| History log of /src/sbin/veriexecctl/veriexecctl.c |
| Revision | | Date | Author | Comments |
| 1.40 |
| 10-Jan-2017 |
christos | need <sys/stat.h> ... for stat()
|
| 1.39 |
| 16-Jun-2015 |
christos | branches: 1.39.2;
fix error messages containing \n
|
| 1.38 |
| 26-Apr-2015 |
maxv | Be a bit more verbose if the kernel rejects a file
|
| 1.37 |
| 27-Jul-2014 |
dholland | branches: 1.37.2;
Fix snprintf usage and, while here, don't trundle off the end of an
array. Part of PR 47976 from Henning Petersen.
|
| 1.36 |
| 09-Feb-2014 |
maxv | branches: 1.36.2;
Fix error message; argv[1] could be NULL
|
| 1.35 |
| 29-Aug-2011 |
joerg | branches: 1.35.2; 1.35.8;
Use __dead
|
| 1.34 |
| 16-Mar-2009 |
lukem | fix sign-compare issues
|
| 1.33 |
| 31-Aug-2008 |
dholland | branches: 1.33.4;
Remove trailing whitespace. Noted in PR 39440 by Stathis Kamperis.
|
| 1.32 |
| 31-Aug-2008 |
dholland | Don't dump core if given no arguments. Fixes PR 39440 from Stathis Kamperis
(but with a different patch).
|
| 1.31 |
| 15-Feb-2008 |
elad | branches: 1.31.4; 1.31.8;
Allow no signatures file to be specified for the "load" command, and use
the default one in such cases.
Update command usage and documentation to reflect the above.
|
| 1.30 |
| 06-Sep-2007 |
xtraeme | branches: 1.30.2;
CID 4498: print_entry() returning without freeing 'fp'.
Ok by rmind@.
|
| 1.29 |
| 17-Aug-2007 |
pavel | branches: 1.29.2;
Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).
|
| 1.28 |
| 15-May-2007 |
oster | Add missing #include <sys/ioctl.h> to make this build without warnings.
|
| 1.27 |
| 15-May-2007 |
elad | Some Veriexec stuff that's been rotting in my tree for months.
Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.
- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.
- Fix memory leak in rename handling when overwriting a monitored
file.
- Fix table deletion logic.
- Don't prevent query requests if not in learning mode.
KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.
- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.
- veriexec_report() was removed, it is now internal.
- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.
- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.
New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.
- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:
# veriexecctl dump > /etc/signatures
Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.
Idea from Brett Lymn.
- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:
# veriexecctl flush
- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.
- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.
Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.
- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.
- Some of the messages Veriexec prints were improved.
- Various documentation fixes.
All relevant man-pages were updated to reflect the above changes.
Binary compatibility with existing veriexecctl binaries is maintained.
|
| 1.26 |
| 29-Nov-2006 |
elad | Type changed from size_t to uint64_t, adjust format string.
Pointed out by Tom Spindler, thanks!
|
| 1.25 |
| 28-Nov-2006 |
elad | Make Veriexec use proplib(3) for kernel-userland data passing.
Obviously, this breaks the already unstable Veriexec ABI, but that's
it. Some cool additions are planned to be introduced, and this just
makes it so that NetBSD 4.0 users will be able to easily use them as
well.
This also removes the fingerprint type name limit, so relevant code
was adjusted.
Thoroughly tested (even uncovered a bug in proplib! thanks for fixing
that cube@!). Documentation updated.
|
| 1.24 |
| 21-Nov-2006 |
elad | Update my email address.
|
| 1.23 |
| 14-Jul-2006 |
elad | misc cleanup: remove #if 0 code, unused var, and make pretty.
|
| 1.22 |
| 14-Jul-2006 |
elad | oops, forgot to handle new abi for "query", noted by he@, thanks!
|
| 1.21 |
| 14-Jul-2006 |
elad | okay, since there was no way to divide this to two commits, here it goes..
introduce fileassoc(9), a kernel interface for associating meta-data with
files using in-kernel memory. this is very similar to what we had in
veriexec till now, only abstracted so it can be used more easily by more
consumers.
this also prompted the redesign of the interface, making it work on vnodes
and mounts and not directly on devices and inodes. internally, we still
use file-id but that's gonna change soon... the interface will remain
consistent.
as a result, veriexec went under some heavy changes to conform to the new
interface. since we no longer use device numbers to identify file-systems,
the veriexec sysctl stuff changed too: kern.veriexec.count.dev_N is now
kern.veriexec.tableN.* where 'N' is NOT the device number but rather a
way to distinguish several mounts.
also worth noting is the plugging of unmount/delete operations
wrt/fileassoc and veriexec.
tons of input from yamt@, wrstuden@, martin@, and christos@.
|
| 1.20 |
| 13-Dec-2005 |
dsl | Use PRIu64 to print ino_t (maybe there should be a PRIino_t somewhere....)
|
| 1.19 |
| 12-Dec-2005 |
elad | Add and document a "query" keyword to veriexecctl. Usage:
/sbin/veriexecctl query /path/to/file
will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.
|
| 1.18 |
| 10-Dec-2005 |
elad | Add and document a VERIEXEC_DELETE operation for Veriexec.
We can now delete an entry from the tables using
veriexecctl delete /path/to/file
or remove an entire table using
veriexecctl delete /mount_point
(any directory will work for the mount point it's on)
|
| 1.17 |
| 05-Oct-2005 |
elad | Introduce per-page fingerprints in Veriexec.
This closes a hole pointed out by Thor Lancelot Simon on tech-kern ~3
years ago.
The problem was with running binaries from remote storage, where our
kernel (and Veriexec) has no control over any changes to files.
An attacker could, after the fingerprint has been verified and
program loaded to memory, inject malicious code into the backing
store on the remote storage, followed by a forced flush, causing
a page-in of the malicious data from backing store, bypassing
integrity checks.
Initial implementation by Brett Lymn.
|
| 1.16 |
| 13-Jun-2005 |
elad | Some refactoring and bugfixes:
- Report line numbers correctly.
- Don't perform a 2nd pass when there are were errors during 1st.
- Support multiple, comma-separated flags. This is mostly a reworking of
some parser internals preparing for planned features.
|
| 1.15 |
| 03-Jun-2005 |
elad | No need for this one, apparently. Reported by Hisashi T Fujinaka.
|
| 1.14 |
| 03-Jun-2005 |
elad | Don't create duplicate tables for the same device.
|
| 1.13 |
| 01-Jun-2005 |
elad | Newline in end of usage.
|
| 1.12 |
| 30-May-2005 |
elad | Warn when failing to load an entry; don't fail the whole process.
|
| 1.11 |
| 21-May-2005 |
skrll | Remove unused variables.
|
| 1.10 |
| 20-May-2005 |
elad | Remove leftovers from Vexec.
|
| 1.9 |
| 20-May-2005 |
elad | Remove common code for returning supported fingerprints. This is done now
via sysctl(8) using kern.veriexec.algorithms.
Also add an entry for the 'algorithms' variable in sysctl.8 forgotten in
the last commit.
|
| 1.8 |
| 21-Apr-2005 |
christos | Minor cleanups, KNF, error handling consistency.
|
| 1.7 |
| 21-Apr-2005 |
he | Make this compile again after the latest overhaul.
Use -I${.CURDIR} instead of -I. to support placement of objects elsewhere.
Make sure arguments to ctype functions are unsigned char by changing the
type of one function argument.
Fix "local declaration shadows global" warnings by renaming variables.
Fix printing of size_t variable to use %zu format instead of %u.
|
| 1.6 |
| 20-Apr-2005 |
blymn | Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.
|
| 1.5 |
| 06-Mar-2004 |
blymn | branches: 1.5.6;
Made error messages more descriptive.
|
| 1.4 |
| 05-Jan-2004 |
jmmv | Homogenize usage messages: make the 'usage' word all lowercase, as this seems
to be the most common practice in our tree.
|
| 1.3 |
| 21-Dec-2002 |
wiz | Remove traces of old names (verifiedexec_load and /dev/verifiedexec).
|
| 1.2 |
| 06-Dec-2002 |
thorpej | Need <stdlib.h> for exit() prototype.
|
| 1.1 |
| 23-Nov-2002 |
blymn | Renamed verified exec fingerprint loader.
|
| 1.5.6.11 |
| 02-Jul-2005 |
tron | Pull up revision 1.16 (requested by elad in ticket #487):
Some refactoring and bugfixes:
- Report line numbers correctly.
- Don't perform a 2nd pass when there are were errors during 1st.
- Support multiple, comma-separated flags. This is mostly a reworking of
some parser internals preparing for planned features.
|
| 1.5.6.10 |
| 10-Jun-2005 |
tron | Pull up revision 1.15 (requested by elad in ticket #390):
No need for this one, apparently. Reported by Hisashi T Fujinaka.
|
| 1.5.6.9 |
| 10-Jun-2005 |
tron | Pull up revision 1.14 (requested by elad in ticket #389):
Don't create duplicate tables for the same device.
|
| 1.5.6.8 |
| 10-Jun-2005 |
tron | Pull up revision 1.13 (requested by elad in ticket #389):
Newline in end of usage.
|
| 1.5.6.7 |
| 10-Jun-2005 |
tron | Pull up revision 1.12 (requested by elad in ticket #389):
Warn when failing to load an entry; don't fail the whole process.
|
| 1.5.6.6 |
| 10-Jun-2005 |
tron | Pull up revision 1.11 (requested by elad in ticket #389):
Remove unused variables.
|
| 1.5.6.5 |
| 10-Jun-2005 |
tron | Pull up revision 1.10 (requested by elad in ticket #389):
Remove leftovers from Vexec.
|
| 1.5.6.4 |
| 10-Jun-2005 |
tron | Pull up revision 1.9 (requested by elad in ticket #389):
Remove common code for returning supported fingerprints. This is done now
via sysctl(8) using kern.veriexec.algorithms.
Also add an entry for the 'algorithms' variable in sysctl.8 forgotten in
the last commit.
|
| 1.5.6.3 |
| 10-Jun-2005 |
tron | Pull up revision 1.8 (requested by elad in ticket #389):
Minor cleanups, KNF, error handling consistency.
|
| 1.5.6.2 |
| 10-Jun-2005 |
tron | Pull up revision 1.7 (requested by elad in ticket #389):
Make this compile again after the latest overhaul.
Use -I${.CURDIR} instead of -I. to support placement of objects elsewhere.
Make sure arguments to ctype functions are unsigned char by changing the
type of one function argument.
Fix "local declaration shadows global" warnings by renaming variables.
Fix printing of size_t variable to use %zu format instead of %u.
|
| 1.5.6.1 |
| 10-Jun-2005 |
tron | Pull up revision 1.6 (requested by elad in ticket #389):
Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
fingerprints.
* Fingerprint methods handling has been made more flexible, it is now
even simpler to add new methods.
* the loader no longer passes in magic numbers representing the
fingerprint method so veriexecctl is not longer kernel specific.
* fingerprint methods can be tailored out using options in the kernel
config file.
* more fingerprint methods added - rmd160, sha256/384/512
* veriexecctl can now report the fingerprint methods supported by the
running kernel.
* regularised the naming of some portions of veriexec.
|
| 1.29.2.2 |
| 23-Mar-2008 |
matt | sync with HEAD
|
| 1.29.2.1 |
| 06-Nov-2007 |
matt | sync with HEAD
|
| 1.30.2.1 |
| 18-Feb-2008 |
mjf | Sync with HEAD.
|
| 1.31.8.1 |
| 18-Sep-2008 |
wrstuden | Sync with wrstuden-revivesa-base-2.
|
| 1.31.4.1 |
| 28-Sep-2008 |
mjf | Sync with HEAD.
|
| 1.33.4.1 |
| 13-May-2009 |
jym | Sync with HEAD.
Third (and last) commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html
|
| 1.35.8.1 |
| 20-Aug-2014 |
tls | Rebase to HEAD as of a few days ago.
|
| 1.35.2.1 |
| 22-May-2014 |
yamt | sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
|
| 1.36.2.1 |
| 10-Aug-2014 |
tls | Rebase.
|
| 1.37.2.1 |
| 19-May-2015 |
snj | Pull up following revision(s) (requested by maxv in ticket #764):
sbin/veriexecctl/veriexecctl.c: revision 1.38
share/man/man9/veriexec.9: revision 1.10
sys/conf/files: revision 1.1128
sys/dev/verified_exec.c: revisions 1.70, 1.71
sys/kern/kern_veriexec.c: revisions 1.1-1.8
sys/kern/kern_verifiedexec.c: delete
Rename kern_verifiedexec.c to kern_veriexec.c. "Veriexec" is the name of
the subsystem, not "Verifiedexec".
The revisions of kern_verifiedexec.c are now in Attic/.
No change between kern_verifiedexec.c and kern_veriexec.c.
Also, update the man page accordingly.
Okayed by christos@ and blymn@ some months ago.
--
KNF
--
Don't mix veriexec lock and file lock in veriexec_file_verify().
Now:
- 'veriexec_op_lock' needs to be held when calling veriexec_file_verify()
- the 'file_lock_state' argument indicates if the file is locked
- add some KASSERTs
--
Instead of duplicating code, add veriexec_fp_status(). Also reorder a
useless goto.
--
Make veriexec_renamechk() more readable. Also add a KASSERT on vte_count.
No real functional change
--
If we already have an entry for the file being loaded, return EEXIST, don't
silently skip it.
--
Remove FreeBSD.
ok elad@
--
KASSERT x then y, not (x && y).
--
KNF
--
Not to add even more confusion in an already overcomplicated subsystem,
remove the FreeBSD code. This code is likely to be outdated, and Veriexec
is in all cases not available on FreeBSD.
--
Be a bit more verbose if the kernel rejects a file
|
| 1.39.2.1 |
| 20-Mar-2017 |
pgoyette | Sync with HEAD
|
