veriexecctl.c revision 1.27
1 /* $NetBSD: veriexecctl.c,v 1.27 2007/05/15 19:47:46 elad Exp $ */ 2 3 /*- 4 * Copyright 2005 Elad Efrat <elad (at) NetBSD.org> 5 * Copyright 2005 Brett Lymn <blymn (at) netbsd.org> 6 * 7 * All rights reserved. 8 * 9 * This code has been donated to The NetBSD Foundation by the Author. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. The name of the author may not be used to endorse or promote products 17 * derived from this software withough specific prior written permission 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 * 30 * 31 */ 32 33 #include <sys/param.h> 34 #include <sys/statvfs.h> 35 #include <sys/verified_exec.h> 36 37 #include <stdio.h> 38 #include <stdlib.h> 39 #include <string.h> 40 #include <fcntl.h> 41 #include <unistd.h> 42 #include <err.h> 43 #include <errno.h> 44 45 #include <prop/proplib.h> 46 47 #include "veriexecctl.h" 48 49 #define VERIEXEC_DEVICE "/dev/veriexec" 50 51 #define STATUS_STRING(status) ((status) == FINGERPRINT_NOTEVAL ? \ 52 "not evaluated" : \ 53 (status) == FINGERPRINT_VALID ? \ 54 "valid" : \ 55 (status) == FINGERPRINT_NOMATCH ? \ 56 "mismatch" : \ 57 "<unknown>") 58 59 extern int yyparse(void); 60 61 int gfd, verbose = 0, error = EXIT_SUCCESS; 62 size_t line = 0; 63 64 static void 65 usage(void) 66 { 67 const char *progname = getprogname(); 68 69 (void)fprintf(stderr, "Usage:\n" 70 "%s [-ekv] load <signature_file>\n" 71 "%s delete <file | mount_point>\n" 72 "%s query <file>\n" 73 "%s dump\n" 74 "%s flush\n", progname, progname, progname, progname, progname); 75 76 exit(1); 77 } 78 79 static void 80 flags2str(uint8_t flags, char *buf, size_t len) 81 { 82 uint8_t all; 83 84 all = (VERIEXEC_DIRECT | VERIEXEC_INDIRECT | VERIEXEC_FILE | 85 VERIEXEC_UNTRUSTED); 86 if (flags & ~all) { 87 if (verbose) 88 warnx("Contaminated flags `0x%x'", (flags & ~all)); 89 return; 90 } 91 92 while (flags) { 93 if (*buf) 94 strlcat(buf, ", ", len); 95 96 if (flags & VERIEXEC_DIRECT) { 97 strlcat(buf, "direct", len); 98 flags &= ~VERIEXEC_DIRECT; 99 continue; 100 } 101 if (flags & VERIEXEC_INDIRECT) { 102 strlcat(buf, "indirect", len); 103 flags &= ~VERIEXEC_INDIRECT; 104 continue; 105 } 106 if (flags & VERIEXEC_FILE) { 107 strlcat(buf, "file", len); 108 flags &= ~VERIEXEC_FILE; 109 continue; 110 } 111 if (flags & VERIEXEC_UNTRUSTED) { 112 strlcat(buf, "untrusted", len); 113 flags &= ~VERIEXEC_UNTRUSTED; 114 continue; 115 } 116 } 117 } 118 119 static void 120 print_query(prop_dictionary_t qp, char *file) 121 { 122 struct statvfs sv; 123 const char *v; 124 int i; 125 uint8_t u8; 126 char buf[64]; 127 128 if (statvfs(file, &sv) != 0) 129 err(1, "Can't statvfs() `%s'\n", file); 130 131 printf("Filename: %s\n", file); 132 printf("Mount: %s\n", sv.f_mntonname); 133 prop_dictionary_get_uint8(qp, "entry-type", &u8); 134 memset(buf, 0, sizeof(buf)); 135 flags2str(u8, buf, sizeof(buf)); 136 printf("Entry flags: %s\n", buf); 137 prop_dictionary_get_uint8(qp, "status", &u8); 138 printf("Entry status: %s\n", STATUS_STRING(u8)); 139 printf("Fingerprint algorithm: %s\n", dict_gets(qp, "fp-type")); 140 printf("Fingerprint: "); 141 v = dict_getd(qp, "fp"); 142 for (i = 0; i < prop_data_size(prop_dictionary_get(qp, "fp")); i++) 143 printf("%02x", v[i] & 0xff); 144 printf("\n"); 145 } 146 147 static char * 148 escape(const char *s) 149 { 150 char *q, *p; 151 size_t len; 152 153 len = strlen(s); 154 if (len >= MAXPATHLEN) 155 return (NULL); 156 157 len *= 2; 158 q = p = calloc(1, len + 1); 159 160 while (*s) { 161 if (*s == ' ' || *s == '\t') 162 *p++ = '\\'; 163 164 *p++ = *s++; 165 } 166 167 return (q); 168 } 169 170 static void 171 print_entry(prop_dictionary_t entry) 172 { 173 char *file, *fp; 174 const uint8_t *v; 175 size_t len, i; 176 uint8_t u8; 177 char flags[64]; 178 179 /* Get fingerprint in ASCII. */ 180 len = prop_data_size(prop_dictionary_get(entry, "fp")); 181 len *= 2; 182 fp = calloc(1, len + 1); 183 v = dict_getd(entry, "fp"); 184 for (i = 0; i < len; i++) 185 snprintf(fp, len + 1, "%s%02x", fp, v[i] & 0xff); 186 187 /* Get flags. */ 188 memset(flags, 0, sizeof(flags)); 189 prop_dictionary_get_uint8(entry, "entry-type", &u8); 190 flags2str(u8, flags, sizeof(flags)); 191 192 file = escape(dict_gets(entry, "file")); 193 printf("%s %s %s %s\n", file, dict_gets(entry, "fp-type"), fp, flags); 194 free(file); 195 } 196 197 int 198 main(int argc, char **argv) 199 { 200 extern boolean_t keep_filename, eval_on_load; 201 int c; 202 203 setprogname(argv[0]); 204 205 while ((c = getopt(argc, argv, "ekv")) != -1) 206 switch (c) { 207 case 'e': 208 eval_on_load = TRUE; 209 break; 210 211 case 'k': 212 keep_filename = TRUE; 213 break; 214 215 case 'v': 216 verbose = 1; 217 break; 218 219 default: 220 usage(); 221 } 222 223 argc -= optind; 224 argv += optind; 225 226 if ((gfd = open(VERIEXEC_DEVICE, O_RDWR, 0)) == -1) 227 err(1, "Cannot open `%s'", VERIEXEC_DEVICE); 228 229 /* 230 * Handle the different commands we can do. 231 */ 232 if (argc == 2 && strcasecmp(argv[0], "load") == 0) { 233 extern FILE *yyin; 234 int lfd; 235 236 lfd = open(argv[1], O_RDONLY|O_EXLOCK, 0); 237 if (lfd == -1) 238 err(1, "Cannot open `%s'", argv[1]); 239 240 yyin = fdopen(lfd, "r"); 241 242 yyparse(); 243 244 (void)fclose(yyin); 245 } else if (argc == 2 && strcasecmp(argv[0], "delete") == 0) { 246 prop_dictionary_t dp; 247 struct stat sb; 248 249 if (stat(argv[1], &sb) == -1) 250 err(1, "Can't stat `%s'", argv[1]); 251 252 dp = prop_dictionary_create(); 253 dict_sets(dp, "file", argv[1]); 254 255 /* 256 * If it's a regular file, remove it. If it's a directory, 257 * remove the entire table. If it's neither, abort. 258 */ 259 if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode)) 260 errx(1, "`%s' is not a regular file or directory.", 261 argv[1]); 262 263 if (prop_dictionary_send_ioctl(dp, gfd, VERIEXEC_DELETE) != 0) 264 err(1, "Error deleting `%s'", argv[1]); 265 266 prop_object_release(dp); 267 } else if (argc == 2 && strcasecmp(argv[0], "query") == 0) { 268 prop_dictionary_t qp, rqp; 269 int r; 270 271 qp = prop_dictionary_create(); 272 273 dict_sets(qp, "file", argv[1]); 274 275 r = prop_dictionary_sendrecv_ioctl(qp, gfd, VERIEXEC_QUERY, 276 &rqp); 277 if (r) { 278 if (r == ENOENT) 279 errx(1, "No Veriexec entry for `%s'", argv[1]); 280 281 err(1, "Error querying `%s'", argv[1]); 282 } 283 284 if (rqp != NULL) { 285 print_query(rqp, argv[1]); 286 prop_object_release(rqp); 287 } 288 289 prop_object_release(qp); 290 } else if (argc == 1 && strcasecmp(argv[0], "dump") == 0) { 291 prop_array_t entries; 292 size_t nentries, i; 293 294 if (prop_array_recv_ioctl(gfd, VERIEXEC_DUMP, 295 &entries) == -1) 296 err(1, "Error dumping tables"); 297 298 nentries = prop_array_count(entries); 299 for (i = 0; i < nentries; i++) 300 print_entry(prop_array_get(entries, i)); 301 302 prop_object_release(entries); 303 } else if (argc == 1 && strcasecmp(argv[0], "flush") == 0) { 304 if (ioctl(gfd, VERIEXEC_FLUSH) == -1) 305 err(1, "Cannot flush Veriexec database"); 306 } else 307 usage(); 308 309 (void)close(gfd); 310 return error; 311 } 312
Indexes created Thu Oct 02 10:09:58 GMT 2025