kern_veriexec.c revision 1.18.2.2
1 1.18.2.2 jdolecek /* $NetBSD: kern_veriexec.c,v 1.18.2.2 2017/12/03 11:38:45 jdolecek Exp $ */ 2 1.18.2.2 jdolecek 3 1.18.2.2 jdolecek /*- 4 1.18.2.2 jdolecek * Copyright (c) 2005, 2006 Elad Efrat <elad (at) NetBSD.org> 5 1.18.2.2 jdolecek * Copyright (c) 2005, 2006 Brett Lymn <blymn (at) NetBSD.org> 6 1.18.2.2 jdolecek * All rights reserved. 7 1.18.2.2 jdolecek * 8 1.18.2.2 jdolecek * Redistribution and use in source and binary forms, with or without 9 1.18.2.2 jdolecek * modification, are permitted provided that the following conditions 10 1.18.2.2 jdolecek * are met: 11 1.18.2.2 jdolecek * 1. Redistributions of source code must retain the above copyright 12 1.18.2.2 jdolecek * notice, this list of conditions and the following disclaimer. 13 1.18.2.2 jdolecek * 2. Redistributions in binary form must reproduce the above copyright 14 1.18.2.2 jdolecek * notice, this list of conditions and the following disclaimer in the 15 1.18.2.2 jdolecek * documentation and/or other materials provided with the distribution. 16 1.18.2.2 jdolecek * 3. The name of the authors may not be used to endorse or promote products 17 1.18.2.2 jdolecek * derived from this software without specific prior written permission. 18 1.18.2.2 jdolecek * 19 1.18.2.2 jdolecek * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR 20 1.18.2.2 jdolecek * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 1.18.2.2 jdolecek * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 1.18.2.2 jdolecek * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 1.18.2.2 jdolecek * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 1.18.2.2 jdolecek * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 1.18.2.2 jdolecek * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 1.18.2.2 jdolecek * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 1.18.2.2 jdolecek * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 1.18.2.2 jdolecek * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 1.18.2.2 jdolecek */ 30 1.18.2.2 jdolecek 31 1.18.2.2 jdolecek #include <sys/cdefs.h> 32 1.18.2.2 jdolecek __KERNEL_RCSID(0, "$NetBSD: kern_veriexec.c,v 1.18.2.2 2017/12/03 11:38:45 jdolecek Exp $"); 33 1.18.2.2 jdolecek 34 1.18.2.2 jdolecek #include "opt_veriexec.h" 35 1.18.2.2 jdolecek 36 1.18.2.2 jdolecek #include <sys/param.h> 37 1.18.2.2 jdolecek #include <sys/mount.h> 38 1.18.2.2 jdolecek #include <sys/kmem.h> 39 1.18.2.2 jdolecek #include <sys/vnode.h> 40 1.18.2.2 jdolecek #include <sys/namei.h> 41 1.18.2.2 jdolecek #include <sys/once.h> 42 1.18.2.2 jdolecek #include <sys/proc.h> 43 1.18.2.2 jdolecek #include <sys/rwlock.h> 44 1.18.2.2 jdolecek #include <sys/syslog.h> 45 1.18.2.2 jdolecek #include <sys/sysctl.h> 46 1.18.2.2 jdolecek #include <sys/inttypes.h> 47 1.18.2.2 jdolecek #include <sys/verified_exec.h> 48 1.18.2.2 jdolecek #include <sys/sha1.h> 49 1.18.2.2 jdolecek #include <sys/sha2.h> 50 1.18.2.2 jdolecek #include <sys/rmd160.h> 51 1.18.2.2 jdolecek #include <sys/md5.h> 52 1.18.2.2 jdolecek #include <sys/fileassoc.h> 53 1.18.2.2 jdolecek #include <sys/kauth.h> 54 1.18.2.2 jdolecek #include <sys/conf.h> 55 1.18.2.2 jdolecek #include <miscfs/specfs/specdev.h> 56 1.18.2.2 jdolecek #include <prop/proplib.h> 57 1.18.2.2 jdolecek #include <sys/fcntl.h> 58 1.18.2.2 jdolecek 59 1.18.2.2 jdolecek /* Readable values for veriexec_file_report(). */ 60 1.18.2.2 jdolecek #define REPORT_ALWAYS 0x01 /* Always print */ 61 1.18.2.2 jdolecek #define REPORT_VERBOSE 0x02 /* Print when verbose >= 1 */ 62 1.18.2.2 jdolecek #define REPORT_DEBUG 0x04 /* Print when verbose >= 2 (debug) */ 63 1.18.2.2 jdolecek #define REPORT_PANIC 0x08 /* Call panic() */ 64 1.18.2.2 jdolecek #define REPORT_ALARM 0x10 /* Alarm - also print pid/uid/.. */ 65 1.18.2.2 jdolecek #define REPORT_LOGMASK (REPORT_ALWAYS|REPORT_VERBOSE|REPORT_DEBUG) 66 1.18.2.2 jdolecek 67 1.18.2.2 jdolecek /* state of locking for veriexec_file_verify */ 68 1.18.2.2 jdolecek #define VERIEXEC_UNLOCKED 0x00 /* Nothing locked, callee does it */ 69 1.18.2.2 jdolecek #define VERIEXEC_LOCKED 0x01 /* Global op lock held */ 70 1.18.2.2 jdolecek 71 1.18.2.2 jdolecek /* state of file locking for veriexec_file_verify */ 72 1.18.2.2 jdolecek #define VERIEXEC_FILE_UNLOCKED 0x02 /* Nothing locked, callee does it */ 73 1.18.2.2 jdolecek #define VERIEXEC_FILE_LOCKED 0x04 /* File locked */ 74 1.18.2.2 jdolecek 75 1.18.2.2 jdolecek #define VERIEXEC_RW_UPGRADE(lock) while((rw_tryupgrade(lock)) == 0){}; 76 1.18.2.2 jdolecek 77 1.18.2.2 jdolecek struct veriexec_fpops { 78 1.18.2.2 jdolecek const char *type; 79 1.18.2.2 jdolecek size_t hash_len; 80 1.18.2.2 jdolecek size_t context_size; 81 1.18.2.2 jdolecek veriexec_fpop_init_t init; 82 1.18.2.2 jdolecek veriexec_fpop_update_t update; 83 1.18.2.2 jdolecek veriexec_fpop_final_t final; 84 1.18.2.2 jdolecek LIST_ENTRY(veriexec_fpops) entries; 85 1.18.2.2 jdolecek }; 86 1.18.2.2 jdolecek 87 1.18.2.2 jdolecek /* Veriexec per-file entry data. */ 88 1.18.2.2 jdolecek struct veriexec_file_entry { 89 1.18.2.2 jdolecek krwlock_t lock; /* r/w lock */ 90 1.18.2.2 jdolecek u_char *filename; /* File name. */ 91 1.18.2.2 jdolecek u_char type; /* Entry type. */ 92 1.18.2.2 jdolecek u_char status; /* Evaluation status. */ 93 1.18.2.2 jdolecek u_char *fp; /* Fingerprint. */ 94 1.18.2.2 jdolecek struct veriexec_fpops *ops; /* Fingerprint ops vector*/ 95 1.18.2.2 jdolecek size_t filename_len; /* Length of filename. */ 96 1.18.2.2 jdolecek }; 97 1.18.2.2 jdolecek 98 1.18.2.2 jdolecek /* Veriexec per-table data. */ 99 1.18.2.2 jdolecek struct veriexec_table_entry { 100 1.18.2.2 jdolecek uint64_t vte_count; /* Number of Veriexec entries. */ 101 1.18.2.2 jdolecek const struct sysctlnode *vte_node; 102 1.18.2.2 jdolecek }; 103 1.18.2.2 jdolecek 104 1.18.2.2 jdolecek static int veriexec_verbose; 105 1.18.2.2 jdolecek static int veriexec_strict; 106 1.18.2.2 jdolecek static int veriexec_bypass = 1; 107 1.18.2.2 jdolecek 108 1.18.2.2 jdolecek static char *veriexec_fp_names = NULL; 109 1.18.2.2 jdolecek static size_t veriexec_name_max = 0; 110 1.18.2.2 jdolecek 111 1.18.2.2 jdolecek static const struct sysctlnode *veriexec_count_node; 112 1.18.2.2 jdolecek 113 1.18.2.2 jdolecek static fileassoc_t veriexec_hook; 114 1.18.2.2 jdolecek static specificdata_key_t veriexec_mountspecific_key; 115 1.18.2.2 jdolecek 116 1.18.2.2 jdolecek static LIST_HEAD(, veriexec_fpops) veriexec_fpops_list = 117 1.18.2.2 jdolecek LIST_HEAD_INITIALIZER(veriexec_fpops_list); 118 1.18.2.2 jdolecek 119 1.18.2.2 jdolecek static int veriexec_raw_cb(kauth_cred_t, kauth_action_t, void *, 120 1.18.2.2 jdolecek void *, void *, void *, void *); 121 1.18.2.2 jdolecek static struct veriexec_fpops *veriexec_fpops_lookup(const char *); 122 1.18.2.2 jdolecek static void veriexec_file_free(struct veriexec_file_entry *); 123 1.18.2.2 jdolecek 124 1.18.2.2 jdolecek static unsigned int veriexec_tablecount = 0; 125 1.18.2.2 jdolecek 126 1.18.2.2 jdolecek /* 127 1.18.2.2 jdolecek * Veriexec operations global lock - most ops hold this as a read 128 1.18.2.2 jdolecek * lock, it is upgraded to a write lock when destroying veriexec file 129 1.18.2.2 jdolecek * table entries. 130 1.18.2.2 jdolecek */ 131 1.18.2.2 jdolecek static krwlock_t veriexec_op_lock; 132 1.18.2.2 jdolecek 133 1.18.2.2 jdolecek /* 134 1.18.2.2 jdolecek * Sysctl helper routine for Veriexec. 135 1.18.2.2 jdolecek */ 136 1.18.2.2 jdolecek static int 137 1.18.2.2 jdolecek sysctl_kern_veriexec_algorithms(SYSCTLFN_ARGS) 138 1.18.2.2 jdolecek { 139 1.18.2.2 jdolecek size_t len; 140 1.18.2.2 jdolecek int error; 141 1.18.2.2 jdolecek const char *p; 142 1.18.2.2 jdolecek 143 1.18.2.2 jdolecek if (newp != NULL) 144 1.18.2.2 jdolecek return EPERM; 145 1.18.2.2 jdolecek 146 1.18.2.2 jdolecek if (namelen != 0) 147 1.18.2.2 jdolecek return EINVAL; 148 1.18.2.2 jdolecek 149 1.18.2.2 jdolecek p = veriexec_fp_names == NULL ? "" : veriexec_fp_names; 150 1.18.2.2 jdolecek 151 1.18.2.2 jdolecek len = strlen(p) + 1; 152 1.18.2.2 jdolecek 153 1.18.2.2 jdolecek if (*oldlenp < len && oldp) 154 1.18.2.2 jdolecek return ENOMEM; 155 1.18.2.2 jdolecek 156 1.18.2.2 jdolecek if (oldp && (error = copyout(p, oldp, len)) != 0) 157 1.18.2.2 jdolecek return error; 158 1.18.2.2 jdolecek 159 1.18.2.2 jdolecek *oldlenp = len; 160 1.18.2.2 jdolecek return 0; 161 1.18.2.2 jdolecek } 162 1.18.2.2 jdolecek 163 1.18.2.2 jdolecek static int 164 1.18.2.2 jdolecek sysctl_kern_veriexec_strict(SYSCTLFN_ARGS) 165 1.18.2.2 jdolecek { 166 1.18.2.2 jdolecek struct sysctlnode node; 167 1.18.2.2 jdolecek int error, newval; 168 1.18.2.2 jdolecek 169 1.18.2.2 jdolecek node = *rnode; 170 1.18.2.2 jdolecek node.sysctl_data = &newval; 171 1.18.2.2 jdolecek 172 1.18.2.2 jdolecek newval = veriexec_strict; 173 1.18.2.2 jdolecek error = sysctl_lookup(SYSCTLFN_CALL(&node)); 174 1.18.2.2 jdolecek if (error || newp == NULL) 175 1.18.2.2 jdolecek return error; 176 1.18.2.2 jdolecek 177 1.18.2.2 jdolecek if (newval < veriexec_strict) 178 1.18.2.2 jdolecek return EPERM; 179 1.18.2.2 jdolecek 180 1.18.2.2 jdolecek veriexec_strict = newval; 181 1.18.2.2 jdolecek 182 1.18.2.2 jdolecek return 0; 183 1.18.2.2 jdolecek } 184 1.18.2.2 jdolecek 185 1.18.2.2 jdolecek SYSCTL_SETUP(sysctl_kern_veriexec_setup, "sysctl kern.veriexec setup") 186 1.18.2.2 jdolecek { 187 1.18.2.2 jdolecek const struct sysctlnode *rnode = NULL; 188 1.18.2.2 jdolecek 189 1.18.2.2 jdolecek sysctl_createv(clog, 0, NULL, &rnode, 190 1.18.2.2 jdolecek CTLFLAG_PERMANENT, 191 1.18.2.2 jdolecek CTLTYPE_NODE, "veriexec", 192 1.18.2.2 jdolecek SYSCTL_DESCR("Veriexec"), 193 1.18.2.2 jdolecek NULL, 0, NULL, 0, 194 1.18.2.2 jdolecek CTL_KERN, CTL_CREATE, CTL_EOL); 195 1.18.2.2 jdolecek 196 1.18.2.2 jdolecek sysctl_createv(clog, 0, &rnode, NULL, 197 1.18.2.2 jdolecek CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 198 1.18.2.2 jdolecek CTLTYPE_INT, "verbose", 199 1.18.2.2 jdolecek SYSCTL_DESCR("Veriexec verbose level"), 200 1.18.2.2 jdolecek NULL, 0, &veriexec_verbose, 0, 201 1.18.2.2 jdolecek CTL_CREATE, CTL_EOL); 202 1.18.2.2 jdolecek sysctl_createv(clog, 0, &rnode, NULL, 203 1.18.2.2 jdolecek CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 204 1.18.2.2 jdolecek CTLTYPE_INT, "strict", 205 1.18.2.2 jdolecek SYSCTL_DESCR("Veriexec strict level"), 206 1.18.2.2 jdolecek sysctl_kern_veriexec_strict, 0, NULL, 0, 207 1.18.2.2 jdolecek CTL_CREATE, CTL_EOL); 208 1.18.2.2 jdolecek sysctl_createv(clog, 0, &rnode, NULL, 209 1.18.2.2 jdolecek CTLFLAG_PERMANENT, 210 1.18.2.2 jdolecek CTLTYPE_STRING, "algorithms", 211 1.18.2.2 jdolecek SYSCTL_DESCR("Veriexec supported hashing " 212 1.18.2.2 jdolecek "algorithms"), 213 1.18.2.2 jdolecek sysctl_kern_veriexec_algorithms, 0, NULL, 0, 214 1.18.2.2 jdolecek CTL_CREATE, CTL_EOL); 215 1.18.2.2 jdolecek sysctl_createv(clog, 0, &rnode, &veriexec_count_node, 216 1.18.2.2 jdolecek CTLFLAG_PERMANENT, 217 1.18.2.2 jdolecek CTLTYPE_NODE, "count", 218 1.18.2.2 jdolecek SYSCTL_DESCR("Number of fingerprints on mount(s)"), 219 1.18.2.2 jdolecek NULL, 0, NULL, 0, 220 1.18.2.2 jdolecek CTL_CREATE, CTL_EOL); 221 1.18.2.2 jdolecek } 222 1.18.2.2 jdolecek 223 1.18.2.2 jdolecek /* 224 1.18.2.2 jdolecek * Add ops to the fingerprint ops vector list. 225 1.18.2.2 jdolecek */ 226 1.18.2.2 jdolecek int 227 1.18.2.2 jdolecek veriexec_fpops_add(const char *fp_type, size_t hash_len, size_t ctx_size, 228 1.18.2.2 jdolecek veriexec_fpop_init_t init, veriexec_fpop_update_t update, 229 1.18.2.2 jdolecek veriexec_fpop_final_t final) 230 1.18.2.2 jdolecek { 231 1.18.2.2 jdolecek struct veriexec_fpops *ops; 232 1.18.2.2 jdolecek 233 1.18.2.2 jdolecek KASSERT((init != NULL) && (update != NULL) && (final != NULL)); 234 1.18.2.2 jdolecek KASSERT((hash_len != 0) && (ctx_size != 0)); 235 1.18.2.2 jdolecek KASSERT(fp_type != NULL); 236 1.18.2.2 jdolecek 237 1.18.2.2 jdolecek if (veriexec_fpops_lookup(fp_type) != NULL) 238 1.18.2.2 jdolecek return (EEXIST); 239 1.18.2.2 jdolecek 240 1.18.2.2 jdolecek ops = kmem_alloc(sizeof(*ops), KM_SLEEP); 241 1.18.2.2 jdolecek ops->type = fp_type; 242 1.18.2.2 jdolecek ops->hash_len = hash_len; 243 1.18.2.2 jdolecek ops->context_size = ctx_size; 244 1.18.2.2 jdolecek ops->init = init; 245 1.18.2.2 jdolecek ops->update = update; 246 1.18.2.2 jdolecek ops->final = final; 247 1.18.2.2 jdolecek 248 1.18.2.2 jdolecek LIST_INSERT_HEAD(&veriexec_fpops_list, ops, entries); 249 1.18.2.2 jdolecek 250 1.18.2.2 jdolecek /* 251 1.18.2.2 jdolecek * If we don't have space for any names, allocate enough for six 252 1.18.2.2 jdolecek * which should be sufficient. (it's also enough for all algorithms 253 1.18.2.2 jdolecek * we can support at the moment) 254 1.18.2.2 jdolecek */ 255 1.18.2.2 jdolecek if (veriexec_fp_names == NULL) { 256 1.18.2.2 jdolecek veriexec_name_max = 64; 257 1.18.2.2 jdolecek veriexec_fp_names = kmem_zalloc(veriexec_name_max, KM_SLEEP); 258 1.18.2.2 jdolecek } 259 1.18.2.2 jdolecek 260 1.18.2.2 jdolecek /* 261 1.18.2.2 jdolecek * If we're running out of space for storing supported algorithms, 262 1.18.2.2 jdolecek * extend the buffer with space for four names. 263 1.18.2.2 jdolecek */ 264 1.18.2.2 jdolecek while (veriexec_name_max - (strlen(veriexec_fp_names) + 1) < 265 1.18.2.2 jdolecek strlen(fp_type)) { 266 1.18.2.2 jdolecek char *newp; 267 1.18.2.2 jdolecek unsigned int new_max; 268 1.18.2.2 jdolecek 269 1.18.2.2 jdolecek /* Add space for four algorithm names. */ 270 1.18.2.2 jdolecek new_max = veriexec_name_max + 64; 271 1.18.2.2 jdolecek newp = kmem_zalloc(new_max, KM_SLEEP); 272 1.18.2.2 jdolecek strlcpy(newp, veriexec_fp_names, new_max); 273 1.18.2.2 jdolecek kmem_free(veriexec_fp_names, veriexec_name_max); 274 1.18.2.2 jdolecek veriexec_fp_names = newp; 275 1.18.2.2 jdolecek veriexec_name_max = new_max; 276 1.18.2.2 jdolecek } 277 1.18.2.2 jdolecek 278 1.18.2.2 jdolecek if (*veriexec_fp_names != '\0') 279 1.18.2.2 jdolecek strlcat(veriexec_fp_names, " ", veriexec_name_max); 280 1.18.2.2 jdolecek 281 1.18.2.2 jdolecek strlcat(veriexec_fp_names, fp_type, veriexec_name_max); 282 1.18.2.2 jdolecek 283 1.18.2.2 jdolecek return (0); 284 1.18.2.2 jdolecek } 285 1.18.2.2 jdolecek 286 1.18.2.2 jdolecek static void 287 1.18.2.2 jdolecek veriexec_mountspecific_dtor(void *v) 288 1.18.2.2 jdolecek { 289 1.18.2.2 jdolecek struct veriexec_table_entry *vte = v; 290 1.18.2.2 jdolecek 291 1.18.2.2 jdolecek if (vte == NULL) { 292 1.18.2.2 jdolecek return; 293 1.18.2.2 jdolecek } 294 1.18.2.2 jdolecek sysctl_free(__UNCONST(vte->vte_node)); 295 1.18.2.2 jdolecek veriexec_tablecount--; 296 1.18.2.2 jdolecek kmem_free(vte, sizeof(*vte)); 297 1.18.2.2 jdolecek } 298 1.18.2.2 jdolecek 299 1.18.2.2 jdolecek static int 300 1.18.2.2 jdolecek veriexec_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 301 1.18.2.2 jdolecek void *arg0, void *arg1, void *arg2, void *arg3) 302 1.18.2.2 jdolecek { 303 1.18.2.2 jdolecek int result; 304 1.18.2.2 jdolecek enum kauth_system_req req; 305 1.18.2.2 jdolecek 306 1.18.2.2 jdolecek if (action != KAUTH_SYSTEM_VERIEXEC) 307 1.18.2.2 jdolecek return KAUTH_RESULT_DEFER; 308 1.18.2.2 jdolecek 309 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 310 1.18.2.2 jdolecek req = (enum kauth_system_req)arg0; 311 1.18.2.2 jdolecek 312 1.18.2.2 jdolecek if (req == KAUTH_REQ_SYSTEM_VERIEXEC_MODIFY && 313 1.18.2.2 jdolecek veriexec_strict > VERIEXEC_LEARNING) { 314 1.18.2.2 jdolecek log(LOG_WARNING, "Veriexec: Strict mode, modifying " 315 1.18.2.2 jdolecek "tables not permitted.\n"); 316 1.18.2.2 jdolecek 317 1.18.2.2 jdolecek result = KAUTH_RESULT_DENY; 318 1.18.2.2 jdolecek } 319 1.18.2.2 jdolecek 320 1.18.2.2 jdolecek return result; 321 1.18.2.2 jdolecek } 322 1.18.2.2 jdolecek 323 1.18.2.2 jdolecek /* 324 1.18.2.2 jdolecek * Initialise Veriexec. 325 1.18.2.2 jdolecek */ 326 1.18.2.2 jdolecek void 327 1.18.2.2 jdolecek veriexec_init(void) 328 1.18.2.2 jdolecek { 329 1.18.2.2 jdolecek int error; 330 1.18.2.2 jdolecek 331 1.18.2.2 jdolecek /* Register a fileassoc for Veriexec. */ 332 1.18.2.2 jdolecek error = fileassoc_register("veriexec", 333 1.18.2.2 jdolecek (fileassoc_cleanup_cb_t)veriexec_file_free, &veriexec_hook); 334 1.18.2.2 jdolecek if (error) 335 1.18.2.2 jdolecek panic("Veriexec: Can't register fileassoc: error=%d", error); 336 1.18.2.2 jdolecek 337 1.18.2.2 jdolecek /* Register listener to handle raw disk access. */ 338 1.18.2.2 jdolecek if (kauth_listen_scope(KAUTH_SCOPE_DEVICE, veriexec_raw_cb, NULL) == 339 1.18.2.2 jdolecek NULL) 340 1.18.2.2 jdolecek panic("Veriexec: Can't listen on device scope"); 341 1.18.2.2 jdolecek 342 1.18.2.2 jdolecek error = mount_specific_key_create(&veriexec_mountspecific_key, 343 1.18.2.2 jdolecek veriexec_mountspecific_dtor); 344 1.18.2.2 jdolecek if (error) 345 1.18.2.2 jdolecek panic("Veriexec: Can't create mountspecific key"); 346 1.18.2.2 jdolecek 347 1.18.2.2 jdolecek if (kauth_listen_scope(KAUTH_SCOPE_SYSTEM, veriexec_listener_cb, 348 1.18.2.2 jdolecek NULL) == NULL) 349 1.18.2.2 jdolecek panic("Veriexec: Can't listen on system scope"); 350 1.18.2.2 jdolecek 351 1.18.2.2 jdolecek rw_init(&veriexec_op_lock); 352 1.18.2.2 jdolecek 353 1.18.2.2 jdolecek #define FPOPS_ADD(a, b, c, d, e, f) \ 354 1.18.2.2 jdolecek veriexec_fpops_add(a, b, c, (veriexec_fpop_init_t)d, \ 355 1.18.2.2 jdolecek (veriexec_fpop_update_t)e, (veriexec_fpop_final_t)f) 356 1.18.2.2 jdolecek 357 1.18.2.2 jdolecek #ifdef VERIFIED_EXEC_FP_SHA256 358 1.18.2.2 jdolecek FPOPS_ADD("SHA256", SHA256_DIGEST_LENGTH, sizeof(SHA256_CTX), 359 1.18.2.2 jdolecek SHA256_Init, SHA256_Update, SHA256_Final); 360 1.18.2.2 jdolecek #endif /* VERIFIED_EXEC_FP_SHA256 */ 361 1.18.2.2 jdolecek 362 1.18.2.2 jdolecek #ifdef VERIFIED_EXEC_FP_SHA384 363 1.18.2.2 jdolecek FPOPS_ADD("SHA384", SHA384_DIGEST_LENGTH, sizeof(SHA384_CTX), 364 1.18.2.2 jdolecek SHA384_Init, SHA384_Update, SHA384_Final); 365 1.18.2.2 jdolecek #endif /* VERIFIED_EXEC_FP_SHA384 */ 366 1.18.2.2 jdolecek 367 1.18.2.2 jdolecek #ifdef VERIFIED_EXEC_FP_SHA512 368 1.18.2.2 jdolecek FPOPS_ADD("SHA512", SHA512_DIGEST_LENGTH, sizeof(SHA512_CTX), 369 1.18.2.2 jdolecek SHA512_Init, SHA512_Update, SHA512_Final); 370 1.18.2.2 jdolecek #endif /* VERIFIED_EXEC_FP_SHA512 */ 371 1.18.2.2 jdolecek 372 1.18.2.2 jdolecek #undef FPOPS_ADD 373 1.18.2.2 jdolecek } 374 1.18.2.2 jdolecek 375 1.18.2.2 jdolecek static struct veriexec_fpops * 376 1.18.2.2 jdolecek veriexec_fpops_lookup(const char *name) 377 1.18.2.2 jdolecek { 378 1.18.2.2 jdolecek struct veriexec_fpops *ops; 379 1.18.2.2 jdolecek 380 1.18.2.2 jdolecek if (name == NULL) 381 1.18.2.2 jdolecek return (NULL); 382 1.18.2.2 jdolecek 383 1.18.2.2 jdolecek LIST_FOREACH(ops, &veriexec_fpops_list, entries) { 384 1.18.2.2 jdolecek if (strcasecmp(name, ops->type) == 0) 385 1.18.2.2 jdolecek return (ops); 386 1.18.2.2 jdolecek } 387 1.18.2.2 jdolecek 388 1.18.2.2 jdolecek return (NULL); 389 1.18.2.2 jdolecek } 390 1.18.2.2 jdolecek 391 1.18.2.2 jdolecek /* 392 1.18.2.2 jdolecek * Calculate fingerprint. Information on hash length and routines used is 393 1.18.2.2 jdolecek * extracted from veriexec_hash_list according to the hash type. 394 1.18.2.2 jdolecek * 395 1.18.2.2 jdolecek * NOTE: vfe is assumed to be locked for writing on entry. 396 1.18.2.2 jdolecek */ 397 1.18.2.2 jdolecek static int 398 1.18.2.2 jdolecek veriexec_fp_calc(struct lwp *l, struct vnode *vp, int file_lock_state, 399 1.18.2.2 jdolecek struct veriexec_file_entry *vfe, u_char *fp) 400 1.18.2.2 jdolecek { 401 1.18.2.2 jdolecek struct vattr va; 402 1.18.2.2 jdolecek void *ctx; 403 1.18.2.2 jdolecek u_char *buf; 404 1.18.2.2 jdolecek off_t offset, len; 405 1.18.2.2 jdolecek size_t resid; 406 1.18.2.2 jdolecek int error; 407 1.18.2.2 jdolecek 408 1.18.2.2 jdolecek KASSERT(file_lock_state != VERIEXEC_LOCKED); 409 1.18.2.2 jdolecek KASSERT(file_lock_state != VERIEXEC_UNLOCKED); 410 1.18.2.2 jdolecek 411 1.18.2.2 jdolecek if (file_lock_state == VERIEXEC_FILE_UNLOCKED) 412 1.18.2.2 jdolecek vn_lock(vp, LK_SHARED | LK_RETRY); 413 1.18.2.2 jdolecek error = VOP_GETATTR(vp, &va, l->l_cred); 414 1.18.2.2 jdolecek if (file_lock_state == VERIEXEC_FILE_UNLOCKED) 415 1.18.2.2 jdolecek VOP_UNLOCK(vp); 416 1.18.2.2 jdolecek if (error) 417 1.18.2.2 jdolecek return (error); 418 1.18.2.2 jdolecek 419 1.18.2.2 jdolecek ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 420 1.18.2.2 jdolecek buf = kmem_alloc(PAGE_SIZE, KM_SLEEP); 421 1.18.2.2 jdolecek 422 1.18.2.2 jdolecek (vfe->ops->init)(ctx); 423 1.18.2.2 jdolecek 424 1.18.2.2 jdolecek len = 0; 425 1.18.2.2 jdolecek error = 0; 426 1.18.2.2 jdolecek for (offset = 0; offset < va.va_size; offset += PAGE_SIZE) { 427 1.18.2.2 jdolecek len = ((va.va_size - offset) < PAGE_SIZE) ? 428 1.18.2.2 jdolecek (va.va_size - offset) : PAGE_SIZE; 429 1.18.2.2 jdolecek 430 1.18.2.2 jdolecek error = vn_rdwr(UIO_READ, vp, buf, len, offset, 431 1.18.2.2 jdolecek UIO_SYSSPACE, 432 1.18.2.2 jdolecek ((file_lock_state == VERIEXEC_FILE_LOCKED)? 433 1.18.2.2 jdolecek IO_NODELOCKED : 0), 434 1.18.2.2 jdolecek l->l_cred, &resid, NULL); 435 1.18.2.2 jdolecek 436 1.18.2.2 jdolecek if (error) { 437 1.18.2.2 jdolecek goto bad; 438 1.18.2.2 jdolecek } 439 1.18.2.2 jdolecek 440 1.18.2.2 jdolecek (vfe->ops->update)(ctx, buf, (unsigned int) len); 441 1.18.2.2 jdolecek 442 1.18.2.2 jdolecek if (len != PAGE_SIZE) 443 1.18.2.2 jdolecek break; 444 1.18.2.2 jdolecek } 445 1.18.2.2 jdolecek 446 1.18.2.2 jdolecek (vfe->ops->final)(fp, ctx); 447 1.18.2.2 jdolecek 448 1.18.2.2 jdolecek bad: 449 1.18.2.2 jdolecek kmem_free(ctx, vfe->ops->context_size); 450 1.18.2.2 jdolecek kmem_free(buf, PAGE_SIZE); 451 1.18.2.2 jdolecek 452 1.18.2.2 jdolecek return (error); 453 1.18.2.2 jdolecek } 454 1.18.2.2 jdolecek 455 1.18.2.2 jdolecek /* Compare two fingerprints of the same type. */ 456 1.18.2.2 jdolecek static int 457 1.18.2.2 jdolecek veriexec_fp_cmp(struct veriexec_fpops *ops, u_char *fp1, u_char *fp2) 458 1.18.2.2 jdolecek { 459 1.18.2.2 jdolecek if (veriexec_verbose >= 2) { 460 1.18.2.2 jdolecek int i; 461 1.18.2.2 jdolecek 462 1.18.2.2 jdolecek printf("comparing hashes...\n"); 463 1.18.2.2 jdolecek printf("fp1: "); 464 1.18.2.2 jdolecek for (i = 0; i < ops->hash_len; i++) { 465 1.18.2.2 jdolecek printf("%02x", fp1[i]); 466 1.18.2.2 jdolecek } 467 1.18.2.2 jdolecek printf("\nfp2: "); 468 1.18.2.2 jdolecek for (i = 0; i < ops->hash_len; i++) { 469 1.18.2.2 jdolecek printf("%02x", fp2[i]); 470 1.18.2.2 jdolecek } 471 1.18.2.2 jdolecek printf("\n"); 472 1.18.2.2 jdolecek } 473 1.18.2.2 jdolecek 474 1.18.2.2 jdolecek return (memcmp(fp1, fp2, ops->hash_len)); 475 1.18.2.2 jdolecek } 476 1.18.2.2 jdolecek 477 1.18.2.2 jdolecek static int 478 1.18.2.2 jdolecek veriexec_fp_status(struct lwp *l, struct vnode *vp, int file_lock_state, 479 1.18.2.2 jdolecek struct veriexec_file_entry *vfe, u_char *status) 480 1.18.2.2 jdolecek { 481 1.18.2.2 jdolecek size_t hash_len = vfe->ops->hash_len; 482 1.18.2.2 jdolecek u_char *digest; 483 1.18.2.2 jdolecek int error; 484 1.18.2.2 jdolecek 485 1.18.2.2 jdolecek digest = kmem_zalloc(hash_len, KM_SLEEP); 486 1.18.2.2 jdolecek 487 1.18.2.2 jdolecek error = veriexec_fp_calc(l, vp, file_lock_state, vfe, digest); 488 1.18.2.2 jdolecek if (error) 489 1.18.2.2 jdolecek goto out; 490 1.18.2.2 jdolecek 491 1.18.2.2 jdolecek /* Compare fingerprint with loaded data. */ 492 1.18.2.2 jdolecek if (veriexec_fp_cmp(vfe->ops, vfe->fp, digest) == 0) 493 1.18.2.2 jdolecek *status = FINGERPRINT_VALID; 494 1.18.2.2 jdolecek else 495 1.18.2.2 jdolecek *status = FINGERPRINT_NOMATCH; 496 1.18.2.2 jdolecek 497 1.18.2.2 jdolecek out: 498 1.18.2.2 jdolecek kmem_free(digest, hash_len); 499 1.18.2.2 jdolecek return error; 500 1.18.2.2 jdolecek } 501 1.18.2.2 jdolecek 502 1.18.2.2 jdolecek 503 1.18.2.2 jdolecek static struct veriexec_table_entry * 504 1.18.2.2 jdolecek veriexec_table_lookup(struct mount *mp) 505 1.18.2.2 jdolecek { 506 1.18.2.2 jdolecek /* XXX: From raidframe init */ 507 1.18.2.2 jdolecek if (mp == NULL) 508 1.18.2.2 jdolecek return NULL; 509 1.18.2.2 jdolecek 510 1.18.2.2 jdolecek return mount_getspecific(mp, veriexec_mountspecific_key); 511 1.18.2.2 jdolecek } 512 1.18.2.2 jdolecek 513 1.18.2.2 jdolecek static struct veriexec_file_entry * 514 1.18.2.2 jdolecek veriexec_get(struct vnode *vp) 515 1.18.2.2 jdolecek { 516 1.18.2.2 jdolecek return (fileassoc_lookup(vp, veriexec_hook)); 517 1.18.2.2 jdolecek } 518 1.18.2.2 jdolecek 519 1.18.2.2 jdolecek bool 520 1.18.2.2 jdolecek veriexec_lookup(struct vnode *vp) 521 1.18.2.2 jdolecek { 522 1.18.2.2 jdolecek return (veriexec_get(vp) == NULL ? false : true); 523 1.18.2.2 jdolecek } 524 1.18.2.2 jdolecek 525 1.18.2.2 jdolecek /* 526 1.18.2.2 jdolecek * Routine for maintaining mostly consistent message formats in Veriexec. 527 1.18.2.2 jdolecek */ 528 1.18.2.2 jdolecek static void 529 1.18.2.2 jdolecek veriexec_file_report(struct veriexec_file_entry *vfe, const u_char *msg, 530 1.18.2.2 jdolecek const u_char *filename, struct lwp *l, int f) 531 1.18.2.2 jdolecek { 532 1.18.2.2 jdolecek if (vfe != NULL && vfe->filename != NULL) 533 1.18.2.2 jdolecek filename = vfe->filename; 534 1.18.2.2 jdolecek if (filename == NULL) 535 1.18.2.2 jdolecek return; 536 1.18.2.2 jdolecek 537 1.18.2.2 jdolecek if (((f & REPORT_LOGMASK) >> 1) <= veriexec_verbose) { 538 1.18.2.2 jdolecek if (!(f & REPORT_ALARM) || (l == NULL)) 539 1.18.2.2 jdolecek log(LOG_NOTICE, "Veriexec: %s [%s]\n", msg, 540 1.18.2.2 jdolecek filename); 541 1.18.2.2 jdolecek else 542 1.18.2.2 jdolecek log(LOG_ALERT, "Veriexec: %s [%s, prog=%s pid=%u, " 543 1.18.2.2 jdolecek "uid=%u, gid=%u]\n", msg, filename, 544 1.18.2.2 jdolecek l->l_proc->p_comm, l->l_proc->p_pid, 545 1.18.2.2 jdolecek kauth_cred_getuid(l->l_cred), 546 1.18.2.2 jdolecek kauth_cred_getgid(l->l_cred)); 547 1.18.2.2 jdolecek } 548 1.18.2.2 jdolecek 549 1.18.2.2 jdolecek if (f & REPORT_PANIC) 550 1.18.2.2 jdolecek panic("Veriexec: Unrecoverable error."); 551 1.18.2.2 jdolecek } 552 1.18.2.2 jdolecek 553 1.18.2.2 jdolecek /* 554 1.18.2.2 jdolecek * Verify the fingerprint of the given file. If we're called directly from 555 1.18.2.2 jdolecek * sys_execve(), 'flag' will be VERIEXEC_DIRECT. If we're called from 556 1.18.2.2 jdolecek * exec_script(), 'flag' will be VERIEXEC_INDIRECT. If we are called from 557 1.18.2.2 jdolecek * vn_open(), 'flag' will be VERIEXEC_FILE. 558 1.18.2.2 jdolecek * 559 1.18.2.2 jdolecek * 'veriexec_op_lock' must be locked (and remains locked). 560 1.18.2.2 jdolecek * 561 1.18.2.2 jdolecek * NOTE: The veriexec file entry pointer (vfep) will be returned LOCKED 562 1.18.2.2 jdolecek * on no error. 563 1.18.2.2 jdolecek */ 564 1.18.2.2 jdolecek static int 565 1.18.2.2 jdolecek veriexec_file_verify(struct lwp *l, struct vnode *vp, const u_char *name, 566 1.18.2.2 jdolecek int flag, int file_lock_state, struct veriexec_file_entry **vfep) 567 1.18.2.2 jdolecek { 568 1.18.2.2 jdolecek struct veriexec_file_entry *vfe; 569 1.18.2.2 jdolecek int error = 0; 570 1.18.2.2 jdolecek 571 1.18.2.2 jdolecek KASSERT(rw_lock_held(&veriexec_op_lock)); 572 1.18.2.2 jdolecek KASSERT(file_lock_state != VERIEXEC_LOCKED); 573 1.18.2.2 jdolecek KASSERT(file_lock_state != VERIEXEC_UNLOCKED); 574 1.18.2.2 jdolecek 575 1.18.2.2 jdolecek #define VFE_NEEDS_EVAL(vfe) ((vfe->status == FINGERPRINT_NOTEVAL) || \ 576 1.18.2.2 jdolecek (vfe->type & VERIEXEC_UNTRUSTED)) 577 1.18.2.2 jdolecek 578 1.18.2.2 jdolecek if (vfep != NULL) 579 1.18.2.2 jdolecek *vfep = NULL; 580 1.18.2.2 jdolecek 581 1.18.2.2 jdolecek if (vp->v_type != VREG) 582 1.18.2.2 jdolecek return (0); 583 1.18.2.2 jdolecek 584 1.18.2.2 jdolecek /* Lookup veriexec table entry, save pointer if requested. */ 585 1.18.2.2 jdolecek vfe = veriexec_get(vp); 586 1.18.2.2 jdolecek if (vfep != NULL) 587 1.18.2.2 jdolecek *vfep = vfe; 588 1.18.2.2 jdolecek 589 1.18.2.2 jdolecek /* No entry in the veriexec tables. */ 590 1.18.2.2 jdolecek if (vfe == NULL) { 591 1.18.2.2 jdolecek veriexec_file_report(NULL, "No entry.", name, 592 1.18.2.2 jdolecek l, REPORT_VERBOSE); 593 1.18.2.2 jdolecek 594 1.18.2.2 jdolecek /* 595 1.18.2.2 jdolecek * Lockdown mode: Deny access to non-monitored files. 596 1.18.2.2 jdolecek * IPS mode: Deny execution of non-monitored files. 597 1.18.2.2 jdolecek */ 598 1.18.2.2 jdolecek if ((veriexec_strict >= VERIEXEC_LOCKDOWN) || 599 1.18.2.2 jdolecek ((veriexec_strict >= VERIEXEC_IPS) && 600 1.18.2.2 jdolecek (flag != VERIEXEC_FILE))) 601 1.18.2.2 jdolecek return (EPERM); 602 1.18.2.2 jdolecek 603 1.18.2.2 jdolecek return (0); 604 1.18.2.2 jdolecek } 605 1.18.2.2 jdolecek 606 1.18.2.2 jdolecek /* 607 1.18.2.2 jdolecek * Grab the lock for the entry, if we need to do an evaluation 608 1.18.2.2 jdolecek * then the lock is a write lock, after we have the write 609 1.18.2.2 jdolecek * lock, check if we really need it - some other thread may 610 1.18.2.2 jdolecek * have already done the work for us. 611 1.18.2.2 jdolecek */ 612 1.18.2.2 jdolecek if (VFE_NEEDS_EVAL(vfe)) { 613 1.18.2.2 jdolecek rw_enter(&vfe->lock, RW_WRITER); 614 1.18.2.2 jdolecek if (!VFE_NEEDS_EVAL(vfe)) 615 1.18.2.2 jdolecek rw_downgrade(&vfe->lock); 616 1.18.2.2 jdolecek } else 617 1.18.2.2 jdolecek rw_enter(&vfe->lock, RW_READER); 618 1.18.2.2 jdolecek 619 1.18.2.2 jdolecek /* Evaluate fingerprint if needed. */ 620 1.18.2.2 jdolecek if (VFE_NEEDS_EVAL(vfe)) { 621 1.18.2.2 jdolecek u_char status; 622 1.18.2.2 jdolecek 623 1.18.2.2 jdolecek error = veriexec_fp_status(l, vp, file_lock_state, vfe, &status); 624 1.18.2.2 jdolecek if (error) { 625 1.18.2.2 jdolecek veriexec_file_report(vfe, "Fingerprint calculation error.", 626 1.18.2.2 jdolecek name, NULL, REPORT_ALWAYS); 627 1.18.2.2 jdolecek rw_exit(&vfe->lock); 628 1.18.2.2 jdolecek return (error); 629 1.18.2.2 jdolecek } 630 1.18.2.2 jdolecek vfe->status = status; 631 1.18.2.2 jdolecek rw_downgrade(&vfe->lock); 632 1.18.2.2 jdolecek } 633 1.18.2.2 jdolecek 634 1.18.2.2 jdolecek if (!(vfe->type & flag)) { 635 1.18.2.2 jdolecek veriexec_file_report(vfe, "Incorrect access type.", name, l, 636 1.18.2.2 jdolecek REPORT_ALWAYS|REPORT_ALARM); 637 1.18.2.2 jdolecek 638 1.18.2.2 jdolecek /* IPS mode: Enforce access type. */ 639 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_IPS) { 640 1.18.2.2 jdolecek rw_exit(&vfe->lock); 641 1.18.2.2 jdolecek return (EPERM); 642 1.18.2.2 jdolecek } 643 1.18.2.2 jdolecek } 644 1.18.2.2 jdolecek 645 1.18.2.2 jdolecek switch (vfe->status) { 646 1.18.2.2 jdolecek case FINGERPRINT_NOTEVAL: 647 1.18.2.2 jdolecek /* Should not happen. */ 648 1.18.2.2 jdolecek rw_exit(&vfe->lock); 649 1.18.2.2 jdolecek veriexec_file_report(vfe, "Not-evaluated status " 650 1.18.2.2 jdolecek "post evaluation; inconsistency detected.", name, 651 1.18.2.2 jdolecek NULL, REPORT_ALWAYS|REPORT_PANIC); 652 1.18.2.2 jdolecek /* NOTREACHED */ 653 1.18.2.2 jdolecek 654 1.18.2.2 jdolecek case FINGERPRINT_VALID: 655 1.18.2.2 jdolecek /* Valid fingerprint. */ 656 1.18.2.2 jdolecek veriexec_file_report(vfe, "Match.", name, NULL, 657 1.18.2.2 jdolecek REPORT_VERBOSE); 658 1.18.2.2 jdolecek 659 1.18.2.2 jdolecek break; 660 1.18.2.2 jdolecek 661 1.18.2.2 jdolecek case FINGERPRINT_NOMATCH: 662 1.18.2.2 jdolecek /* Fingerprint mismatch. */ 663 1.18.2.2 jdolecek veriexec_file_report(vfe, "Mismatch.", name, 664 1.18.2.2 jdolecek NULL, REPORT_ALWAYS|REPORT_ALARM); 665 1.18.2.2 jdolecek 666 1.18.2.2 jdolecek /* IDS mode: Deny access on fingerprint mismatch. */ 667 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_IDS) { 668 1.18.2.2 jdolecek rw_exit(&vfe->lock); 669 1.18.2.2 jdolecek error = EPERM; 670 1.18.2.2 jdolecek } 671 1.18.2.2 jdolecek 672 1.18.2.2 jdolecek break; 673 1.18.2.2 jdolecek 674 1.18.2.2 jdolecek default: 675 1.18.2.2 jdolecek /* Should never happen. */ 676 1.18.2.2 jdolecek rw_exit(&vfe->lock); 677 1.18.2.2 jdolecek veriexec_file_report(vfe, "Invalid status " 678 1.18.2.2 jdolecek "post evaluation.", name, NULL, REPORT_ALWAYS|REPORT_PANIC); 679 1.18.2.2 jdolecek /* NOTREACHED */ 680 1.18.2.2 jdolecek } 681 1.18.2.2 jdolecek 682 1.18.2.2 jdolecek return (error); 683 1.18.2.2 jdolecek } 684 1.18.2.2 jdolecek 685 1.18.2.2 jdolecek int 686 1.18.2.2 jdolecek veriexec_verify(struct lwp *l, struct vnode *vp, const u_char *name, int flag, 687 1.18.2.2 jdolecek bool *found) 688 1.18.2.2 jdolecek { 689 1.18.2.2 jdolecek struct veriexec_file_entry *vfe; 690 1.18.2.2 jdolecek int r; 691 1.18.2.2 jdolecek 692 1.18.2.2 jdolecek if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 693 1.18.2.2 jdolecek return 0; 694 1.18.2.2 jdolecek 695 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 696 1.18.2.2 jdolecek r = veriexec_file_verify(l, vp, name, flag, VERIEXEC_FILE_UNLOCKED, 697 1.18.2.2 jdolecek &vfe); 698 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 699 1.18.2.2 jdolecek 700 1.18.2.2 jdolecek if ((r == 0) && (vfe != NULL)) 701 1.18.2.2 jdolecek rw_exit(&vfe->lock); 702 1.18.2.2 jdolecek 703 1.18.2.2 jdolecek if (found != NULL) 704 1.18.2.2 jdolecek *found = (vfe != NULL) ? true : false; 705 1.18.2.2 jdolecek 706 1.18.2.2 jdolecek return (r); 707 1.18.2.2 jdolecek } 708 1.18.2.2 jdolecek 709 1.18.2.2 jdolecek /* 710 1.18.2.2 jdolecek * Veriexec remove policy code. 711 1.18.2.2 jdolecek */ 712 1.18.2.2 jdolecek int 713 1.18.2.2 jdolecek veriexec_removechk(struct lwp *l, struct vnode *vp, const char *pathbuf) 714 1.18.2.2 jdolecek { 715 1.18.2.2 jdolecek struct veriexec_file_entry *vfe; 716 1.18.2.2 jdolecek int error; 717 1.18.2.2 jdolecek 718 1.18.2.2 jdolecek if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 719 1.18.2.2 jdolecek return 0; 720 1.18.2.2 jdolecek 721 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 722 1.18.2.2 jdolecek vfe = veriexec_get(vp); 723 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 724 1.18.2.2 jdolecek 725 1.18.2.2 jdolecek if (vfe == NULL) { 726 1.18.2.2 jdolecek /* Lockdown mode: Deny access to non-monitored files. */ 727 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_LOCKDOWN) 728 1.18.2.2 jdolecek return (EPERM); 729 1.18.2.2 jdolecek 730 1.18.2.2 jdolecek return (0); 731 1.18.2.2 jdolecek } 732 1.18.2.2 jdolecek 733 1.18.2.2 jdolecek veriexec_file_report(vfe, "Remove request.", pathbuf, l, 734 1.18.2.2 jdolecek REPORT_ALWAYS|REPORT_ALARM); 735 1.18.2.2 jdolecek 736 1.18.2.2 jdolecek /* IDS mode: Deny removal of monitored files. */ 737 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_IDS) 738 1.18.2.2 jdolecek error = EPERM; 739 1.18.2.2 jdolecek else 740 1.18.2.2 jdolecek error = veriexec_file_delete(l, vp); 741 1.18.2.2 jdolecek 742 1.18.2.2 jdolecek return error; 743 1.18.2.2 jdolecek } 744 1.18.2.2 jdolecek 745 1.18.2.2 jdolecek /* 746 1.18.2.2 jdolecek * Veriexec rename policy. 747 1.18.2.2 jdolecek * 748 1.18.2.2 jdolecek * XXX: Once there's a way to hook after a successful rename, it would be 749 1.18.2.2 jdolecek * XXX: nice to update vfe->filename to the new name if it's not NULL and 750 1.18.2.2 jdolecek * XXX: the new name is absolute (ie., starts with a slash). 751 1.18.2.2 jdolecek */ 752 1.18.2.2 jdolecek int 753 1.18.2.2 jdolecek veriexec_renamechk(struct lwp *l, struct vnode *fromvp, const char *fromname, 754 1.18.2.2 jdolecek struct vnode *tovp, const char *toname) 755 1.18.2.2 jdolecek { 756 1.18.2.2 jdolecek struct veriexec_file_entry *fvfe = NULL, *tvfe = NULL; 757 1.18.2.2 jdolecek 758 1.18.2.2 jdolecek if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 759 1.18.2.2 jdolecek return 0; 760 1.18.2.2 jdolecek 761 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 762 1.18.2.2 jdolecek 763 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_LOCKDOWN) { 764 1.18.2.2 jdolecek log(LOG_ALERT, "Veriexec: Preventing rename of `%s' to " 765 1.18.2.2 jdolecek "`%s', uid=%u, pid=%u: Lockdown mode.\n", fromname, toname, 766 1.18.2.2 jdolecek kauth_cred_geteuid(l->l_cred), l->l_proc->p_pid); 767 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 768 1.18.2.2 jdolecek return (EPERM); 769 1.18.2.2 jdolecek } 770 1.18.2.2 jdolecek 771 1.18.2.2 jdolecek fvfe = veriexec_get(fromvp); 772 1.18.2.2 jdolecek if (tovp != NULL) 773 1.18.2.2 jdolecek tvfe = veriexec_get(tovp); 774 1.18.2.2 jdolecek 775 1.18.2.2 jdolecek if ((fvfe == NULL) && (tvfe == NULL)) { 776 1.18.2.2 jdolecek /* None of them is monitored */ 777 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 778 1.18.2.2 jdolecek return 0; 779 1.18.2.2 jdolecek } 780 1.18.2.2 jdolecek 781 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_IPS) { 782 1.18.2.2 jdolecek log(LOG_ALERT, "Veriexec: Preventing rename of `%s' " 783 1.18.2.2 jdolecek "to `%s', uid=%u, pid=%u: IPS mode, %s " 784 1.18.2.2 jdolecek "monitored.\n", fromname, toname, 785 1.18.2.2 jdolecek kauth_cred_geteuid(l->l_cred), 786 1.18.2.2 jdolecek l->l_proc->p_pid, (fvfe != NULL && tvfe != NULL) ? 787 1.18.2.2 jdolecek "files" : "file"); 788 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 789 1.18.2.2 jdolecek return (EPERM); 790 1.18.2.2 jdolecek } 791 1.18.2.2 jdolecek 792 1.18.2.2 jdolecek if (fvfe != NULL) { 793 1.18.2.2 jdolecek /* 794 1.18.2.2 jdolecek * Monitored file is renamed; filename no longer relevant. 795 1.18.2.2 jdolecek */ 796 1.18.2.2 jdolecek 797 1.18.2.2 jdolecek /* 798 1.18.2.2 jdolecek * XXX: We could keep the buffer, and when (and if) updating the 799 1.18.2.2 jdolecek * XXX: filename post-rename, re-allocate it only if it's not 800 1.18.2.2 jdolecek * XXX: big enough for the new filename. 801 1.18.2.2 jdolecek */ 802 1.18.2.2 jdolecek 803 1.18.2.2 jdolecek /* XXX: Get write lock on fvfe here? */ 804 1.18.2.2 jdolecek 805 1.18.2.2 jdolecek VERIEXEC_RW_UPGRADE(&veriexec_op_lock); 806 1.18.2.2 jdolecek /* once we have the op lock in write mode 807 1.18.2.2 jdolecek * there should be no locks on any file 808 1.18.2.2 jdolecek * entries so we can destroy the object. 809 1.18.2.2 jdolecek */ 810 1.18.2.2 jdolecek 811 1.18.2.2 jdolecek if (fvfe->filename_len > 0) 812 1.18.2.2 jdolecek kmem_free(fvfe->filename, fvfe->filename_len); 813 1.18.2.2 jdolecek 814 1.18.2.2 jdolecek fvfe->filename = NULL; 815 1.18.2.2 jdolecek fvfe->filename_len = 0; 816 1.18.2.2 jdolecek 817 1.18.2.2 jdolecek rw_downgrade(&veriexec_op_lock); 818 1.18.2.2 jdolecek } 819 1.18.2.2 jdolecek 820 1.18.2.2 jdolecek log(LOG_NOTICE, "Veriexec: %s file `%s' renamed to " 821 1.18.2.2 jdolecek "%s file `%s', uid=%u, pid=%u.\n", (fvfe != NULL) ? 822 1.18.2.2 jdolecek "Monitored" : "Non-monitored", fromname, (tvfe != NULL) ? 823 1.18.2.2 jdolecek "monitored" : "non-monitored", toname, 824 1.18.2.2 jdolecek kauth_cred_geteuid(l->l_cred), l->l_proc->p_pid); 825 1.18.2.2 jdolecek 826 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 827 1.18.2.2 jdolecek 828 1.18.2.2 jdolecek if (tvfe != NULL) { 829 1.18.2.2 jdolecek /* 830 1.18.2.2 jdolecek * Monitored file is overwritten. Remove the entry. 831 1.18.2.2 jdolecek */ 832 1.18.2.2 jdolecek (void)veriexec_file_delete(l, tovp); 833 1.18.2.2 jdolecek } 834 1.18.2.2 jdolecek 835 1.18.2.2 jdolecek return (0); 836 1.18.2.2 jdolecek } 837 1.18.2.2 jdolecek 838 1.18.2.2 jdolecek static void 839 1.18.2.2 jdolecek veriexec_file_free(struct veriexec_file_entry *vfe) 840 1.18.2.2 jdolecek { 841 1.18.2.2 jdolecek if (vfe != NULL) { 842 1.18.2.2 jdolecek if (vfe->fp != NULL) 843 1.18.2.2 jdolecek kmem_free(vfe->fp, vfe->ops->hash_len); 844 1.18.2.2 jdolecek if (vfe->filename != NULL) 845 1.18.2.2 jdolecek kmem_free(vfe->filename, vfe->filename_len); 846 1.18.2.2 jdolecek rw_destroy(&vfe->lock); 847 1.18.2.2 jdolecek kmem_free(vfe, sizeof(*vfe)); 848 1.18.2.2 jdolecek } 849 1.18.2.2 jdolecek } 850 1.18.2.2 jdolecek 851 1.18.2.2 jdolecek static void 852 1.18.2.2 jdolecek veriexec_file_purge(struct veriexec_file_entry *vfe, int have_lock) 853 1.18.2.2 jdolecek { 854 1.18.2.2 jdolecek if (vfe == NULL) 855 1.18.2.2 jdolecek return; 856 1.18.2.2 jdolecek 857 1.18.2.2 jdolecek if (have_lock == VERIEXEC_UNLOCKED) 858 1.18.2.2 jdolecek rw_enter(&vfe->lock, RW_WRITER); 859 1.18.2.2 jdolecek else 860 1.18.2.2 jdolecek VERIEXEC_RW_UPGRADE(&vfe->lock); 861 1.18.2.2 jdolecek 862 1.18.2.2 jdolecek vfe->status = FINGERPRINT_NOTEVAL; 863 1.18.2.2 jdolecek if (have_lock == VERIEXEC_UNLOCKED) 864 1.18.2.2 jdolecek rw_exit(&vfe->lock); 865 1.18.2.2 jdolecek else 866 1.18.2.2 jdolecek rw_downgrade(&vfe->lock); 867 1.18.2.2 jdolecek } 868 1.18.2.2 jdolecek 869 1.18.2.2 jdolecek static void 870 1.18.2.2 jdolecek veriexec_file_purge_cb(struct veriexec_file_entry *vfe, void *cookie) 871 1.18.2.2 jdolecek { 872 1.18.2.2 jdolecek veriexec_file_purge(vfe, VERIEXEC_UNLOCKED); 873 1.18.2.2 jdolecek } 874 1.18.2.2 jdolecek 875 1.18.2.2 jdolecek /* 876 1.18.2.2 jdolecek * Invalidate a Veriexec file entry. 877 1.18.2.2 jdolecek * XXX: This should be updated when per-page fingerprints are added. 878 1.18.2.2 jdolecek */ 879 1.18.2.2 jdolecek void 880 1.18.2.2 jdolecek veriexec_purge(struct vnode *vp) 881 1.18.2.2 jdolecek { 882 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 883 1.18.2.2 jdolecek veriexec_file_purge(veriexec_get(vp), VERIEXEC_UNLOCKED); 884 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 885 1.18.2.2 jdolecek } 886 1.18.2.2 jdolecek 887 1.18.2.2 jdolecek /* 888 1.18.2.2 jdolecek * Enforce raw disk access policy. 889 1.18.2.2 jdolecek * 890 1.18.2.2 jdolecek * IDS mode: Invalidate fingerprints on a mount if it's opened for writing. 891 1.18.2.2 jdolecek * IPS mode: Don't allow raw writing to disks we monitor. 892 1.18.2.2 jdolecek * Lockdown mode: Don't allow raw writing to all disks. 893 1.18.2.2 jdolecek * 894 1.18.2.2 jdolecek * XXX: This is bogus. There's an obvious race condition between the time 895 1.18.2.2 jdolecek * XXX: the disk is open for writing, in which an attacker can access a 896 1.18.2.2 jdolecek * XXX: monitored file to get its signature cached again, and when the raw 897 1.18.2.2 jdolecek * XXX: file is overwritten on disk. 898 1.18.2.2 jdolecek * XXX: 899 1.18.2.2 jdolecek * XXX: To solve this, we need something like the following: 900 1.18.2.2 jdolecek * XXX: open raw disk: 901 1.18.2.2 jdolecek * XXX: - raise refcount, 902 1.18.2.2 jdolecek * XXX: - invalidate fingerprints, 903 1.18.2.2 jdolecek * XXX: - mark all entries for that disk with "no cache" flag 904 1.18.2.2 jdolecek * XXX: 905 1.18.2.2 jdolecek * XXX: veriexec_verify: 906 1.18.2.2 jdolecek * XXX: - if "no cache", don't cache evaluation result 907 1.18.2.2 jdolecek * XXX: 908 1.18.2.2 jdolecek * XXX: close raw disk: 909 1.18.2.2 jdolecek * XXX: - lower refcount, 910 1.18.2.2 jdolecek * XXX: - if refcount == 0, remove "no cache" flag from all entries 911 1.18.2.2 jdolecek */ 912 1.18.2.2 jdolecek static int 913 1.18.2.2 jdolecek veriexec_raw_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 914 1.18.2.2 jdolecek void *arg0, void *arg1, void *arg2, void *arg3) 915 1.18.2.2 jdolecek { 916 1.18.2.2 jdolecek int result; 917 1.18.2.2 jdolecek enum kauth_device_req req; 918 1.18.2.2 jdolecek struct veriexec_table_entry *vte; 919 1.18.2.2 jdolecek 920 1.18.2.2 jdolecek result = KAUTH_RESULT_DENY; 921 1.18.2.2 jdolecek req = (enum kauth_device_req)arg0; 922 1.18.2.2 jdolecek 923 1.18.2.2 jdolecek switch (action) { 924 1.18.2.2 jdolecek case KAUTH_DEVICE_RAWIO_SPEC: { 925 1.18.2.2 jdolecek struct vnode *vp, *bvp; 926 1.18.2.2 jdolecek int error; 927 1.18.2.2 jdolecek 928 1.18.2.2 jdolecek if (req == KAUTH_REQ_DEVICE_RAWIO_SPEC_READ) { 929 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 930 1.18.2.2 jdolecek break; 931 1.18.2.2 jdolecek } 932 1.18.2.2 jdolecek 933 1.18.2.2 jdolecek vp = arg1; 934 1.18.2.2 jdolecek KASSERT(vp != NULL); 935 1.18.2.2 jdolecek 936 1.18.2.2 jdolecek /* Handle /dev/mem and /dev/kmem. */ 937 1.18.2.2 jdolecek if (iskmemvp(vp)) { 938 1.18.2.2 jdolecek if (veriexec_strict < VERIEXEC_IPS) 939 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 940 1.18.2.2 jdolecek 941 1.18.2.2 jdolecek break; 942 1.18.2.2 jdolecek } 943 1.18.2.2 jdolecek 944 1.18.2.2 jdolecek error = rawdev_mounted(vp, &bvp); 945 1.18.2.2 jdolecek if (error == EINVAL) { 946 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 947 1.18.2.2 jdolecek break; 948 1.18.2.2 jdolecek } 949 1.18.2.2 jdolecek 950 1.18.2.2 jdolecek /* 951 1.18.2.2 jdolecek * XXX: See vfs_mountedon() comment in rawdev_mounted(). 952 1.18.2.2 jdolecek */ 953 1.18.2.2 jdolecek vte = veriexec_table_lookup(bvp->v_mount); 954 1.18.2.2 jdolecek if (vte == NULL) { 955 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 956 1.18.2.2 jdolecek break; 957 1.18.2.2 jdolecek } 958 1.18.2.2 jdolecek 959 1.18.2.2 jdolecek switch (veriexec_strict) { 960 1.18.2.2 jdolecek case VERIEXEC_LEARNING: 961 1.18.2.2 jdolecek case VERIEXEC_IDS: 962 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 963 1.18.2.2 jdolecek 964 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_WRITER); 965 1.18.2.2 jdolecek fileassoc_table_run(bvp->v_mount, veriexec_hook, 966 1.18.2.2 jdolecek (fileassoc_cb_t)veriexec_file_purge_cb, NULL); 967 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 968 1.18.2.2 jdolecek 969 1.18.2.2 jdolecek break; 970 1.18.2.2 jdolecek case VERIEXEC_IPS: 971 1.18.2.2 jdolecek result = KAUTH_RESULT_DENY; 972 1.18.2.2 jdolecek break; 973 1.18.2.2 jdolecek case VERIEXEC_LOCKDOWN: 974 1.18.2.2 jdolecek result = KAUTH_RESULT_DENY; 975 1.18.2.2 jdolecek break; 976 1.18.2.2 jdolecek } 977 1.18.2.2 jdolecek 978 1.18.2.2 jdolecek break; 979 1.18.2.2 jdolecek } 980 1.18.2.2 jdolecek 981 1.18.2.2 jdolecek case KAUTH_DEVICE_RAWIO_PASSTHRU: 982 1.18.2.2 jdolecek /* XXX What can we do here? */ 983 1.18.2.2 jdolecek if (veriexec_strict < VERIEXEC_IPS) 984 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 985 1.18.2.2 jdolecek 986 1.18.2.2 jdolecek break; 987 1.18.2.2 jdolecek 988 1.18.2.2 jdolecek default: 989 1.18.2.2 jdolecek result = KAUTH_RESULT_DEFER; 990 1.18.2.2 jdolecek break; 991 1.18.2.2 jdolecek } 992 1.18.2.2 jdolecek 993 1.18.2.2 jdolecek return (result); 994 1.18.2.2 jdolecek } 995 1.18.2.2 jdolecek 996 1.18.2.2 jdolecek /* 997 1.18.2.2 jdolecek * Create a new Veriexec table. 998 1.18.2.2 jdolecek */ 999 1.18.2.2 jdolecek static struct veriexec_table_entry * 1000 1.18.2.2 jdolecek veriexec_table_add(struct lwp *l, struct mount *mp) 1001 1.18.2.2 jdolecek { 1002 1.18.2.2 jdolecek struct veriexec_table_entry *vte; 1003 1.18.2.2 jdolecek u_char buf[16]; 1004 1.18.2.2 jdolecek 1005 1.18.2.2 jdolecek vte = kmem_zalloc(sizeof(*vte), KM_SLEEP); 1006 1.18.2.2 jdolecek mount_setspecific(mp, veriexec_mountspecific_key, vte); 1007 1.18.2.2 jdolecek 1008 1.18.2.2 jdolecek snprintf(buf, sizeof(buf), "table%u", veriexec_tablecount++); 1009 1.18.2.2 jdolecek sysctl_createv(NULL, 0, &veriexec_count_node, &vte->vte_node, 1010 1.18.2.2 jdolecek 0, CTLTYPE_NODE, buf, NULL, NULL, 0, NULL, 1011 1.18.2.2 jdolecek 0, CTL_CREATE, CTL_EOL); 1012 1.18.2.2 jdolecek 1013 1.18.2.2 jdolecek sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1014 1.18.2.2 jdolecek CTLFLAG_READONLY, CTLTYPE_STRING, "mntpt", 1015 1.18.2.2 jdolecek NULL, NULL, 0, mp->mnt_stat.f_mntonname, 1016 1.18.2.2 jdolecek 0, CTL_CREATE, CTL_EOL); 1017 1.18.2.2 jdolecek sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1018 1.18.2.2 jdolecek CTLFLAG_READONLY, CTLTYPE_STRING, "fstype", 1019 1.18.2.2 jdolecek NULL, NULL, 0, mp->mnt_stat.f_fstypename, 1020 1.18.2.2 jdolecek 0, CTL_CREATE, CTL_EOL); 1021 1.18.2.2 jdolecek sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1022 1.18.2.2 jdolecek CTLFLAG_READONLY, CTLTYPE_QUAD, "nentries", 1023 1.18.2.2 jdolecek NULL, NULL, 0, &vte->vte_count, 0, CTL_CREATE, CTL_EOL); 1024 1.18.2.2 jdolecek 1025 1.18.2.2 jdolecek return (vte); 1026 1.18.2.2 jdolecek } 1027 1.18.2.2 jdolecek 1028 1.18.2.2 jdolecek /* 1029 1.18.2.2 jdolecek * Add a file to be monitored by Veriexec. 1030 1.18.2.2 jdolecek * 1031 1.18.2.2 jdolecek * Expected elements in dict: file, fp, fp-type, entry-type. 1032 1.18.2.2 jdolecek */ 1033 1.18.2.2 jdolecek int 1034 1.18.2.2 jdolecek veriexec_file_add(struct lwp *l, prop_dictionary_t dict) 1035 1.18.2.2 jdolecek { 1036 1.18.2.2 jdolecek struct veriexec_table_entry *vte; 1037 1.18.2.2 jdolecek struct veriexec_file_entry *vfe = NULL; 1038 1.18.2.2 jdolecek struct veriexec_file_entry *ovfe; 1039 1.18.2.2 jdolecek struct vnode *vp; 1040 1.18.2.2 jdolecek const char *file, *fp_type; 1041 1.18.2.2 jdolecek int error; 1042 1.18.2.2 jdolecek bool ignore_dup = false; 1043 1.18.2.2 jdolecek 1044 1.18.2.2 jdolecek if (!prop_dictionary_get_cstring_nocopy(dict, "file", &file)) 1045 1.18.2.2 jdolecek return (EINVAL); 1046 1.18.2.2 jdolecek 1047 1.18.2.2 jdolecek error = namei_simple_kernel(file, NSM_FOLLOW_NOEMULROOT, &vp); 1048 1.18.2.2 jdolecek if (error) 1049 1.18.2.2 jdolecek return (error); 1050 1.18.2.2 jdolecek 1051 1.18.2.2 jdolecek /* Add only regular files. */ 1052 1.18.2.2 jdolecek if (vp->v_type != VREG) { 1053 1.18.2.2 jdolecek log(LOG_ERR, "Veriexec: Not adding `%s': Not a regular file.\n", 1054 1.18.2.2 jdolecek file); 1055 1.18.2.2 jdolecek error = EBADF; 1056 1.18.2.2 jdolecek goto out; 1057 1.18.2.2 jdolecek } 1058 1.18.2.2 jdolecek 1059 1.18.2.2 jdolecek vfe = kmem_zalloc(sizeof(*vfe), KM_SLEEP); 1060 1.18.2.2 jdolecek rw_init(&vfe->lock); 1061 1.18.2.2 jdolecek 1062 1.18.2.2 jdolecek /* Lookup fingerprint hashing algorithm. */ 1063 1.18.2.2 jdolecek fp_type = prop_string_cstring_nocopy(prop_dictionary_get(dict, 1064 1.18.2.2 jdolecek "fp-type")); 1065 1.18.2.2 jdolecek if ((vfe->ops = veriexec_fpops_lookup(fp_type)) == NULL) { 1066 1.18.2.2 jdolecek log(LOG_ERR, "Veriexec: Invalid or unknown fingerprint type " 1067 1.18.2.2 jdolecek "`%s' for file `%s'.\n", fp_type, file); 1068 1.18.2.2 jdolecek error = EOPNOTSUPP; 1069 1.18.2.2 jdolecek goto out; 1070 1.18.2.2 jdolecek } 1071 1.18.2.2 jdolecek 1072 1.18.2.2 jdolecek if (prop_data_size(prop_dictionary_get(dict, "fp")) != 1073 1.18.2.2 jdolecek vfe->ops->hash_len) { 1074 1.18.2.2 jdolecek log(LOG_ERR, "Veriexec: Bad fingerprint length for `%s'.\n", 1075 1.18.2.2 jdolecek file); 1076 1.18.2.2 jdolecek error = EINVAL; 1077 1.18.2.2 jdolecek goto out; 1078 1.18.2.2 jdolecek } 1079 1.18.2.2 jdolecek 1080 1.18.2.2 jdolecek vfe->fp = kmem_alloc(vfe->ops->hash_len, KM_SLEEP); 1081 1.18.2.2 jdolecek memcpy(vfe->fp, prop_data_data_nocopy(prop_dictionary_get(dict, "fp")), 1082 1.18.2.2 jdolecek vfe->ops->hash_len); 1083 1.18.2.2 jdolecek 1084 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_WRITER); 1085 1.18.2.2 jdolecek 1086 1.18.2.2 jdolecek /* Continue entry initialization. */ 1087 1.18.2.2 jdolecek if (prop_dictionary_get_uint8(dict, "entry-type", &vfe->type) == FALSE) 1088 1.18.2.2 jdolecek vfe->type = 0; 1089 1.18.2.2 jdolecek else { 1090 1.18.2.2 jdolecek uint8_t extra_flags; 1091 1.18.2.2 jdolecek 1092 1.18.2.2 jdolecek extra_flags = vfe->type & ~(VERIEXEC_DIRECT | 1093 1.18.2.2 jdolecek VERIEXEC_INDIRECT | VERIEXEC_FILE | VERIEXEC_UNTRUSTED); 1094 1.18.2.2 jdolecek if (extra_flags) { 1095 1.18.2.2 jdolecek log(LOG_NOTICE, "Veriexec: Contaminated flags `0x%x' " 1096 1.18.2.2 jdolecek "for `%s', skipping.\n", extra_flags, file); 1097 1.18.2.2 jdolecek error = EINVAL; 1098 1.18.2.2 jdolecek goto unlock_out; 1099 1.18.2.2 jdolecek } 1100 1.18.2.2 jdolecek } 1101 1.18.2.2 jdolecek if (!(vfe->type & (VERIEXEC_DIRECT | VERIEXEC_INDIRECT | 1102 1.18.2.2 jdolecek VERIEXEC_FILE))) 1103 1.18.2.2 jdolecek vfe->type |= VERIEXEC_DIRECT; 1104 1.18.2.2 jdolecek 1105 1.18.2.2 jdolecek vfe->status = FINGERPRINT_NOTEVAL; 1106 1.18.2.2 jdolecek if (prop_bool_true(prop_dictionary_get(dict, "keep-filename"))) { 1107 1.18.2.2 jdolecek vfe->filename = kmem_strdupsize(file, &vfe->filename_len, 1108 1.18.2.2 jdolecek KM_SLEEP); 1109 1.18.2.2 jdolecek } else 1110 1.18.2.2 jdolecek vfe->filename = NULL; 1111 1.18.2.2 jdolecek 1112 1.18.2.2 jdolecek if (prop_bool_true(prop_dictionary_get(dict, "eval-on-load")) || 1113 1.18.2.2 jdolecek (vfe->type & VERIEXEC_UNTRUSTED)) { 1114 1.18.2.2 jdolecek u_char status; 1115 1.18.2.2 jdolecek 1116 1.18.2.2 jdolecek error = veriexec_fp_status(l, vp, VERIEXEC_FILE_UNLOCKED, 1117 1.18.2.2 jdolecek vfe, &status); 1118 1.18.2.2 jdolecek if (error) 1119 1.18.2.2 jdolecek goto unlock_out; 1120 1.18.2.2 jdolecek vfe->status = status; 1121 1.18.2.2 jdolecek } 1122 1.18.2.2 jdolecek 1123 1.18.2.2 jdolecek /* 1124 1.18.2.2 jdolecek * If we already have an entry for this file, and it matches 1125 1.18.2.2 jdolecek * the new entry exactly (except for the filename, which may 1126 1.18.2.2 jdolecek * hard-linked!), we just ignore the new entry. If the new 1127 1.18.2.2 jdolecek * entry differs, report the error. 1128 1.18.2.2 jdolecek */ 1129 1.18.2.2 jdolecek if ((ovfe = veriexec_get(vp)) != NULL) { 1130 1.18.2.2 jdolecek error = EEXIST; 1131 1.18.2.2 jdolecek if (vfe->type == ovfe->type && 1132 1.18.2.2 jdolecek vfe->status == ovfe->status && 1133 1.18.2.2 jdolecek vfe->ops == ovfe->ops && 1134 1.18.2.2 jdolecek memcmp(vfe->fp, ovfe->fp, vfe->ops->hash_len) == 0) 1135 1.18.2.2 jdolecek ignore_dup = true; 1136 1.18.2.2 jdolecek goto unlock_out; 1137 1.18.2.2 jdolecek } 1138 1.18.2.2 jdolecek 1139 1.18.2.2 jdolecek vte = veriexec_table_lookup(vp->v_mount); 1140 1.18.2.2 jdolecek if (vte == NULL) 1141 1.18.2.2 jdolecek vte = veriexec_table_add(l, vp->v_mount); 1142 1.18.2.2 jdolecek 1143 1.18.2.2 jdolecek /* XXX if we bail below this, we might want to gc newly created vtes. */ 1144 1.18.2.2 jdolecek 1145 1.18.2.2 jdolecek error = fileassoc_add(vp, veriexec_hook, vfe); 1146 1.18.2.2 jdolecek if (error) 1147 1.18.2.2 jdolecek goto unlock_out; 1148 1.18.2.2 jdolecek 1149 1.18.2.2 jdolecek vte->vte_count++; 1150 1.18.2.2 jdolecek 1151 1.18.2.2 jdolecek veriexec_file_report(NULL, "New entry.", file, NULL, REPORT_DEBUG); 1152 1.18.2.2 jdolecek veriexec_bypass = 0; 1153 1.18.2.2 jdolecek 1154 1.18.2.2 jdolecek unlock_out: 1155 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1156 1.18.2.2 jdolecek 1157 1.18.2.2 jdolecek out: 1158 1.18.2.2 jdolecek vrele(vp); 1159 1.18.2.2 jdolecek if (error) 1160 1.18.2.2 jdolecek veriexec_file_free(vfe); 1161 1.18.2.2 jdolecek 1162 1.18.2.2 jdolecek if (ignore_dup && error == EEXIST) 1163 1.18.2.2 jdolecek error = 0; 1164 1.18.2.2 jdolecek 1165 1.18.2.2 jdolecek return (error); 1166 1.18.2.2 jdolecek } 1167 1.18.2.2 jdolecek 1168 1.18.2.2 jdolecek int 1169 1.18.2.2 jdolecek veriexec_table_delete(struct lwp *l, struct mount *mp) 1170 1.18.2.2 jdolecek { 1171 1.18.2.2 jdolecek struct veriexec_table_entry *vte; 1172 1.18.2.2 jdolecek 1173 1.18.2.2 jdolecek vte = veriexec_table_lookup(mp); 1174 1.18.2.2 jdolecek if (vte == NULL) 1175 1.18.2.2 jdolecek return (ENOENT); 1176 1.18.2.2 jdolecek 1177 1.18.2.2 jdolecek veriexec_mountspecific_dtor(vte); 1178 1.18.2.2 jdolecek mount_setspecific(mp, veriexec_mountspecific_key, NULL); 1179 1.18.2.2 jdolecek 1180 1.18.2.2 jdolecek return (fileassoc_table_clear(mp, veriexec_hook)); 1181 1.18.2.2 jdolecek } 1182 1.18.2.2 jdolecek 1183 1.18.2.2 jdolecek int 1184 1.18.2.2 jdolecek veriexec_file_delete(struct lwp *l, struct vnode *vp) 1185 1.18.2.2 jdolecek { 1186 1.18.2.2 jdolecek struct veriexec_table_entry *vte; 1187 1.18.2.2 jdolecek int error; 1188 1.18.2.2 jdolecek 1189 1.18.2.2 jdolecek vte = veriexec_table_lookup(vp->v_mount); 1190 1.18.2.2 jdolecek if (vte == NULL) 1191 1.18.2.2 jdolecek return (ENOENT); 1192 1.18.2.2 jdolecek 1193 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_WRITER); 1194 1.18.2.2 jdolecek error = fileassoc_clear(vp, veriexec_hook); 1195 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1196 1.18.2.2 jdolecek if (!error) { 1197 1.18.2.2 jdolecek KASSERT(vte->vte_count > 0); 1198 1.18.2.2 jdolecek vte->vte_count--; 1199 1.18.2.2 jdolecek } 1200 1.18.2.2 jdolecek 1201 1.18.2.2 jdolecek return (error); 1202 1.18.2.2 jdolecek } 1203 1.18.2.2 jdolecek 1204 1.18.2.2 jdolecek /* 1205 1.18.2.2 jdolecek * Convert Veriexec entry data to a dictionary readable by userland tools. 1206 1.18.2.2 jdolecek */ 1207 1.18.2.2 jdolecek static void 1208 1.18.2.2 jdolecek veriexec_file_convert(struct veriexec_file_entry *vfe, prop_dictionary_t rdict) 1209 1.18.2.2 jdolecek { 1210 1.18.2.2 jdolecek if (vfe->filename) 1211 1.18.2.2 jdolecek prop_dictionary_set(rdict, "file", 1212 1.18.2.2 jdolecek prop_string_create_cstring(vfe->filename)); 1213 1.18.2.2 jdolecek prop_dictionary_set_uint8(rdict, "entry-type", vfe->type); 1214 1.18.2.2 jdolecek prop_dictionary_set_uint8(rdict, "status", vfe->status); 1215 1.18.2.2 jdolecek prop_dictionary_set(rdict, "fp-type", 1216 1.18.2.2 jdolecek prop_string_create_cstring(vfe->ops->type)); 1217 1.18.2.2 jdolecek prop_dictionary_set(rdict, "fp", 1218 1.18.2.2 jdolecek prop_data_create_data(vfe->fp, vfe->ops->hash_len)); 1219 1.18.2.2 jdolecek } 1220 1.18.2.2 jdolecek 1221 1.18.2.2 jdolecek int 1222 1.18.2.2 jdolecek veriexec_convert(struct vnode *vp, prop_dictionary_t rdict) 1223 1.18.2.2 jdolecek { 1224 1.18.2.2 jdolecek struct veriexec_file_entry *vfe; 1225 1.18.2.2 jdolecek 1226 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 1227 1.18.2.2 jdolecek 1228 1.18.2.2 jdolecek vfe = veriexec_get(vp); 1229 1.18.2.2 jdolecek if (vfe == NULL) { 1230 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1231 1.18.2.2 jdolecek return (ENOENT); 1232 1.18.2.2 jdolecek } 1233 1.18.2.2 jdolecek 1234 1.18.2.2 jdolecek rw_enter(&vfe->lock, RW_READER); 1235 1.18.2.2 jdolecek veriexec_file_convert(vfe, rdict); 1236 1.18.2.2 jdolecek rw_exit(&vfe->lock); 1237 1.18.2.2 jdolecek 1238 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1239 1.18.2.2 jdolecek return (0); 1240 1.18.2.2 jdolecek } 1241 1.18.2.2 jdolecek 1242 1.18.2.2 jdolecek int 1243 1.18.2.2 jdolecek veriexec_unmountchk(struct mount *mp) 1244 1.18.2.2 jdolecek { 1245 1.18.2.2 jdolecek int error; 1246 1.18.2.2 jdolecek 1247 1.18.2.2 jdolecek if ((veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 1248 1.18.2.2 jdolecek || doing_shutdown) 1249 1.18.2.2 jdolecek return (0); 1250 1.18.2.2 jdolecek 1251 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 1252 1.18.2.2 jdolecek 1253 1.18.2.2 jdolecek switch (veriexec_strict) { 1254 1.18.2.2 jdolecek case VERIEXEC_LEARNING: 1255 1.18.2.2 jdolecek error = 0; 1256 1.18.2.2 jdolecek break; 1257 1.18.2.2 jdolecek 1258 1.18.2.2 jdolecek case VERIEXEC_IDS: 1259 1.18.2.2 jdolecek if (veriexec_table_lookup(mp) != NULL) { 1260 1.18.2.2 jdolecek log(LOG_INFO, "Veriexec: IDS mode, allowing unmount " 1261 1.18.2.2 jdolecek "of \"%s\".\n", mp->mnt_stat.f_mntonname); 1262 1.18.2.2 jdolecek } 1263 1.18.2.2 jdolecek 1264 1.18.2.2 jdolecek error = 0; 1265 1.18.2.2 jdolecek break; 1266 1.18.2.2 jdolecek 1267 1.18.2.2 jdolecek case VERIEXEC_IPS: { 1268 1.18.2.2 jdolecek struct veriexec_table_entry *vte; 1269 1.18.2.2 jdolecek 1270 1.18.2.2 jdolecek vte = veriexec_table_lookup(mp); 1271 1.18.2.2 jdolecek if ((vte != NULL) && (vte->vte_count > 0)) { 1272 1.18.2.2 jdolecek log(LOG_ALERT, "Veriexec: IPS mode, preventing" 1273 1.18.2.2 jdolecek " unmount of \"%s\" with monitored files.\n", 1274 1.18.2.2 jdolecek mp->mnt_stat.f_mntonname); 1275 1.18.2.2 jdolecek 1276 1.18.2.2 jdolecek error = EPERM; 1277 1.18.2.2 jdolecek } else 1278 1.18.2.2 jdolecek error = 0; 1279 1.18.2.2 jdolecek break; 1280 1.18.2.2 jdolecek } 1281 1.18.2.2 jdolecek 1282 1.18.2.2 jdolecek case VERIEXEC_LOCKDOWN: 1283 1.18.2.2 jdolecek default: 1284 1.18.2.2 jdolecek log(LOG_ALERT, "Veriexec: Lockdown mode, preventing unmount " 1285 1.18.2.2 jdolecek "of \"%s\".\n", mp->mnt_stat.f_mntonname); 1286 1.18.2.2 jdolecek error = EPERM; 1287 1.18.2.2 jdolecek break; 1288 1.18.2.2 jdolecek } 1289 1.18.2.2 jdolecek 1290 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1291 1.18.2.2 jdolecek return (error); 1292 1.18.2.2 jdolecek } 1293 1.18.2.2 jdolecek 1294 1.18.2.2 jdolecek int 1295 1.18.2.2 jdolecek veriexec_openchk(struct lwp *l, struct vnode *vp, const char *path, int fmode) 1296 1.18.2.2 jdolecek { 1297 1.18.2.2 jdolecek struct veriexec_file_entry *vfe = NULL; 1298 1.18.2.2 jdolecek int error = 0; 1299 1.18.2.2 jdolecek 1300 1.18.2.2 jdolecek if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 1301 1.18.2.2 jdolecek return 0; 1302 1.18.2.2 jdolecek 1303 1.18.2.2 jdolecek if (vp == NULL) { 1304 1.18.2.2 jdolecek /* If no creation requested, let this fail normally. */ 1305 1.18.2.2 jdolecek if (!(fmode & O_CREAT)) 1306 1.18.2.2 jdolecek goto out; 1307 1.18.2.2 jdolecek 1308 1.18.2.2 jdolecek /* Lockdown mode: Prevent creation of new files. */ 1309 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_LOCKDOWN) { 1310 1.18.2.2 jdolecek log(LOG_ALERT, "Veriexec: Preventing new file " 1311 1.18.2.2 jdolecek "creation in `%s'.\n", path); 1312 1.18.2.2 jdolecek error = EPERM; 1313 1.18.2.2 jdolecek } 1314 1.18.2.2 jdolecek 1315 1.18.2.2 jdolecek goto out; 1316 1.18.2.2 jdolecek } 1317 1.18.2.2 jdolecek 1318 1.18.2.2 jdolecek rw_enter(&veriexec_op_lock, RW_READER); 1319 1.18.2.2 jdolecek error = veriexec_file_verify(l, vp, path, VERIEXEC_FILE, 1320 1.18.2.2 jdolecek VERIEXEC_FILE_LOCKED, &vfe); 1321 1.18.2.2 jdolecek 1322 1.18.2.2 jdolecek if (error) { 1323 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1324 1.18.2.2 jdolecek goto out; 1325 1.18.2.2 jdolecek } 1326 1.18.2.2 jdolecek 1327 1.18.2.2 jdolecek if ((vfe != NULL) && ((fmode & FWRITE) || (fmode & O_TRUNC))) { 1328 1.18.2.2 jdolecek veriexec_file_report(vfe, "Write access request.", path, l, 1329 1.18.2.2 jdolecek REPORT_ALWAYS | REPORT_ALARM); 1330 1.18.2.2 jdolecek 1331 1.18.2.2 jdolecek /* IPS mode: Deny write access to monitored files. */ 1332 1.18.2.2 jdolecek if (veriexec_strict >= VERIEXEC_IPS) 1333 1.18.2.2 jdolecek error = EPERM; 1334 1.18.2.2 jdolecek else 1335 1.18.2.2 jdolecek veriexec_file_purge(vfe, VERIEXEC_LOCKED); 1336 1.18.2.2 jdolecek } 1337 1.18.2.2 jdolecek 1338 1.18.2.2 jdolecek if (vfe != NULL) 1339 1.18.2.2 jdolecek rw_exit(&vfe->lock); 1340 1.18.2.2 jdolecek 1341 1.18.2.2 jdolecek rw_exit(&veriexec_op_lock); 1342 1.18.2.2 jdolecek out: 1343 1.18.2.2 jdolecek return (error); 1344 1.18.2.2 jdolecek } 1345 1.18.2.2 jdolecek 1346 1.18.2.2 jdolecek static void 1347 1.18.2.2 jdolecek veriexec_file_dump(struct veriexec_file_entry *vfe, prop_array_t entries) 1348 1.18.2.2 jdolecek { 1349 1.18.2.2 jdolecek prop_dictionary_t entry; 1350 1.18.2.2 jdolecek 1351 1.18.2.2 jdolecek /* If we don't have a filename, this is meaningless. */ 1352 1.18.2.2 jdolecek if (vfe->filename == NULL) 1353 1.18.2.2 jdolecek return; 1354 1.18.2.2 jdolecek 1355 1.18.2.2 jdolecek entry = prop_dictionary_create(); 1356 1.18.2.2 jdolecek 1357 1.18.2.2 jdolecek veriexec_file_convert(vfe, entry); 1358 1.18.2.2 jdolecek 1359 1.18.2.2 jdolecek prop_array_add(entries, entry); 1360 1.18.2.2 jdolecek } 1361 1.18.2.2 jdolecek 1362 1.18.2.2 jdolecek int 1363 1.18.2.2 jdolecek veriexec_dump(struct lwp *l, prop_array_t rarray) 1364 1.18.2.2 jdolecek { 1365 1.18.2.2 jdolecek mount_iterator_t *iter; 1366 1.18.2.2 jdolecek struct mount *mp; 1367 1.18.2.2 jdolecek 1368 1.18.2.2 jdolecek mountlist_iterator_init(&iter); 1369 1.18.2.2 jdolecek while ((mp = mountlist_iterator_next(iter)) != NULL) { 1370 1.18.2.2 jdolecek fileassoc_table_run(mp, veriexec_hook, 1371 1.18.2.2 jdolecek (fileassoc_cb_t)veriexec_file_dump, rarray); 1372 1.18.2.2 jdolecek } 1373 1.18.2.2 jdolecek mountlist_iterator_destroy(iter); 1374 1.18.2.2 jdolecek 1375 1.18.2.2 jdolecek return (0); 1376 1.18.2.2 jdolecek } 1377 1.18.2.2 jdolecek 1378 1.18.2.2 jdolecek int 1379 1.18.2.2 jdolecek veriexec_flush(struct lwp *l) 1380 1.18.2.2 jdolecek { 1381 1.18.2.2 jdolecek mount_iterator_t *iter; 1382 1.18.2.2 jdolecek struct mount *mp; 1383 1.18.2.2 jdolecek int error = 0; 1384 1.18.2.2 jdolecek 1385 1.18.2.2 jdolecek mountlist_iterator_init(&iter); 1386 1.18.2.2 jdolecek while ((mp = mountlist_iterator_next(iter)) != NULL) { 1387 1.18.2.2 jdolecek int lerror; 1388 1.18.2.2 jdolecek 1389 1.18.2.2 jdolecek lerror = veriexec_table_delete(l, mp); 1390 1.18.2.2 jdolecek if (lerror && lerror != ENOENT) 1391 1.18.2.2 jdolecek error = lerror; 1392 1.18.2.2 jdolecek } 1393 1.18.2.2 jdolecek mountlist_iterator_destroy(iter); 1394 1.18.2.2 jdolecek 1395 1.18.2.2 jdolecek return (error); 1396 1.18.2.2 jdolecek } 1397
Indexes created Wed Sep 24 15:09:51 GMT 2025