SUPR3HardenedVerify.cpp revision ce5210fe822f74de78c3dddc74f32a2cabcee5fd
/* $Id$ */
/** @file
* VirtualBox Support Library - Verification of Hardened Installation.
*/
/*
* Copyright (C) 2006-2010 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*
* The contents of this file may alternatively be used under the terms
* of the Common Development and Distribution License Version 1.0
* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
* VirtualBox OSE distribution, in which case the provisions of the
* CDDL are applicable instead of those of the GPL.
*
* You may elect to license modified versions of this file under the
* terms and conditions of either the GPL or the CDDL or both.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#if defined(RT_OS_OS2)
# define INCL_BASE
# define INCL_ERRORS
# include <os2.h>
# include <stdio.h>
# include <stdlib.h>
# include <unistd.h>
# include <sys/syslimits.h>
#elif defined(RT_OS_WINDOWS)
# include <Windows.h>
# include <stdio.h>
#else /* UNIXes */
# include <stdio.h>
# include <stdlib.h>
# include <dirent.h>
# include <dlfcn.h>
# include <fcntl.h>
# include <limits.h>
# include <errno.h>
# include <unistd.h>
# include <stdio.h>
# include <pwd.h>
# ifdef RT_OS_DARWIN
# endif
#endif
#include "SUPLibInternal.h"
/*******************************************************************************
* Defined Constants And Macros *
*******************************************************************************/
/** The max path length acceptable for a trusted path. */
#define SUPR3HARDENED_MAX_PATH 260U
#ifdef RT_OS_SOLARIS
#endif
/*******************************************************************************
* Global Variables *
*******************************************************************************/
/**
* The files that gets verified.
*
* @todo This needs reviewing against the linux packages.
* @todo The excessive use of kSupID_SharedLib needs to be reviewed at some point. For
* the time being we're building the linux packages with SharedLib pointing to
* AppPrivArch (lazy bird).
*/
static SUPINSTFILE const g_aSupInstallFiles[] =
{
/* type, dir, fOpt, "pszFile" */
/* ---------------------------------------------------------------------- */
#ifdef VBOX_WITH_RAW_MODE
#endif
#if HC_ARCH_BITS == 32
#endif
//#ifdef VBOX_WITH_DEBUGGER_GUI
//#endif
//#ifdef VBOX_WITH_SHARED_CLIPBOARD
//#endif
//#ifdef VBOX_WITH_SHARED_FOLDERS
//#endif
//#ifdef VBOX_WITH_GUEST_PROPS
//#endif
//#ifdef VBOX_WITH_GUEST_CONTROL
//#endif
#ifdef VBOX_WITH_MAIN
#ifdef RT_OS_WINDOWS
#else
#endif
#endif
//#ifdef VBOX_WITH_HEADLESS
//#endif
//#ifdef VBOX_WITH_QTGUI
# endif
//#endif
//#ifdef VBOX_WITH_VBOXSDL
//#endif
//#ifdef VBOX_WITH_VBOXBFE
//#endif
//#ifdef VBOX_WITH_WEBSERVICES
//#endif
#ifdef RT_OS_LINUX
#endif
//#ifdef VBOX_WITH_NETFLT
//#endif
};
/** Array parallel to g_aSupInstallFiles containing per-file status info. */
/** Array index by install directory specifier containing info about verified directories. */
/**
* Assembles the path to a directory.
*
* @returns VINF_SUCCESS on success, some error code on failure (fFatal
* decides whether it returns or not).
*
* @param enmDir The directory.
* @param pszDst Where to assemble the path.
* @param cchDst The size of the buffer.
* @param fFatal Whether failures should be treated as fatal (true) or not (false).
*/
{
int rc;
switch (enmDir)
{
case kSupID_AppBin: /** @todo fix this AppBin crap (uncertain wtf some binaries actually are installed). */
case kSupID_Bin:
break;
case kSupID_SharedLib:
break;
case kSupID_AppPrivArch:
break;
case kSupID_AppPrivArchComp:
if (RT_SUCCESS(rc))
{
else
}
break;
case kSupID_AppPrivNoArch:
break;
default:
"supR3HardenedMakePath: enmDir=%d\n", enmDir);
}
if (RT_FAILURE(rc))
return rc;
}
/**
* Assembles the path to a file table entry, with or without the actual filename.
*
* @returns VINF_SUCCESS on success, some error code on failure (fFatal
* decides whether it returns or not).
*
* @param pFile The file table entry.
* @param pszDst Where to assemble the path.
* @param cchDst The size of the buffer.
* @param fWithFilename If set, the filename is included, otherwise it is omitted (no trailing slash).
* @param fFatal Whether failures should be treated as fatal (true) or not (false).
*/
static int supR3HardenedMakeFilePath(PCSUPINSTFILE pFile, char *pszDst, size_t cchDst, bool fWithFilename, bool fFatal)
{
/*
* Combine supR3HardenedMakePath and the filename.
*/
{
{
}
else
"supR3HardenedMakeFilePath: pszFile=%s off=%lu\n",
}
return rc;
}
/**
* Verifies a directory.
*
* @returns VINF_SUCCESS on success. On failure, an error code is returned if
* fFatal is clear and if it's set the function wont return.
* @param enmDir The directory specifier.
* @param fFatal Whether validation failures should be treated as
* fatal (true) or not (false).
*/
{
/*
* Validate the index just to be on the safe side...
*/
"supR3HardenedVerifyDir: enmDir=%d\n", enmDir);
/*
* Already validated?
*/
return VINF_SUCCESS; /** @todo revalidate? */
/* initialize the entry. */
"supR3HardenedVerifyDir: hDir=%p enmDir=%d\n",
/*
* Make the path and open the directory.
*/
char szPath[RTPATH_MAX];
if (RT_SUCCESS(rc))
{
#if defined(RT_OS_WINDOWS)
NULL,
NULL);
if (hDir != INVALID_HANDLE_VALUE)
{
/** @todo check the type */
/* That's all on windows, for now at least... */
}
else
{
int err = GetLastError();
"supR3HardenedVerifyDir: Failed to open \"%s\": err=%d\n",
}
#else /* UNIXY */
if (fd >= 0)
{
/*
* On unixy systems we'll make sure the directory is owned by root
* and not writable by the group and user.
*/
{
{
}
else
{
"supR3HardenedVerifyDir: \"%s\" is not a directory\n",
"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": not owned by root (st_uid=%ld)\n",
else
"supR3HardenedVerifyDir: Cannot trust the directory \"%s\": group and/or other writable (st_mode=0%lo)\n",
}
}
else
{
"supR3HardenedVerifyDir: Failed to fstat \"%s\": %s (%d)\n",
}
}
else
{
"supR3HardenedVerifyDir: Failed to open \"%s\": %s (%d)\n",
}
#endif /* UNIXY */
}
return rc;
}
/**
* Verifies a file entry.
*
* @returns VINF_SUCCESS on success. On failure, an error code is returned if
* fFatal is clear and if it's set the function wont return.
*
* @param iFile The file table index of the file to be verified.
* @param fFatal Whether validation failures should be treated as
* fatal (true) or not (false).
* @param fLeaveFileOpen Whether the file should be left open.
*/
{
/*
* Already done?
*/
if (pVerified->fValidated)
return VINF_SUCCESS; /** @todo revalidate? */
/* initialize the entry. */
"supR3HardenedVerifyFileInternal: hFile=%p (%s)\n",
pVerified->fValidated = false;
/*
* Verify the directory then proceed to open it.
* (This'll make sure the directory is opened and that we can (later)
* use openat if we wish.)
*/
if (RT_SUCCESS(rc))
{
char szPath[RTPATH_MAX];
if (RT_SUCCESS(rc))
{
#if defined(RT_OS_WINDOWS)
NULL,
NULL);
if (hFile != INVALID_HANDLE_VALUE)
{
/** @todo Check the type, and verify the signature (separate function so we can skip it). */
{
/* it's valid. */
if (fLeaveFileOpen)
else
pVerified->fValidated = true;
}
}
else
{
int err = GetLastError();
"supR3HardenedVerifyFileInternal: Failed to open \"%s\": err=%d\n",
}
#else /* UNIXY */
if (fd >= 0)
{
/*
* On unixy systems we'll make sure the directory is owned by root
* and not writable by the group and user.
*/
{
{
/* it's valid. */
if (fLeaveFileOpen)
else
pVerified->fValidated = true;
}
else
{
"supR3HardenedVerifyFileInternal: \"%s\" is not a regular file\n",
"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": not owned by root (st_uid=%ld)\n",
else
"supR3HardenedVerifyFileInternal: Cannot trust the file \"%s\": group and/or other writable (st_mode=0%lo)\n",
}
}
else
{
"supR3HardenedVerifyFileInternal: Failed to fstat \"%s\": %s (%d)\n",
}
}
else
{
"supR3HardenedVerifyFileInternal: Failed to open \"%s\": %s (%d)\n",
}
#endif /* UNIXY */
}
}
return rc;
}
/**
* Verifies that the specified table entry matches the given filename.
*
* @returns VINF_SUCCESS if matching. On mismatch fFatal indicates whether an
* error is returned or we terminate the application.
*
* @param iFile The file table index.
* @param pszFilename The filename.
* @param fFatal Whether validation failures should be treated as
* fatal (true) or not (false).
*/
{
/*
* Construct the full path for the file table entry
* and compare it with the specified file.
*/
char szName[RTPATH_MAX];
if (RT_FAILURE(rc))
return rc;
#if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
#else
#endif
{
/*
* Normalize the two paths and compare again.
*/
#if defined(RT_OS_WINDOWS)
char szName2[RTPATH_MAX];
rc = VINF_SUCCESS;
#else
char szName2[RTPATH_MAX];
rc = VINF_SUCCESS;
#endif
if (RT_FAILURE(rc))
{
"supR3HardenedVerifySameFile: \"%s\" isn't the same as \"%s\"\n",
}
}
/*
* Check more stuff like the stat info if it's an already open file?
*/
return VINF_SUCCESS;
}
/**
* Verifies a file.
*
* @returns VINF_SUCCESS on success.
* VERR_NOT_FOUND if the file isn't in the table, this isn't ever a fatal error.
* On verification failure, an error code will be returned when fFatal is clear,
* otherwise the program will be terminated.
*
* @param pszFilename The filename.
* @param fFatal Whether validation failures should be treated as
* fatal (true) or not (false).
*/
{
/*
* Lookup the file and check if it's the same file.
*/
{
if (RT_SUCCESS(rc))
return rc;
}
return VERR_NOT_FOUND;
}
/**
* Verifies a program, worker for supR3HardenedVerifyAll.
*
* @returns See supR3HardenedVerifyAll.
* @param pszProgName See supR3HardenedVerifyAll.
* @param fFatal See supR3HardenedVerifyAll.
*/
{
/*
*/
int rc = VINF_SUCCESS;
bool fExe = false;
bool fDll = false;
{
{
/* This only has to be found (once). */
if (fDll)
"supR3HardenedVerifyProgram: duplicate DLL entry for \"%s\"\n", pszProgName);
fDll = true;
}
{
/* Here we'll have to check that the specific program is the same as the entry. */
if (fExe)
"supR3HardenedVerifyProgram: duplicate EXE entry for \"%s\"\n", pszProgName);
fExe = true;
char szFilename[RTPATH_MAX];
int rc2 = supR3HardenedPathExecDir(szFilename, sizeof(szFilename) - cchProgName - sizeof(SUPLIB_EXE_SUFF));
if (RT_SUCCESS(rc2))
{
}
else
"supR3HardenedVerifyProgram: failed to query program path: rc=%d\n", rc2);
}
}
/*
* Check the findings.
*/
"supR3HardenedVerifyProgram: Couldn't find the program \"%s\"\n", pszProgName);
else if (!fExe)
"supR3HardenedVerifyProgram: Couldn't find the EXE entry for \"%s\"\n", pszProgName);
else if (!fDll)
"supR3HardenedVerifyProgram: Couldn't find the DLL entry for \"%s\"\n", pszProgName);
return rc;
}
/**
* Verifies all the known files.
*
* @returns VINF_SUCCESS on success.
* On verification failure, an error code will be returned when fFatal is clear,
* otherwise the program will be terminated.
*
* @param fFatal Whether validation failures should be treated as
* fatal (true) or not (false).
* @param fLeaveFilesOpen If set, all the verified files are left open.
* @param pszProgName Optional program name. This is used by SUPR3HardenedMain
* to verify that both the executable and corresponding
*/
{
/*
* The verify all the files.
*/
int rc = VINF_SUCCESS;
{
}
/*
* Verify the program name if specified, that is to say, just check that
* it's in the table (=> we've already verified it).
*/
if (pszProgName)
{
}
return rc;
}
/**
* Copies the N messages into the error buffer and returns @a rc.
*
* @returns Returns @a rc
* @param rc The return code.
* @param pErrInfo The error info structure.
* @param cMsgs The number of messages in the ellipsis.
* @param ... Message parts.
*/
{
if (pErrInfo)
{
{
}
}
return rc;
}
/**
* Copies the three messages into the error buffer and returns @a rc.
*
* @returns Returns @a rc
* @param rc The return code.
* @param pErrInfo The error info structure.
* @param pszMsg1 The first message part.
* @param pszMsg2 The second message part.
* @param pszMsg3 The third message part.
*/
{
}
#ifdef SOME_UNUSED_FUNCTION
/**
* Copies the two messages into the error buffer and returns @a rc.
*
* @returns Returns @a rc
* @param rc The return code.
* @param pErrInfo The error info structure.
* @param pszMsg1 The first message part.
* @param pszMsg2 The second message part.
*/
const char *pszMsg2)
{
}
/**
* Copies the error message to the error buffer and returns @a rc.
*
* @returns Returns @a rc
* @param rc The return code.
* @param pErrInfo The error info structure.
* @param pszMsg The message.
*/
{
}
#endif /* SOME_UNUSED_FUNCTION */
/**
* Output from a successfull supR3HardenedVerifyPathSanity call.
*/
typedef struct SUPR3HARDENEDPATHINFO
{
/** The length of the path in szCopy. */
/** The number of path components. */
/** Set if the path ends with slash, indicating that it's a directory
* reference and not a file reference. The slash has been removed from
* the copy. */
bool fDirSlash;
/** The offset where each path component starts, i.e. the char after the
* slash. The array has cComponents + 1 entries, where the final one is
* cch + 1 so that one can always terminate the current component by
* szPath[aoffComponent[i] - 1] = '\0'. */
/** A normalized copy of the path.
* Reserve some extra space so we can be more relaxed about overflow
* checks and terminator paddings, especially when recursing. */
/** Pointer to a parsed path. */
typedef SUPR3HARDENEDPATHINFO *PSUPR3HARDENEDPATHINFO;
/**
* Verifies that the path is absolutely sane, it also parses the path.
*
* A sane path starts at the root (w/ drive letter on DOS derived systems) and
* does not have any relative bits (/../) or unnecessary slashes (/bin//ls).
* Sane paths are less or equal to SUPR3HARDENED_MAX_PATH bytes in length. UNC
* paths are not supported.
*
* @returns VBox status code.
* @param pszPath The path to check.
* @param pErrInfo The error info structure.
* @param pInfo Where to return a copy of the path along with
* parsing information.
*/
static int supR3HardenedVerifyPathSanity(const char *pszPath, PRTERRINFO pErrInfo, PSUPR3HARDENEDPATHINFO pInfo)
{
/*
*/
#if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
if ( RT_C_IS_ALPHA(pszSrc[0])
return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo, "The path is not absolute: '", pszPath, "'");
*pszDst++ = ':';
*pszDst++ = RTPATH_SLASH;
pszSrc += 3;
#else
if (!RTPATH_IS_SLASH(pszSrc[0]))
return supR3HardenedSetError3(VERR_SUPLIB_PATH_NOT_ABSOLUTE, pErrInfo, "The path is not absolute: '", pszPath, "'");
*pszDst++ = RTPATH_SLASH;
pszSrc += 1;
#endif
/*
* No path specifying the root or something very shortly thereafter will
* be approved of.
*/
if (pszSrc[0] == '\0')
return supR3HardenedSetError3(VERR_SUPLIB_PATH_IS_ROOT, pErrInfo, "The path is root: '", pszPath, "'");
return supR3HardenedSetError3(VERR_SUPLIB_PATH_TOO_SHORT, pErrInfo, "The path is too short: '", pszPath, "'");
/*
* Check each component. No parent references or double slashes.
*/
pInfo->cComponents = 0;
while (pszSrc[0])
{
/* Sanity checks. */
if ( pszSrc[0] == '.'
/* Record the start of the component. */
/* Traverse to the end of the component, copying it as we go along. */
while (pszSrc[0])
{
if (RTPATH_IS_SLASH(pszSrc[0]))
{
pszSrc++;
if (*pszSrc)
*pszDst++ = RTPATH_SLASH;
else
break;
}
}
}
/* Terminate the string and enter its length. */
pszDst[0] = '\0';
return VINF_SUCCESS;
}
/**
* The state information collected by supR3HardenedVerifyFsObject.
*
* This can be used to verify that a directory we've opened for enumeration is
* the same as the one that supR3HardenedVerifyFsObject just verified. It can
* equally be used to verify a native specfied by the user.
*/
typedef struct SUPR3HARDENEDFSOBJSTATE
{
#ifdef RT_OS_WINDOWS
/** Not implemented for windows yet. */
char chTodo;
#else
/** The stat output. */
#endif
/** Pointer to a file system object state. */
/** Pointer to a const file system object state. */
typedef SUPR3HARDENEDFSOBJSTATE const *PCSUPR3HARDENEDFSOBJSTATE;
/**
* Query information about a file system object by path.
*
* @returns VBox status code, error buffer filled on failure.
* @param pszPath The path to the object.
* @param pFsObjState Where to return the state information.
* @param pErrInfo The error info structure.
*/
static int supR3HardenedQueryFsObjectByPath(char const *pszPath, PSUPR3HARDENEDFSOBJSTATE pFsObjState, PRTERRINFO pErrInfo)
{
#if defined(RT_OS_WINDOWS)
/** @todo Windows hardening. */
pFsObjState->chTodo = 0;
return VINF_SUCCESS;
#else
/*
* Stat the object, do not follow links.
*/
{
/* Ignore access errors */
}
/*
* Read ACLs.
*/
/** @todo */
return VINF_SUCCESS;
#endif
}
/**
* Query information about a file system object by native handle.
*
* @returns VBox status code, error buffer filled on failure.
* @param hNative The native handle to the object @a pszPath
* specifies and this should be verified to be the
* same file system object.
* @param pFsObjState Where to return the state information.
* @param pszPath The path to the object. (For the error message
* only.)
* @param pErrInfo The error info structure.
*/
static int supR3HardenedQueryFsObjectByHandle(RTHCUINTPTR hNative, PSUPR3HARDENEDFSOBJSTATE pFsObjState,
{
#if defined(RT_OS_WINDOWS)
/** @todo Windows hardening. */
pFsObjState->chTodo = 0;
return VINF_SUCCESS;
#else
/*
* Stat the object, do not follow links.
*/
/*
* Read ACLs.
*/
/** @todo */
return VINF_SUCCESS;
#endif
}
/**
* Verifies that the file system object indicated by the native handle is the
* same as the one @a pFsObjState indicates.
*
* @returns VBox status code, error buffer filled on failure.
* @param pFsObjState1 File system object information/state by path.
* @param pFsObjState2 File system object information/state by handle.
* @param pszPath The path to the object @a pFsObjState
* describes. (For the error message.)
* @param pErrInfo The error info structure.
*/
static int supR3HardenedIsSameFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState1, PCSUPR3HARDENEDFSOBJSTATE pFsObjState2,
{
#if defined(RT_OS_WINDOWS)
/** @todo Windows hardening. */
return VINF_SUCCESS;
return VINF_SUCCESS;
#else
/*
* Compare the ino+dev, then the uid+gid and finally the important mode
* bits. Technically the first one should be enough, but we're paranoid.
*/
return VINF_SUCCESS;
#endif
}
/**
* Verifies a file system object (file or directory).
*
* @returns VBox status code, error buffer filled on failure.
* @param pFsObjState The file system object information/state to be
* verified.
* @param fDir Whether this is a directory or a file.
* @param fRelaxed Whether we can be more relaxed about this
* directory (only used for grand parent
* directories).
* @param pszPath The path to the object. For error messages and
* securing a couple of hacks.
* @param pErrInfo The error info structure.
*/
static int supR3HardenedVerifyFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState, bool fDir, bool fRelaxed,
{
#if defined(RT_OS_WINDOWS)
/** @todo Windows hardening. */
return VINF_SUCCESS;
/* No hardening here - it's a single user system. */
return VINF_SUCCESS;
#else
/*
* The owner must be root.
*
* This can be extended to include predefined system users if necessary.
*/
return supR3HardenedSetError3(VERR_SUPLIB_OWNER_NOT_ROOT, pErrInfo, "The owner is not root: '", pszPath, "'");
/*
* The object type must be directory or file, no symbolic links or other
* risky stuff (sorry dude, but we're paranoid on purpose here).
*/
{
}
{
}
/*
* The group does not matter if it does not have write access, if it has
*
* This can be extended to include predefined system groups or groups that
* only root is member of.
*/
{
#ifdef RT_OS_DARWIN
/* HACK ALERT: On Darwin /Applications is root:admin with admin having
full access. So, to work around we relax the hardening a bit and
permit grand parents and beyond to be group writable by admin. */
/** @todo dynamically resolve the admin group? */
bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 80 /*admin*/ || strcmp(pszPath, "/Applications");
#elif defined(RT_OS_FREEBSD)
similar to /Applications on OS X (see above).
On FreeBSD root is normally the only member of this group, on
PC-BSD the default user is a member. */
/** @todo dynamically resolve the operator group? */
#else
bool fBad = true;
#endif
if (fBad)
}
/*
* World must not have write access. There is no relaxing this rule.
*/
/*
* Check the ACLs.
*/
/** @todo */
return VINF_SUCCESS;
#endif
}
/**
* Verifies that the file system object indicated by the native handle is the
* same as the one @a pFsObjState indicates.
*
* @returns VBox status code, error buffer filled on failure.
* @param hNative The native handle to the object @a pszPath
* specifies and this should be verified to be the
* same file system object.
* @param pFsObjState The information/state returned by a previous
* query call.
* @param pszPath The path to the object @a pFsObjState
* describes. (For the error message.)
* @param pErrInfo The error info structure.
*/
static int supR3HardenedVerifySameFsObject(RTHCUINTPTR hNative, PCSUPR3HARDENEDFSOBJSTATE pFsObjState,
{
if (RT_SUCCESS(rc))
return rc;
}
/**
* Does the recursive directory enumeration.
*
* @returns VBox status code, error buffer filled on failure.
* @param pszDirPath The path buffer containing the subdirectory to
* enumerate followed by a slash (this is never
* the root slash). The buffer is RTPATH_MAX in
* size and anything starting at @a cchDirPath
* - 1 and beyond is scratch space.
* @param cchDirPath The length of the directory path + slash.
* @param pFsObjState Pointer to the file system object state buffer.
* On input this will hold the stats for
* the directory @a pszDirPath indicates and will
* be used to verified that we're opening the same
* thing.
* @param fRecursive Whether to recurse into subdirectories.
* @param pErrInfo The error info structure.
*/
static int supR3HardenedVerifyDirRecursive(char *pszDirPath, size_t cchDirPath, PSUPR3HARDENEDFSOBJSTATE pFsObjState,
{
#if defined(RT_OS_WINDOWS)
/** @todo Windows hardening. */
return VINF_SUCCESS;
/* No hardening here - it's a single user system. */
return VINF_SUCCESS;
#else
/*
* Open the directory. Now, we could probably eliminate opendir here
* and go down on kernel API level (open + getdents for instance), however
* that's not very portable and hopefully not necessary.
*/
if (!pDir)
{
/* Ignore access errors. */
return VINF_SUCCESS;
}
{
if (RT_FAILURE(rc))
{
return rc;
}
}
/*
* Enumerate the directory, check all the requested bits.
*/
int rc = VINF_SUCCESS;
for (;;)
{
if (iErr)
{
break;
}
if (!pEntry)
break;
/*
* Check the length and copy it into the path buffer so it can be
* stat()'ed.
*/
{
break;
}
/*
* Query the information about the entry and verify it.
* (We don't bother skipping '.' and '..' at this point, a little bit
* of extra checks doesn't hurt and neither requires relaxed handling.)
*/
if (RT_SUCCESS(rc))
break;
rc = supR3HardenedVerifyFsObject(pFsObjState, S_ISDIR(pFsObjState->Stat.st_mode), false /*fRelaxed*/,
if (RT_FAILURE(rc))
break;
/*
* Recurse into subdirectories if requested.
*/
if ( fRecursive
{
if (RT_FAILURE(rc))
break;
}
}
return VINF_SUCCESS;
#endif
}
/**
* Worker for SUPR3HardenedVerifyDir.
*
* @returns See SUPR3HardenedVerifyDir.
* @param pszDirPath See SUPR3HardenedVerifyDir.
* @param fRecursive See SUPR3HardenedVerifyDir.
* @param fCheckFiles See SUPR3HardenedVerifyDir.
* @param pErrInfo See SUPR3HardenedVerifyDir.
*/
DECLHIDDEN(int) supR3HardenedVerifyDir(const char *pszDirPath, bool fRecursive, bool fCheckFiles, PRTERRINFO pErrInfo)
{
/*
* Validate the input path and parse it.
*/
if (RT_FAILURE(rc))
return rc;
/*
* Verify each component from the root up.
*/
{
if (RT_SUCCESS(rc))
if (RT_FAILURE(rc))
return rc;
Info.szPath[Info.aoffComponents[iComponent + 1] - 1] = iComponent + 1 != cComponents ? RTPATH_SLASH : '\0';
}
/*
* Check files and subdirectories if requested.
*/
if (fCheckFiles || fRecursive)
{
}
return VINF_SUCCESS;
}
/**
* Verfies a file.
*
* @returns VBox status code, error buffer filled on failure.
* @param pszFilename The file to verify.
* @param hNativeFile Handle to the file, verify that it's the same
* as we ended up with when verifying the path.
* RTHCUINTPTR_MAX means NIL here.
* @param pErrInfo Where to return extended error information.
* Optional.
*/
DECLHIDDEN(int) supR3HardenedVerifyFile(const char *pszFilename, RTHCUINTPTR hNativeFile, PRTERRINFO pErrInfo)
{
/*
* Validate the input path and parse it.
*/
if (RT_FAILURE(rc))
return rc;
/*
* Verify each component from the root up.
*/
{
if (RT_SUCCESS(rc))
if (RT_FAILURE(rc))
return rc;
}
/*
* Verify the file.
*/
if (hNativeFile != RTHCUINTPTR_MAX)
return VINF_SUCCESS;
}
/**
* Gets the pre-init data for the hand-over to the other version
* of this code.
*
* The reason why we pass this information on is that it contains
* open directories and files. Later it may include even more info
* (int the verified arrays mostly).
*
* The receiver is supR3HardenedRecvPreInitData.
*
* @param pPreInitData Where to store it.
*/
{
}
/**
* Receives the pre-init data from the static executable stub.
*
* @returns VBox status code. Will not bitch on failure since the
* runtime isn't ready for it, so that is left to the exe stub.
*
* @param pPreInitData The hand-over data.
*/
{
/*
* Compare the array lengths and the contents of g_aSupInstallFiles.
*/
return VERR_VERSION_MISMATCH;
return VERR_VERSION_MISMATCH;
/*
* Check that we're not called out of order.
* If dynamic linking it screwed up, we may end up here.
*/
return VERR_WRONG_ORDER;
/*
* Copy the verification data over.
*/
return VINF_SUCCESS;
}