the copy. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** The offset where each path component starts, i.e. the char after the
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * slash. The array has cComponents + 1 entries, where the final one is
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * cch + 1 so that one can always terminate the current component by
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * szPath[aoffComponent[i] - 1] = '\0'. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** A normalized copy of the path.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Reserve some extra space so we can be more relaxed about overflow
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * checks and terminator paddings, especially when recursing. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync/** Pointer to a parsed path. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsynctypedef SUPR3HARDENEDPATHINFO *PSUPR3HARDENEDPATHINFO;
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Verifies that the path is absolutely sane, it also parses the path.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * A sane path starts at the root (w/ drive letter on DOS derived systems) and
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * does not have any relative bits (/../) or unnecessary slashes (/bin//ls).
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Sane paths are less or equal to SUPR3HARDENED_MAX_PATH bytes in length. UNC
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * paths are not supported.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @returns VBox status code.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param pszPath The path to check.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pInfo Where to return a copy of the path along with
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * parsing information.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncstatic int supR3HardenedVerifyPathSanity(const char *pszPath, PRTERRINFO pErrInfo, PSUPR3HARDENEDPATHINFO pInfo)
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Check that it's an absolute path and copy the volume/root specifier.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo, "The path is not absolute: '", pszPath, "'");
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo, "The path is not absolute: '", pszPath, "'");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * No path specifying the root or something very shortly thereafter will
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * be approved of.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_IS_ROOT, pErrInfo, "The path is root: '", pszPath, "'");
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_SHORT, pErrInfo, "The path is too short: '", pszPath, "'");
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * Check each component. No parent references or double slashes.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /* Sanity checks. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync if (RTPATH_IS_SLASH(pszSrc[0])) /* can be relaxed if we care. */
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_CLEAN, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync "The path is not clean of double slashes: '", pszPath, "'");
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /* Record the start of the component. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync if (pInfo->cComponents >= RT_ELEMENTS(pInfo->aoffComponents) - 1)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_MANY_COMPONENTS, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync "The path has too many components: '", pszPath, "'");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync pInfo->aoffComponents[pInfo->cComponents++] = pszDst - &pInfo->szPath[0];
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /* Traverse to the end of the component, copying it as we go along. */
79fe674227c3f2b82ab22a6b7d340283b610fb83vboxsync if ((uintptr_t)(pszDst - &pInfo->szPath[0]) >= SUPR3HARDENED_MAX_PATH)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_LONG, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /* Terminate the string and enter its length. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync pInfo->cch = (uint16_t)(pszDst - &pInfo->szPath[0]);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync pInfo->aoffComponents[pInfo->cComponents] = pInfo->cch + 1;
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * The state information collected by supR3HardenedVerifyFsObject.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * This can be used to verify that a directory we've opened for enumeration is
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * the same as the one that supR3HardenedVerifyFsObject just verified. It can
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * equally be used to verify a native specfied by the user.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** Not implemented for windows yet. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** The stat output. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync/** Pointer to a file system object state. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsynctypedef SUPR3HARDENEDFSOBJSTATE *PSUPR3HARDENEDFSOBJSTATE;
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync/** Pointer to a const file system object state. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsynctypedef SUPR3HARDENEDFSOBJSTATE const *PCSUPR3HARDENEDFSOBJSTATE;
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Query information about a file system object by path.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns VBox status code, error buffer filled on failure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszPath The path to the object.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState Where to return the state information.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncstatic int supR3HardenedQueryFsObjectByPath(char const *pszPath, PSUPR3HARDENEDFSOBJSTATE pFsObjState, PRTERRINFO pErrInfo)
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** @todo Windows hardening. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Stat the object, do not follow links.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /* Ignore access errors */
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetErrorN(VERR_SUPLIB_STAT_FAILED, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync 5, "stat failed with ", strerror(errno), " on: '", pszPath, "'");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Read ACLs.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** @todo */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Query information about a file system object by native handle.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @returns VBox status code, error buffer filled on failure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param hNative The native handle to the object @a pszPath
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * specifies and this should be verified to be the
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * same file system object.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState Where to return the state information.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszPath The path to the object. (For the error message
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsyncstatic int supR3HardenedQueryFsObjectByHandle(RTHCUINTPTR hNative, PSUPR3HARDENEDFSOBJSTATE pFsObjState,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** @todo Windows hardening. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Stat the object, do not follow links.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetErrorN(VERR_SUPLIB_STAT_FAILED, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync 5, "fstat failed with ", strerror(errno), " on '", pszPath, "'");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Read ACLs.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** @todo */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Verifies that the file system object indicated by the native handle is the
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * same as the one @a pFsObjState indicates.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns VBox status code, error buffer filled on failure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState1 File system object information/state by path.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState2 File system object information/state by handle.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszPath The path to the object @a pFsObjState
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * describes. (For the error message.)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsyncstatic int supR3HardenedIsSameFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState1, PCSUPR3HARDENEDFSOBJSTATE pFsObjState2,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** @todo Windows hardening. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Compare the ino+dev, then the uid+gid and finally the important mode
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * bits. Technically the first one should be enough, but we're paranoid.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync if ( pFsObjState1->Stat.st_ino != pFsObjState2->Stat.st_ino
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync || pFsObjState1->Stat.st_dev != pFsObjState2->Stat.st_dev)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_NOT_SAME_OBJECT, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync "The native handle is not the same as '", pszPath, "' (ino/dev)");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync if ( pFsObjState1->Stat.st_uid != pFsObjState2->Stat.st_uid
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync || pFsObjState1->Stat.st_gid != pFsObjState2->Stat.st_gid)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_NOT_SAME_OBJECT, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync "The native handle is not the same as '", pszPath, "' (uid/gid)");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync if ( (pFsObjState1->Stat.st_mode & (S_IFMT | S_IWUSR | S_IWGRP | S_IWOTH))
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync != (pFsObjState2->Stat.st_mode & (S_IFMT | S_IWUSR | S_IWGRP | S_IWOTH)))
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_NOT_SAME_OBJECT, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync "The native handle is not the same as '", pszPath, "' (mode)");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Verifies a file system object (file or directory).
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns VBox status code, error buffer filled on failure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState The file system object information/state to be
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * verified.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param fDir Whether this is a directory or a file.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param fRelaxed Whether we can be more relaxed about this
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * directory (only used for grand parent
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * directories).
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync * @param pszPath The path to the object. For error messages and
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync * securing a couple of hacks.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsyncstatic int supR3HardenedVerifyFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState, bool fDir, bool fRelaxed,
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync /** @todo Windows hardening. */
f5eadb22976c1f9813300e4042b8255cfaef7e19vboxsync NOREF(pFsObjState); NOREF(fDir); NOREF(fRelaxed); NOREF(pszPath); NOREF(pErrInfo);
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync /* No hardening here - it's a single user system. */
f5eadb22976c1f9813300e4042b8255cfaef7e19vboxsync NOREF(pFsObjState); NOREF(fDir); NOREF(fRelaxed); NOREF(pszPath); NOREF(pErrInfo);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * The owner must be root.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * This can be extended to include predefined system users if necessary.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_OWNER_NOT_ROOT, pErrInfo, "The owner is not root: '", pszPath, "'");
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync * The object type must be directory or file, no symbolic links or other
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync * risky stuff (sorry dude, but we're paranoid on purpose here).
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync return supR3HardenedSetError3(VERR_SUPLIB_SYMLINKS_ARE_NOT_PERMITTED, pErrInfo,
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync return supR3HardenedSetError3(VERR_SUPLIB_NOT_DIR_NOT_FILE, pErrInfo,
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync return supR3HardenedSetError3(VERR_SUPLIB_IS_DIRECTORY, pErrInfo,
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync "Expected file but found directory: '", pszPath, "'");
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync return supR3HardenedSetError3(VERR_SUPLIB_IS_FILE, pErrInfo,
f65d92209d8ab9f6093c0e2a90e7d5b73a2254fevboxsync "Expected directory but found file: '", pszPath, "'");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * The group does not matter if it does not have write access, if it has
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * write access it must be group 0 (root/wheel/whatever).
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * This can be extended to include predefined system groups or groups that
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * only root is member of.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /* HACK ALERT: On Darwin /Applications is root:admin with admin having
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync full access. So, to work around we relax the hardening a bit and
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync permit grand parents and beyond to be group writable by admin. */
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync /** @todo dynamically resolve the admin group? */
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 80 /*admin*/ || suplibHardenedStrCmp(pszPath, "/Applications");
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync /* HACK ALERT: PC-BSD 9 has group-writable /usr/pib directory which is
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync similar to /Applications on OS X (see above).
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync On FreeBSD root is normally the only member of this group, on
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync PC-BSD the default user is a member. */
980eeb78f6811c935c7ebbe33de92f757ec3bc78vboxsync /** @todo dynamically resolve the operator group? */
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 5 /*operator*/ || suplibHardenedStrCmp(pszPath, "/usr/pbi");
f7f5cd7b1e530eb5636da51c974b48ae0c1775b3vboxsync bool fBad = true;
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_WRITE_NON_SYS_GROUP, pErrInfo,
d8c199b90187790578e3242fd67cfe0a11f2b993vboxsync "An unknown (and thus untrusted) group has write access to '", pszPath,
d8c199b90187790578e3242fd67cfe0a11f2b993vboxsync "' and we therefore cannot trust the directory content or that of any subdirectory");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * World must not have write access. There is no relaxing this rule.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_WORLD_WRITABLE, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Check the ACLs.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync /** @todo */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Verifies that the file system object indicated by the native handle is the
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * same as the one @a pFsObjState indicates.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @returns VBox status code, error buffer filled on failure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param hNative The native handle to the object @a pszPath
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * specifies and this should be verified to be the
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * same file system object.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState The information/state returned by a previous
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * query call.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pszPath The path to the object @a pFsObjState
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * describes. (For the error message.)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsyncstatic int supR3HardenedVerifySameFsObject(RTHCUINTPTR hNative, PCSUPR3HARDENEDFSOBJSTATE pFsObjState,
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync int rc = supR3HardenedQueryFsObjectByHandle(hNative, &FsObjState2, pszPath, pErrInfo);
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedIsSameFsObject(pFsObjState, &FsObjState2, pszPath, pErrInfo);
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * Does the recursive directory enumeration.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @returns VBox status code, error buffer filled on failure.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param pszDirPath The path buffer containing the subdirectory to
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * enumerate followed by a slash (this is never
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * the root slash). The buffer is RTPATH_MAX in
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * size and anything starting at @a cchDirPath
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * - 1 and beyond is scratch space.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param cchDirPath The length of the directory path + slash.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param pFsObjState Pointer to the file system object state buffer.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * On input this will hold the stats for
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * the directory @a pszDirPath indicates and will
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * be used to verified that we're opening the same
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param fRecursive Whether to recurse into subdirectories.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo The error info structure.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsyncstatic int supR3HardenedVerifyDirRecursive(char *pszDirPath, size_t cchDirPath, PSUPR3HARDENEDFSOBJSTATE pFsObjState,
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync /** @todo Windows hardening. */
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync /* No hardening here - it's a single user system. */
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Open the directory. Now, we could probably eliminate opendir here
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * and go down on kernel API level (open + getdents for instance), however
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * that's not very portable and hopefully not necessary.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync /* Ignore access errors. */
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetErrorN(VERR_SUPLIB_DIR_ENUM_FAILED, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync 5, "opendir failed with ", strerror(errno), " on '", pszDirPath, "'");
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync int rc = supR3HardenedVerifySameFsObject(dirfd(pDir), pFsObjState, pszDirPath, pErrInfo);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Enumerate the directory, check all the requested bits.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync pszDirPath[cchDirPath] = '\0'; /* for error messages. */
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedSetErrorN(VERR_SUPLIB_DIR_ENUM_FAILED, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync 5, "readdir_r failed with ", strerror(iErr), " in '", pszDirPath, "'");
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * Check the length and copy it into the path buffer so it can be
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * stat()'ed.
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync size_t cchName = suplibHardenedStrLen(pEntry->d_name);
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedSetErrorN(VERR_SUPLIB_PATH_TOO_LONG, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync 4, "Path grew too long during recursion: '", pszDirPath, pEntry->d_name, "'");
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync suplibHardenedMemCopy(&pszDirPath[cchName], pEntry->d_name, cchName + 1);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Query the information about the entry and verify it.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * (We don't bother skipping '.' and '..' at this point, a little bit
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * of extra checks doesn't hurt and neither requires relaxed handling.)
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedQueryFsObjectByPath(pszDirPath, pFsObjState, pErrInfo);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync rc = supR3HardenedVerifyFsObject(pFsObjState, S_ISDIR(pFsObjState->Stat.st_mode), false /*fRelaxed*/,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Recurse into subdirectories if requested.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync rc = supR3HardenedVerifyDirRecursive(pszDirPath, cchDirPath + cchName + 1, pFsObjState,
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * Worker for SUPR3HardenedVerifyDir.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @returns See SUPR3HardenedVerifyDir.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param pszDirPath See SUPR3HardenedVerifyDir.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param fRecursive See SUPR3HardenedVerifyDir.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param fCheckFiles See SUPR3HardenedVerifyDir.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo See SUPR3HardenedVerifyDir.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsyncDECLHIDDEN(int) supR3HardenedVerifyDir(const char *pszDirPath, bool fRecursive, bool fCheckFiles, PRTERRINFO pErrInfo)
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Validate the input path and parse it.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync int rc = supR3HardenedVerifyPathSanity(pszDirPath, pErrInfo, &Info);
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Verify each component from the root up.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync for (uint32_t iComponent = 0; iComponent < cComponents; iComponent++)
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = '\0';
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedQueryFsObjectByPath(Info.szPath, &FsObjState, pErrInfo);
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedVerifyFsObject(&FsObjState, true /*fDir*/, fRelaxed, Info.szPath, pErrInfo);
33619506f3e6045180309528f76b39cc36760431vboxsync Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = iComponent + 1 != cComponents ? RTPATH_SLASH : '\0';
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Check files and subdirectories if requested.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync return supR3HardenedVerifyDirRecursive(Info.szPath, Info.cch + 1, &FsObjState,
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * Verfies a file.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @returns VBox status code, error buffer filled on failure.
9fbcdff887bd2d679720a8a50f5601df57b32b1bvboxsync * @param pszFilename The file to verify.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * @param hNativeFile Handle to the file, verify that it's the same
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * as we ended up with when verifying the path.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * RTHCUINTPTR_MAX means NIL here.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * @param fMaybe3rdParty Set if the file is could be a supplied by a
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * third party. Different validation rules may
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * apply to 3rd party code on some platforms.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * @param pErrInfo Where to return extended error information.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync * Optional.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncDECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, RTHCUINTPTR hNativeFile,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Validate the input path and parse it.
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync int rc = supR3HardenedVerifyPathSanity(pszFilename, pErrInfo, &Info);
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync return supR3HardenedSetError3(VERR_SUPLIB_IS_DIRECTORY, pErrInfo,
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync "The file path specifies a directory: '", pszFilename, "'");
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync * Verify each component from the root up.
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync for (uint32_t iComponent = 0; iComponent < cComponents; iComponent++)
37e7010b28a4667800196960b59cd63b5434b7d7vboxsync Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = '\0';
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedQueryFsObjectByPath(Info.szPath, &FsObjState, pErrInfo);
3ee1fadbf124a56daa99470bee91759440ef5da9vboxsync rc = supR3HardenedVerifyFsObject(&FsObjState, !fFinal /*fDir*/, fRelaxed, Info.szPath, pErrInfo);
33619506f3e6045180309528f76b39cc36760431vboxsync Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = !fFinal ? RTPATH_SLASH : '\0';
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Verify the file handle against the last component, if specified.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync rc = supR3HardenedVerifySameFsObject(hNativeFile, &FsObjState, Info.szPath, pErrInfo);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * The files shall be signed on windows, verify that.
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync hVerify = CreateFileW(pwszPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
404c008ee2f58e85158a7c1c3f8974bdf52221e3vboxsync rc = RTErrInfoSetF(pErrInfo, rc, "Error converting '%s' to UTF-16: %Rrc", pszFilename, rc);
3c520cf6887d9039d9aa7cf3bbe81fd7de1ffd4cvboxsync NTSTATUS rcNt = NtDuplicateObject(NtCurrentProcess(), (HANDLE)hNativeFile, NtCurrentProcess(), &hVerify,
3c520cf6887d9039d9aa7cf3bbe81fd7de1ffd4cvboxsync GENERIC_READ, 0 /*HandleAttributes*/, 0 /*Options*/);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync uint32_t fFlags = SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING;
733c64713253004dc4de114e345c3e0b667b92ffvboxsync# ifndef IN_SUP_R3_STATIC /* Not in VBoxCpuReport and friends. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync rc = supHardenedWinVerifyImageByHandleNoName(hVerify, fFlags, pErrInfo);
30f07af559efcbd967e801903746fc21f81ee533vboxsync rc = RTErrInfoSetF(pErrInfo, RTErrConvertFromWin32(RtlGetLastWin32Error()),
30f07af559efcbd967e801903746fc21f81ee533vboxsync "Error %u trying to open (or duplicate handle for) '%s'", RtlGetLastWin32Error(), pszFilename);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Gets the pre-init data for the hand-over to the other version
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * of this code.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * The reason why we pass this information on is that it contains
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * open directories and files. Later it may include even more info
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * (int the verified arrays mostly).
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * The receiver is supR3HardenedRecvPreInitData.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pPreInitData Where to store it.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncDECLHIDDEN(void) supR3HardenedGetPreInitData(PSUPPREINITDATA pPreInitData)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync pPreInitData->cInstallFiles = RT_ELEMENTS(g_aSupInstallFiles);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync pPreInitData->paInstallFiles = &g_aSupInstallFiles[0];
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync pPreInitData->paVerifiedFiles = &g_aSupVerifiedFiles[0];
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync pPreInitData->cVerifiedDirs = RT_ELEMENTS(g_aSupVerifiedDirs);
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync pPreInitData->paVerifiedDirs = &g_aSupVerifiedDirs[0];
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Receives the pre-init data from the static executable stub.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @returns VBox status code. Will not bitch on failure since the
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * runtime isn't ready for it, so that is left to the exe stub.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * @param pPreInitData The hand-over data.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsyncDECLHIDDEN(int) supR3HardenedRecvPreInitData(PCSUPPREINITDATA pPreInitData)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Compare the array lengths and the contents of g_aSupInstallFiles.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync if ( pPreInitData->cInstallFiles != RT_ELEMENTS(g_aSupInstallFiles)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync || pPreInitData->cVerifiedDirs != RT_ELEMENTS(g_aSupVerifiedDirs))
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync SUPINSTFILE const *paInstallFiles = pPreInitData->paInstallFiles;
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync if ( g_aSupInstallFiles[iFile].enmDir != paInstallFiles[iFile].enmDir
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync || g_aSupInstallFiles[iFile].enmType != paInstallFiles[iFile].enmType
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync || g_aSupInstallFiles[iFile].fOptional != paInstallFiles[iFile].fOptional
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync || suplibHardenedStrCmp(g_aSupInstallFiles[iFile].pszFile, paInstallFiles[iFile].pszFile))
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Check that we're not called out of order.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * If dynamic linking it screwed up, we may end up here.
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync if ( ASMMemIsAll8(&g_aSupVerifiedFiles[0], sizeof(g_aSupVerifiedFiles), 0) != NULL
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync || ASMMemIsAll8(&g_aSupVerifiedDirs[0], sizeof(g_aSupVerifiedDirs), 0) != NULL)
1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync * Copy the verification data over.
f14d3c62ebf4ccb64bd11528e5c4ec60b4528a1avboxsync suplibHardenedMemCopy(&g_aSupVerifiedFiles[0], pPreInitData->paVerifiedFiles, sizeof(g_aSupVerifiedFiles));