kern_veriexec.c revision 1.3
1 /* $NetBSD: kern_veriexec.c,v 1.3 2015/04/25 09:08:51 maxv Exp $ */ 2 3 /*- 4 * Copyright (c) 2005, 2006 Elad Efrat <elad (at) NetBSD.org> 5 * Copyright (c) 2005, 2006 Brett Lymn <blymn (at) NetBSD.org> 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the authors may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <sys/cdefs.h> 32 __KERNEL_RCSID(0, "$NetBSD: kern_veriexec.c,v 1.3 2015/04/25 09:08:51 maxv Exp $"); 33 34 #include "opt_veriexec.h" 35 36 #include <sys/param.h> 37 #include <sys/mount.h> 38 #include <sys/kmem.h> 39 #include <sys/vnode.h> 40 #include <sys/namei.h> 41 #include <sys/exec.h> 42 #include <sys/once.h> 43 #include <sys/proc.h> 44 #include <sys/rwlock.h> 45 #include <sys/syslog.h> 46 #include <sys/sysctl.h> 47 #include <sys/inttypes.h> 48 #include <sys/verified_exec.h> 49 #if defined(__FreeBSD__) 50 # include <sys/systm.h> 51 # include <sys/imgact.h> 52 # include <crypto/sha1.h> 53 # include <crypto/sha2/sha2.h> 54 # include <crypto/ripemd160/rmd160.h> 55 #else 56 # include <sys/sha1.h> 57 # include <sys/sha2.h> 58 # include <sys/rmd160.h> 59 #endif 60 #include <sys/md5.h> 61 #include <uvm/uvm_extern.h> 62 #include <sys/fileassoc.h> 63 #include <sys/kauth.h> 64 #include <sys/conf.h> 65 #include <miscfs/specfs/specdev.h> 66 #include <prop/proplib.h> 67 #include <sys/fcntl.h> 68 69 /* Readable values for veriexec_file_report(). */ 70 #define REPORT_ALWAYS 0x01 /* Always print */ 71 #define REPORT_VERBOSE 0x02 /* Print when verbose >= 1 */ 72 #define REPORT_DEBUG 0x04 /* Print when verbose >= 2 (debug) */ 73 #define REPORT_PANIC 0x08 /* Call panic() */ 74 #define REPORT_ALARM 0x10 /* Alarm - also print pid/uid/.. */ 75 #define REPORT_LOGMASK (REPORT_ALWAYS|REPORT_VERBOSE|REPORT_DEBUG) 76 77 /* state of locking for veriexec_file_verify */ 78 #define VERIEXEC_UNLOCKED 0x00 /* Nothing locked, callee does it */ 79 #define VERIEXEC_LOCKED 0x01 /* Global op lock held */ 80 81 /* state of file locking for veriexec_file_verify */ 82 #define VERIEXEC_FILE_UNLOCKED 0x02 /* Nothing locked, callee does it */ 83 #define VERIEXEC_FILE_LOCKED 0x04 /* File locked */ 84 85 #define VERIEXEC_RW_UPGRADE(lock) while((rw_tryupgrade(lock)) == 0){}; 86 87 struct veriexec_fpops { 88 const char *type; 89 size_t hash_len; 90 size_t context_size; 91 veriexec_fpop_init_t init; 92 veriexec_fpop_update_t update; 93 veriexec_fpop_final_t final; 94 LIST_ENTRY(veriexec_fpops) entries; 95 }; 96 97 /* Veriexec per-file entry data. */ 98 struct veriexec_file_entry { 99 krwlock_t lock; /* r/w lock */ 100 u_char *filename; /* File name. */ 101 u_char type; /* Entry type. */ 102 u_char status; /* Evaluation status. */ 103 u_char page_fp_status; /* Per-page FP status. */ 104 u_char *fp; /* Fingerprint. */ 105 void *page_fp; /* Per-page fingerprints */ 106 size_t npages; /* Number of pages. */ 107 size_t last_page_size; /* To support < PAGE_SIZE */ 108 struct veriexec_fpops *ops; /* Fingerprint ops vector*/ 109 size_t filename_len; /* Length of filename. */ 110 }; 111 112 /* Veriexec per-table data. */ 113 struct veriexec_table_entry { 114 uint64_t vte_count; /* Number of Veriexec entries. */ 115 const struct sysctlnode *vte_node; 116 }; 117 118 static int veriexec_verbose; 119 static int veriexec_strict; 120 static int veriexec_bypass = 1; 121 122 static char *veriexec_fp_names = NULL; 123 static size_t veriexec_name_max = 0; 124 125 static const struct sysctlnode *veriexec_count_node; 126 127 static fileassoc_t veriexec_hook; 128 static specificdata_key_t veriexec_mountspecific_key; 129 130 static LIST_HEAD(, veriexec_fpops) veriexec_fpops_list = 131 LIST_HEAD_INITIALIZER(veriexec_fpops_list); 132 133 static int veriexec_raw_cb(kauth_cred_t, kauth_action_t, void *, 134 void *, void *, void *, void *); 135 static struct veriexec_fpops *veriexec_fpops_lookup(const char *); 136 static void veriexec_file_free(struct veriexec_file_entry *); 137 138 static unsigned int veriexec_tablecount = 0; 139 140 /* 141 * Veriexec operations global lock - most ops hold this as a read 142 * lock, it is upgraded to a write lock when destroying veriexec file 143 * table entries. 144 */ 145 static krwlock_t veriexec_op_lock; 146 147 /* 148 * Sysctl helper routine for Veriexec. 149 */ 150 static int 151 sysctl_kern_veriexec_algorithms(SYSCTLFN_ARGS) 152 { 153 size_t len; 154 int error; 155 const char *p; 156 157 if (newp != NULL) 158 return EPERM; 159 160 if (namelen != 0) 161 return EINVAL; 162 163 p = veriexec_fp_names == NULL ? "" : veriexec_fp_names; 164 165 len = strlen(p) + 1; 166 167 if (*oldlenp < len && oldp) 168 return ENOMEM; 169 170 if (oldp && (error = copyout(p, oldp, len)) != 0) 171 return error; 172 173 *oldlenp = len; 174 return 0; 175 } 176 177 static int 178 sysctl_kern_veriexec_strict(SYSCTLFN_ARGS) 179 { 180 struct sysctlnode node; 181 int error, newval; 182 183 node = *rnode; 184 node.sysctl_data = &newval; 185 186 newval = veriexec_strict; 187 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 188 if (error || newp == NULL) 189 return error; 190 191 if (newval < veriexec_strict) 192 return EPERM; 193 194 veriexec_strict = newval; 195 196 return 0; 197 } 198 199 SYSCTL_SETUP(sysctl_kern_veriexec_setup, "sysctl kern.veriexec setup") 200 { 201 const struct sysctlnode *rnode = NULL; 202 203 sysctl_createv(clog, 0, NULL, &rnode, 204 CTLFLAG_PERMANENT, 205 CTLTYPE_NODE, "veriexec", 206 SYSCTL_DESCR("Veriexec"), 207 NULL, 0, NULL, 0, 208 CTL_KERN, CTL_CREATE, CTL_EOL); 209 210 sysctl_createv(clog, 0, &rnode, NULL, 211 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 212 CTLTYPE_INT, "verbose", 213 SYSCTL_DESCR("Veriexec verbose level"), 214 NULL, 0, &veriexec_verbose, 0, 215 CTL_CREATE, CTL_EOL); 216 sysctl_createv(clog, 0, &rnode, NULL, 217 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 218 CTLTYPE_INT, "strict", 219 SYSCTL_DESCR("Veriexec strict level"), 220 sysctl_kern_veriexec_strict, 0, NULL, 0, 221 CTL_CREATE, CTL_EOL); 222 sysctl_createv(clog, 0, &rnode, NULL, 223 CTLFLAG_PERMANENT, 224 CTLTYPE_STRING, "algorithms", 225 SYSCTL_DESCR("Veriexec supported hashing " 226 "algorithms"), 227 sysctl_kern_veriexec_algorithms, 0, NULL, 0, 228 CTL_CREATE, CTL_EOL); 229 sysctl_createv(clog, 0, &rnode, &veriexec_count_node, 230 CTLFLAG_PERMANENT, 231 CTLTYPE_NODE, "count", 232 SYSCTL_DESCR("Number of fingerprints on mount(s)"), 233 NULL, 0, NULL, 0, 234 CTL_CREATE, CTL_EOL); 235 } 236 237 /* 238 * Add ops to the fignerprint ops vector list. 239 */ 240 int 241 veriexec_fpops_add(const char *fp_type, size_t hash_len, size_t ctx_size, 242 veriexec_fpop_init_t init, veriexec_fpop_update_t update, 243 veriexec_fpop_final_t final) 244 { 245 struct veriexec_fpops *ops; 246 247 /* Sanity check all parameters. */ 248 if ((fp_type == NULL) || (hash_len == 0) || (ctx_size == 0) || 249 (init == NULL) || (update == NULL) || (final == NULL)) 250 return (EFAULT); 251 252 if (veriexec_fpops_lookup(fp_type) != NULL) 253 return (EEXIST); 254 255 ops = kmem_alloc(sizeof(*ops), KM_SLEEP); 256 257 ops->type = fp_type; 258 ops->hash_len = hash_len; 259 ops->context_size = ctx_size; 260 ops->init = init; 261 ops->update = update; 262 ops->final = final; 263 264 LIST_INSERT_HEAD(&veriexec_fpops_list, ops, entries); 265 266 /* 267 * If we don't have space for any names, allocate enough for six 268 * which should be sufficient. (it's also enough for all algorithms 269 * we can support at the moment) 270 */ 271 if (veriexec_fp_names == NULL) { 272 veriexec_name_max = 64; 273 veriexec_fp_names = kmem_zalloc(veriexec_name_max, KM_SLEEP); 274 } 275 276 /* 277 * If we're running out of space for storing supported algorithms, 278 * extend the buffer with space for four names. 279 */ 280 while (veriexec_name_max - (strlen(veriexec_fp_names) + 1) < 281 strlen(fp_type)) { 282 char *newp; 283 unsigned int new_max; 284 285 /* Add space for four algorithm names. */ 286 new_max = veriexec_name_max + 64; 287 newp = kmem_zalloc(new_max, KM_SLEEP); 288 strlcpy(newp, veriexec_fp_names, new_max); 289 kmem_free(veriexec_fp_names, veriexec_name_max); 290 veriexec_fp_names = newp; 291 veriexec_name_max = new_max; 292 } 293 294 if (*veriexec_fp_names != '\0') 295 strlcat(veriexec_fp_names, " ", veriexec_name_max); 296 297 strlcat(veriexec_fp_names, fp_type, veriexec_name_max); 298 299 return (0); 300 } 301 302 static void 303 veriexec_mountspecific_dtor(void *v) 304 { 305 struct veriexec_table_entry *vte = v; 306 307 if (vte == NULL) { 308 return; 309 } 310 sysctl_free(__UNCONST(vte->vte_node)); 311 veriexec_tablecount--; 312 kmem_free(vte, sizeof(*vte)); 313 } 314 315 static int 316 veriexec_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 317 void *arg0, void *arg1, void *arg2, void *arg3) 318 { 319 int result; 320 enum kauth_system_req req; 321 322 if (action != KAUTH_SYSTEM_VERIEXEC) 323 return KAUTH_RESULT_DEFER; 324 325 result = KAUTH_RESULT_DEFER; 326 req = (enum kauth_system_req)arg0; 327 328 if (req == KAUTH_REQ_SYSTEM_VERIEXEC_MODIFY && 329 veriexec_strict > VERIEXEC_LEARNING) { 330 log(LOG_WARNING, "Veriexec: Strict mode, modifying " 331 "tables not permitted.\n"); 332 333 result = KAUTH_RESULT_DENY; 334 } 335 336 return result; 337 } 338 339 /* 340 * Initialise Veriexec. 341 */ 342 void 343 veriexec_init(void) 344 { 345 int error; 346 347 /* Register a fileassoc for Veriexec. */ 348 error = fileassoc_register("veriexec", 349 (fileassoc_cleanup_cb_t)veriexec_file_free, &veriexec_hook); 350 if (error) 351 panic("Veriexec: Can't register fileassoc: error=%d", error); 352 353 /* Register listener to handle raw disk access. */ 354 if (kauth_listen_scope(KAUTH_SCOPE_DEVICE, veriexec_raw_cb, NULL) == 355 NULL) 356 panic("Veriexec: Can't listen on device scope"); 357 358 error = mount_specific_key_create(&veriexec_mountspecific_key, 359 veriexec_mountspecific_dtor); 360 if (error) 361 panic("Veriexec: Can't create mountspecific key"); 362 363 if (kauth_listen_scope(KAUTH_SCOPE_SYSTEM, veriexec_listener_cb, 364 NULL) == NULL) 365 panic("Veriexec: Can't listen on system scope"); 366 367 rw_init(&veriexec_op_lock); 368 369 #define FPOPS_ADD(a, b, c, d, e, f) \ 370 veriexec_fpops_add(a, b, c, (veriexec_fpop_init_t)d, \ 371 (veriexec_fpop_update_t)e, (veriexec_fpop_final_t)f) 372 373 #ifdef VERIFIED_EXEC_FP_RMD160 374 FPOPS_ADD("RMD160", RMD160_DIGEST_LENGTH, sizeof(RMD160_CTX), 375 RMD160Init, RMD160Update, RMD160Final); 376 #endif /* VERIFIED_EXEC_FP_RMD160 */ 377 378 #ifdef VERIFIED_EXEC_FP_SHA256 379 FPOPS_ADD("SHA256", SHA256_DIGEST_LENGTH, sizeof(SHA256_CTX), 380 SHA256_Init, SHA256_Update, SHA256_Final); 381 #endif /* VERIFIED_EXEC_FP_SHA256 */ 382 383 #ifdef VERIFIED_EXEC_FP_SHA384 384 FPOPS_ADD("SHA384", SHA384_DIGEST_LENGTH, sizeof(SHA384_CTX), 385 SHA384_Init, SHA384_Update, SHA384_Final); 386 #endif /* VERIFIED_EXEC_FP_SHA384 */ 387 388 #ifdef VERIFIED_EXEC_FP_SHA512 389 FPOPS_ADD("SHA512", SHA512_DIGEST_LENGTH, sizeof(SHA512_CTX), 390 SHA512_Init, SHA512_Update, SHA512_Final); 391 #endif /* VERIFIED_EXEC_FP_SHA512 */ 392 393 #ifdef VERIFIED_EXEC_FP_SHA1 394 FPOPS_ADD("SHA1", SHA1_DIGEST_LENGTH, sizeof(SHA1_CTX), 395 SHA1Init, SHA1Update, SHA1Final); 396 #endif /* VERIFIED_EXEC_FP_SHA1 */ 397 398 #ifdef VERIFIED_EXEC_FP_MD5 399 FPOPS_ADD("MD5", MD5_DIGEST_LENGTH, sizeof(MD5_CTX), 400 MD5Init, MD5Update, MD5Final); 401 #endif /* VERIFIED_EXEC_FP_MD5 */ 402 403 #undef FPOPS_ADD 404 } 405 406 static struct veriexec_fpops * 407 veriexec_fpops_lookup(const char *name) 408 { 409 struct veriexec_fpops *ops; 410 411 if (name == NULL) 412 return (NULL); 413 414 LIST_FOREACH(ops, &veriexec_fpops_list, entries) { 415 if (strcasecmp(name, ops->type) == 0) 416 return (ops); 417 } 418 419 return (NULL); 420 } 421 422 /* 423 * Calculate fingerprint. Information on hash length and routines used is 424 * extracted from veriexec_hash_list according to the hash type. 425 * 426 * NOTE: vfe is assumed to be locked for writing on entry. 427 */ 428 static int 429 veriexec_fp_calc(struct lwp *l, struct vnode *vp, int file_lock_state, 430 struct veriexec_file_entry *vfe, u_char *fp) 431 { 432 struct vattr va; 433 void *ctx, *page_ctx; 434 u_char *buf, *page_fp; 435 off_t offset, len; 436 size_t resid, npages; 437 int error, do_perpage, pagen; 438 439 KASSERT((file_lock_state != VERIEXEC_LOCKED) && 440 (file_lock_state != VERIEXEC_UNLOCKED)); 441 442 if (file_lock_state == VERIEXEC_FILE_UNLOCKED) 443 vn_lock(vp, LK_SHARED | LK_RETRY); 444 error = VOP_GETATTR(vp, &va, l->l_cred); 445 if (file_lock_state == VERIEXEC_FILE_UNLOCKED) 446 VOP_UNLOCK(vp); 447 if (error) 448 return (error); 449 450 #ifdef notyet /* XXX - for now */ 451 if ((vfe->type & VERIEXEC_UNTRUSTED) && 452 (vfe->page_fp_status == PAGE_FP_NONE)) 453 do_perpage = 1; 454 else 455 #endif /* notyet */ 456 do_perpage = 0; 457 458 ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 459 buf = kmem_alloc(PAGE_SIZE, KM_SLEEP); 460 461 page_ctx = NULL; 462 page_fp = NULL; 463 npages = 0; 464 if (do_perpage) { 465 npages = (va.va_size >> PAGE_SHIFT) + 1; 466 page_fp = kmem_alloc(vfe->ops->hash_len * npages, KM_SLEEP); 467 vfe->page_fp = page_fp; 468 page_ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 469 } 470 471 (vfe->ops->init)(ctx); 472 473 len = 0; 474 error = 0; 475 pagen = 0; 476 for (offset = 0; offset < va.va_size; offset += PAGE_SIZE) { 477 len = ((va.va_size - offset) < PAGE_SIZE) ? 478 (va.va_size - offset) : PAGE_SIZE; 479 480 error = vn_rdwr(UIO_READ, vp, buf, len, offset, 481 UIO_SYSSPACE, 482 ((file_lock_state == VERIEXEC_FILE_LOCKED)? 483 IO_NODELOCKED : 0), 484 l->l_cred, &resid, NULL); 485 486 if (error) { 487 if (do_perpage) { 488 kmem_free(vfe->page_fp, 489 vfe->ops->hash_len * npages); 490 vfe->page_fp = NULL; 491 } 492 493 goto bad; 494 } 495 496 (vfe->ops->update)(ctx, buf, (unsigned int) len); 497 498 if (do_perpage) { 499 (vfe->ops->init)(page_ctx); 500 (vfe->ops->update)(page_ctx, buf, (unsigned int)len); 501 (vfe->ops->final)(page_fp, page_ctx); 502 503 if (veriexec_verbose >= 2) { 504 int i; 505 506 printf("hash for page %d: ", pagen); 507 for (i = 0; i < vfe->ops->hash_len; i++) 508 printf("%02x", page_fp[i]); 509 printf("\n"); 510 } 511 512 page_fp += vfe->ops->hash_len; 513 pagen++; 514 } 515 516 if (len != PAGE_SIZE) 517 break; 518 } 519 520 (vfe->ops->final)(fp, ctx); 521 522 if (do_perpage) { 523 vfe->last_page_size = len; 524 vfe->page_fp_status = PAGE_FP_READY; 525 vfe->npages = npages; 526 } 527 528 bad: 529 if (do_perpage) 530 kmem_free(page_ctx, vfe->ops->context_size); 531 532 kmem_free(ctx, vfe->ops->context_size); 533 kmem_free(buf, PAGE_SIZE); 534 535 return (error); 536 } 537 538 /* Compare two fingerprints of the same type. */ 539 static int 540 veriexec_fp_cmp(struct veriexec_fpops *ops, u_char *fp1, u_char *fp2) 541 { 542 if (veriexec_verbose >= 2) { 543 int i; 544 545 printf("comparing hashes...\n"); 546 printf("fp1: "); 547 for (i = 0; i < ops->hash_len; i++) { 548 printf("%02x", fp1[i]); 549 } 550 printf("\nfp2: "); 551 for (i = 0; i < ops->hash_len; i++) { 552 printf("%02x", fp2[i]); 553 } 554 printf("\n"); 555 } 556 557 return (memcmp(fp1, fp2, ops->hash_len)); 558 } 559 560 static struct veriexec_table_entry * 561 veriexec_table_lookup(struct mount *mp) 562 { 563 /* XXX: From raidframe init */ 564 if (mp == NULL) 565 return NULL; 566 567 return mount_getspecific(mp, veriexec_mountspecific_key); 568 } 569 570 static struct veriexec_file_entry * 571 veriexec_get(struct vnode *vp) 572 { 573 return (fileassoc_lookup(vp, veriexec_hook)); 574 } 575 576 bool 577 veriexec_lookup(struct vnode *vp) 578 { 579 return (veriexec_get(vp) == NULL ? false : true); 580 } 581 582 /* 583 * Routine for maintaining mostly consistent message formats in Veriexec. 584 */ 585 static void 586 veriexec_file_report(struct veriexec_file_entry *vfe, const u_char *msg, 587 const u_char *filename, struct lwp *l, int f) 588 { 589 if (vfe != NULL && vfe->filename != NULL) 590 filename = vfe->filename; 591 592 if (filename == NULL) 593 return; 594 595 if (((f & REPORT_LOGMASK) >> 1) <= veriexec_verbose) { 596 if (!(f & REPORT_ALARM) || (l == NULL)) 597 log(LOG_NOTICE, "Veriexec: %s [%s]\n", msg, 598 filename); 599 else 600 log(LOG_ALERT, "Veriexec: %s [%s, prog=%s pid=%u, " 601 "uid=%u, gid=%u]\n", msg, filename, 602 l->l_proc->p_comm, l->l_proc->p_pid, 603 kauth_cred_getuid(l->l_cred), 604 kauth_cred_getgid(l->l_cred)); 605 } 606 607 if (f & REPORT_PANIC) 608 panic("Veriexec: Unrecoverable error."); 609 } 610 611 /* 612 * Verify the fingerprint of the given file. If we're called directly from 613 * sys_execve(), 'flag' will be VERIEXEC_DIRECT. If we're called from 614 * exec_script(), 'flag' will be VERIEXEC_INDIRECT. If we are called from 615 * vn_open(), 'flag' will be VERIEXEC_FILE. 616 * 617 * 'veriexec_op_lock' must be locked (and remains locked). 618 * 619 * NOTE: The veriexec file entry pointer (vfep) will be returned LOCKED 620 * on no error. 621 */ 622 static int 623 veriexec_file_verify(struct lwp *l, struct vnode *vp, const u_char *name, 624 int flag, int file_lock_state, struct veriexec_file_entry **vfep) 625 { 626 struct veriexec_file_entry *vfe; 627 int error; 628 629 KASSERT(rw_lock_held(&veriexec_op_lock)); 630 KASSERT((file_lock_state != VERIEXEC_LOCKED) && 631 (file_lock_state != VERIEXEC_UNLOCKED)); 632 633 #define VFE_NEEDS_EVAL(vfe) ((vfe->status == FINGERPRINT_NOTEVAL) || \ 634 (vfe->type & VERIEXEC_UNTRUSTED)) 635 636 if (vfep != NULL) 637 *vfep = NULL; 638 639 if (vp->v_type != VREG) 640 return (0); 641 642 /* Lookup veriexec table entry, save pointer if requested. */ 643 vfe = veriexec_get(vp); 644 if (vfep != NULL) 645 *vfep = vfe; 646 if (vfe == NULL) 647 goto out; 648 649 error = 0; 650 651 /* 652 * Grab the lock for the entry, if we need to do an evaluation 653 * then the lock is a write lock, after we have the write 654 * lock, check if we really need it - some other thread may 655 * have already done the work for us. 656 */ 657 if (VFE_NEEDS_EVAL(vfe)) { 658 rw_enter(&vfe->lock, RW_WRITER); 659 if (!VFE_NEEDS_EVAL(vfe)) 660 rw_downgrade(&vfe->lock); 661 } else 662 rw_enter(&vfe->lock, RW_READER); 663 664 /* Evaluate fingerprint if needed. */ 665 if (VFE_NEEDS_EVAL(vfe)) { 666 u_char *digest; 667 668 /* Calculate fingerprint for on-disk file. */ 669 digest = kmem_zalloc(vfe->ops->hash_len, KM_SLEEP); 670 671 error = veriexec_fp_calc(l, vp, file_lock_state, vfe, digest); 672 if (error) { 673 veriexec_file_report(vfe, "Fingerprint calculation error.", 674 name, NULL, REPORT_ALWAYS); 675 kmem_free(digest, vfe->ops->hash_len); 676 rw_exit(&vfe->lock); 677 return (error); 678 } 679 680 /* Compare fingerprint with loaded data. */ 681 if (veriexec_fp_cmp(vfe->ops, vfe->fp, digest) == 0) 682 vfe->status = FINGERPRINT_VALID; 683 else 684 vfe->status = FINGERPRINT_NOMATCH; 685 686 kmem_free(digest, vfe->ops->hash_len); 687 rw_downgrade(&vfe->lock); 688 } 689 690 if (!(vfe->type & flag)) { 691 veriexec_file_report(vfe, "Incorrect access type.", name, l, 692 REPORT_ALWAYS|REPORT_ALARM); 693 694 /* IPS mode: Enforce access type. */ 695 if (veriexec_strict >= VERIEXEC_IPS) { 696 rw_exit(&vfe->lock); 697 return (EPERM); 698 } 699 } 700 701 out: 702 /* No entry in the veriexec tables. */ 703 if (vfe == NULL) { 704 veriexec_file_report(NULL, "No entry.", name, 705 l, REPORT_VERBOSE); 706 707 /* 708 * Lockdown mode: Deny access to non-monitored files. 709 * IPS mode: Deny execution of non-monitored files. 710 */ 711 if ((veriexec_strict >= VERIEXEC_LOCKDOWN) || 712 ((veriexec_strict >= VERIEXEC_IPS) && 713 (flag != VERIEXEC_FILE))) 714 return (EPERM); 715 716 return (0); 717 } 718 719 switch (vfe->status) { 720 case FINGERPRINT_NOTEVAL: 721 /* Should not happen. */ 722 rw_exit(&vfe->lock); 723 veriexec_file_report(vfe, "Not-evaluated status " 724 "post evaluation; inconsistency detected.", name, 725 NULL, REPORT_ALWAYS|REPORT_PANIC); 726 /* NOTREACHED */ 727 728 case FINGERPRINT_VALID: 729 /* Valid fingerprint. */ 730 veriexec_file_report(vfe, "Match.", name, NULL, 731 REPORT_VERBOSE); 732 733 break; 734 735 case FINGERPRINT_NOMATCH: 736 /* Fingerprint mismatch. */ 737 veriexec_file_report(vfe, "Mismatch.", name, 738 NULL, REPORT_ALWAYS|REPORT_ALARM); 739 740 /* IDS mode: Deny access on fingerprint mismatch. */ 741 if (veriexec_strict >= VERIEXEC_IDS) { 742 rw_exit(&vfe->lock); 743 error = EPERM; 744 } 745 746 break; 747 748 default: 749 /* Should never happen. */ 750 rw_exit(&vfe->lock); 751 veriexec_file_report(vfe, "Invalid status " 752 "post evaluation.", name, NULL, REPORT_ALWAYS|REPORT_PANIC); 753 /* NOTREACHED */ 754 } 755 756 return (error); 757 } 758 759 int 760 veriexec_verify(struct lwp *l, struct vnode *vp, const u_char *name, int flag, 761 bool *found) 762 { 763 struct veriexec_file_entry *vfe; 764 int r; 765 766 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 767 return 0; 768 769 rw_enter(&veriexec_op_lock, RW_READER); 770 r = veriexec_file_verify(l, vp, name, flag, VERIEXEC_FILE_UNLOCKED, 771 &vfe); 772 rw_exit(&veriexec_op_lock); 773 774 if ((r == 0) && (vfe != NULL)) 775 rw_exit(&vfe->lock); 776 777 if (found != NULL) 778 *found = (vfe != NULL) ? true : false; 779 780 return (r); 781 } 782 783 #ifdef notyet 784 /* 785 * Evaluate per-page fingerprints. 786 */ 787 int 788 veriexec_page_verify(struct veriexec_file_entry *vfe, struct vm_page *pg, 789 size_t idx, struct lwp *l) 790 { 791 void *ctx; 792 u_char *fp; 793 u_char *page_fp; 794 int error; 795 vaddr_t kva; 796 797 if (vfe->page_fp_status == PAGE_FP_NONE) 798 return (0); 799 800 if (vfe->page_fp_status == PAGE_FP_FAIL) 801 return (EPERM); 802 803 if (idx >= vfe->npages) 804 return (0); 805 806 ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 807 fp = kmem_alloc(vfe->ops->hash_len, KM_SLEEP); 808 kva = uvm_km_alloc(kernel_map, PAGE_SIZE, VM_PGCOLOR_BUCKET(pg), 809 UVM_KMF_COLORMATCH | UVM_KMF_VAONLY | UVM_KMF_WAITVA); 810 pmap_kenter_pa(kva, VM_PAGE_TO_PHYS(pg), VM_PROT_READ, 0); 811 pmap_update(pmap_kernel()); 812 813 page_fp = (u_char *) vfe->page_fp + (vfe->ops->hash_len * idx); 814 (vfe->ops->init)(ctx); 815 (vfe->ops->update)(ctx, (void *) kva, 816 ((vfe->npages - 1) == idx) ? vfe->last_page_size 817 : PAGE_SIZE); 818 (vfe->ops->final)(fp, ctx); 819 820 pmap_kremove(kva, PAGE_SIZE); 821 pmap_update(pmap_kernel()); 822 uvm_km_free(kernel_map, kva, PAGE_SIZE, UVM_KMF_VAONLY); 823 824 error = veriexec_fp_cmp(vfe->ops, page_fp, fp); 825 if (error) { 826 const char *msg; 827 828 if (veriexec_strict > VERIEXEC_LEARNING) { 829 msg = "Pages modified: Killing process."; 830 } else { 831 msg = "Pages modified."; 832 error = 0; 833 } 834 835 veriexec_file_report(msg, "[page_in]", l, 836 REPORT_ALWAYS|REPORT_ALARM); 837 838 if (error) { 839 ksiginfo_t ksi; 840 841 KSI_INIT(&ksi); 842 ksi.ksi_signo = SIGKILL; 843 ksi.ksi_code = SI_NOINFO; 844 ksi.ksi_pid = l->l_proc->p_pid; 845 ksi.ksi_uid = 0; 846 847 kpsignal(l->l_proc, &ksi, NULL); 848 } 849 } 850 851 kmem_free(ctx, vfe->ops->context_size); 852 kmem_free(fp, vfe->ops->hash_len); 853 854 return (error); 855 } 856 #endif /* notyet */ 857 858 /* 859 * Veriexec remove policy code. 860 */ 861 int 862 veriexec_removechk(struct lwp *l, struct vnode *vp, const char *pathbuf) 863 { 864 struct veriexec_file_entry *vfe; 865 int error; 866 867 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 868 return 0; 869 870 rw_enter(&veriexec_op_lock, RW_READER); 871 872 vfe = veriexec_get(vp); 873 rw_exit(&veriexec_op_lock); 874 875 if (vfe == NULL) { 876 /* Lockdown mode: Deny access to non-monitored files. */ 877 if (veriexec_strict >= VERIEXEC_LOCKDOWN) 878 return (EPERM); 879 880 return (0); 881 } 882 883 veriexec_file_report(vfe, "Remove request.", pathbuf, l, 884 REPORT_ALWAYS|REPORT_ALARM); 885 886 /* IDS mode: Deny removal of monitored files. */ 887 if (veriexec_strict >= VERIEXEC_IDS) 888 error = EPERM; 889 else 890 error = veriexec_file_delete(l, vp); 891 892 return error; 893 } 894 895 /* 896 * Veriexec rename policy. 897 * 898 * XXX: Once there's a way to hook after a successful rename, it would be 899 * XXX: nice to update vfe->filename to the new name if it's not NULL and 900 * XXX: the new name is absolute (ie., starts with a slash). 901 */ 902 int 903 veriexec_renamechk(struct lwp *l, struct vnode *fromvp, const char *fromname, 904 struct vnode *tovp, const char *toname) 905 { 906 struct veriexec_file_entry *vfe, *tvfe; 907 908 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 909 return 0; 910 911 rw_enter(&veriexec_op_lock, RW_READER); 912 913 if (veriexec_strict >= VERIEXEC_LOCKDOWN) { 914 log(LOG_ALERT, "Veriexec: Preventing rename of `%s' to " 915 "`%s', uid=%u, pid=%u: Lockdown mode.\n", fromname, toname, 916 kauth_cred_geteuid(l->l_cred), l->l_proc->p_pid); 917 918 rw_exit(&veriexec_op_lock); 919 return (EPERM); 920 } 921 922 vfe = veriexec_get(fromvp); 923 tvfe = NULL; 924 if (tovp != NULL) 925 tvfe = veriexec_get(tovp); 926 927 if ((vfe != NULL) || (tvfe != NULL)) { 928 if (veriexec_strict >= VERIEXEC_IPS) { 929 log(LOG_ALERT, "Veriexec: Preventing rename of `%s' " 930 "to `%s', uid=%u, pid=%u: IPS mode, %s " 931 "monitored.\n", fromname, toname, 932 kauth_cred_geteuid(l->l_cred), 933 l->l_proc->p_pid, (vfe != NULL && tvfe != NULL) ? 934 "files" : "file"); 935 936 rw_exit(&veriexec_op_lock); 937 return (EPERM); 938 } 939 940 /* 941 * Monitored file is renamed; filename no longer relevant. 942 * 943 * XXX: We could keep the buffer, and when (and if) updating the 944 * XXX: filename post-rename, re-allocate it only if it's not 945 * XXX: big enough for the new filename. 946 */ 947 if (vfe != NULL) { 948 /* XXXX get write lock on vfe here? */ 949 950 VERIEXEC_RW_UPGRADE(&veriexec_op_lock); 951 /* once we have the op lock in write mode 952 * there should be no locks on any file 953 * entries so we can destroy the object. 954 */ 955 956 if (vfe->filename_len > 0) 957 kmem_free(vfe->filename, vfe->filename_len); 958 959 vfe->filename = NULL; 960 vfe->filename_len = 0; 961 962 rw_downgrade(&veriexec_op_lock); 963 } 964 965 log(LOG_NOTICE, "Veriexec: %s file `%s' renamed to " 966 "%s file `%s', uid=%u, pid=%u.\n", (vfe != NULL) ? 967 "Monitored" : "Non-monitored", fromname, (tvfe != NULL) ? 968 "monitored" : "non-monitored", toname, 969 kauth_cred_geteuid(l->l_cred), l->l_proc->p_pid); 970 971 rw_exit(&veriexec_op_lock); 972 973 /* 974 * Monitored file is overwritten. Remove the entry. 975 */ 976 if (tvfe != NULL) 977 (void)veriexec_file_delete(l, tovp); 978 979 } else 980 rw_exit(&veriexec_op_lock); 981 982 return (0); 983 } 984 985 static void 986 veriexec_file_free(struct veriexec_file_entry *vfe) 987 { 988 if (vfe != NULL) { 989 if (vfe->fp != NULL) 990 kmem_free(vfe->fp, vfe->ops->hash_len); 991 if (vfe->page_fp != NULL) 992 kmem_free(vfe->page_fp, vfe->ops->hash_len); 993 if (vfe->filename != NULL) 994 kmem_free(vfe->filename, vfe->filename_len); 995 rw_destroy(&vfe->lock); 996 kmem_free(vfe, sizeof(*vfe)); 997 } 998 } 999 1000 static void 1001 veriexec_file_purge(struct veriexec_file_entry *vfe, int have_lock) 1002 { 1003 if (vfe == NULL) 1004 return; 1005 1006 if (have_lock == VERIEXEC_UNLOCKED) 1007 rw_enter(&vfe->lock, RW_WRITER); 1008 else 1009 VERIEXEC_RW_UPGRADE(&vfe->lock); 1010 1011 vfe->status = FINGERPRINT_NOTEVAL; 1012 if (have_lock == VERIEXEC_UNLOCKED) 1013 rw_exit(&vfe->lock); 1014 else 1015 rw_downgrade(&vfe->lock); 1016 } 1017 1018 static void 1019 veriexec_file_purge_cb(struct veriexec_file_entry *vfe, void *cookie) 1020 { 1021 veriexec_file_purge(vfe, VERIEXEC_UNLOCKED); 1022 } 1023 1024 /* 1025 * Invalidate a Veriexec file entry. 1026 * XXX: This should be updated when per-page fingerprints are added. 1027 */ 1028 void 1029 veriexec_purge(struct vnode *vp) 1030 { 1031 rw_enter(&veriexec_op_lock, RW_READER); 1032 veriexec_file_purge(veriexec_get(vp), VERIEXEC_UNLOCKED); 1033 rw_exit(&veriexec_op_lock); 1034 } 1035 1036 /* 1037 * Enforce raw disk access policy. 1038 * 1039 * IDS mode: Invalidate fingerprints on a mount if it's opened for writing. 1040 * IPS mode: Don't allow raw writing to disks we monitor. 1041 * Lockdown mode: Don't allow raw writing to all disks. 1042 * 1043 * XXX: This is bogus. There's an obvious race condition between the time 1044 * XXX: the disk is open for writing, in which an attacker can access a 1045 * XXX: monitored file to get its signature cached again, and when the raw 1046 * XXX: file is overwritten on disk. 1047 * XXX: 1048 * XXX: To solve this, we need something like the following: 1049 * XXX: open raw disk: 1050 * XXX: - raise refcount, 1051 * XXX: - invalidate fingerprints, 1052 * XXX: - mark all entries for that disk with "no cache" flag 1053 * XXX: 1054 * XXX: veriexec_verify: 1055 * XXX: - if "no cache", don't cache evaluation result 1056 * XXX: 1057 * XXX: close raw disk: 1058 * XXX: - lower refcount, 1059 * XXX: - if refcount == 0, remove "no cache" flag from all entries 1060 */ 1061 static int 1062 veriexec_raw_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 1063 void *arg0, void *arg1, void *arg2, void *arg3) 1064 { 1065 int result; 1066 enum kauth_device_req req; 1067 struct veriexec_table_entry *vte; 1068 1069 result = KAUTH_RESULT_DENY; 1070 req = (enum kauth_device_req)arg0; 1071 1072 switch (action) { 1073 case KAUTH_DEVICE_RAWIO_SPEC: { 1074 struct vnode *vp, *bvp; 1075 int error; 1076 1077 if (req == KAUTH_REQ_DEVICE_RAWIO_SPEC_READ) { 1078 result = KAUTH_RESULT_DEFER; 1079 break; 1080 } 1081 1082 vp = arg1; 1083 KASSERT(vp != NULL); 1084 1085 /* Handle /dev/mem and /dev/kmem. */ 1086 if (iskmemvp(vp)) { 1087 if (veriexec_strict < VERIEXEC_IPS) 1088 result = KAUTH_RESULT_DEFER; 1089 1090 break; 1091 } 1092 1093 error = rawdev_mounted(vp, &bvp); 1094 if (error == EINVAL) { 1095 result = KAUTH_RESULT_DEFER; 1096 break; 1097 } 1098 1099 /* 1100 * XXX: See vfs_mountedon() comment in rawdev_mounted(). 1101 */ 1102 vte = veriexec_table_lookup(bvp->v_mount); 1103 if (vte == NULL) { 1104 result = KAUTH_RESULT_DEFER; 1105 break; 1106 } 1107 1108 switch (veriexec_strict) { 1109 case VERIEXEC_LEARNING: 1110 case VERIEXEC_IDS: 1111 result = KAUTH_RESULT_DEFER; 1112 1113 rw_enter(&veriexec_op_lock, RW_WRITER); 1114 fileassoc_table_run(bvp->v_mount, veriexec_hook, 1115 (fileassoc_cb_t)veriexec_file_purge_cb, NULL); 1116 rw_exit(&veriexec_op_lock); 1117 1118 break; 1119 case VERIEXEC_IPS: 1120 result = KAUTH_RESULT_DENY; 1121 break; 1122 case VERIEXEC_LOCKDOWN: 1123 result = KAUTH_RESULT_DENY; 1124 break; 1125 } 1126 1127 break; 1128 } 1129 1130 case KAUTH_DEVICE_RAWIO_PASSTHRU: 1131 /* XXX What can we do here? */ 1132 if (veriexec_strict < VERIEXEC_IPS) 1133 result = KAUTH_RESULT_DEFER; 1134 1135 break; 1136 1137 default: 1138 result = KAUTH_RESULT_DEFER; 1139 break; 1140 } 1141 1142 return (result); 1143 } 1144 1145 /* 1146 * Create a new Veriexec table. 1147 */ 1148 static struct veriexec_table_entry * 1149 veriexec_table_add(struct lwp *l, struct mount *mp) 1150 { 1151 struct veriexec_table_entry *vte; 1152 u_char buf[16]; 1153 1154 vte = kmem_zalloc(sizeof(*vte), KM_SLEEP); 1155 mount_setspecific(mp, veriexec_mountspecific_key, vte); 1156 1157 snprintf(buf, sizeof(buf), "table%u", veriexec_tablecount++); 1158 sysctl_createv(NULL, 0, &veriexec_count_node, &vte->vte_node, 1159 0, CTLTYPE_NODE, buf, NULL, NULL, 0, NULL, 1160 0, CTL_CREATE, CTL_EOL); 1161 1162 sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1163 CTLFLAG_READONLY, CTLTYPE_STRING, "mntpt", 1164 NULL, NULL, 0, mp->mnt_stat.f_mntonname, 1165 0, CTL_CREATE, CTL_EOL); 1166 sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1167 CTLFLAG_READONLY, CTLTYPE_STRING, "fstype", 1168 NULL, NULL, 0, mp->mnt_stat.f_fstypename, 1169 0, CTL_CREATE, CTL_EOL); 1170 sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1171 CTLFLAG_READONLY, CTLTYPE_QUAD, "nentries", 1172 NULL, NULL, 0, &vte->vte_count, 0, CTL_CREATE, CTL_EOL); 1173 1174 return (vte); 1175 } 1176 1177 /* 1178 * Add a file to be monitored by Veriexec. 1179 * 1180 * Expected elements in dict: file, fp, fp-type, entry-type. 1181 */ 1182 int 1183 veriexec_file_add(struct lwp *l, prop_dictionary_t dict) 1184 { 1185 struct veriexec_table_entry *vte; 1186 struct veriexec_file_entry *vfe = NULL, *hh; 1187 struct vnode *vp; 1188 const char *file, *fp_type; 1189 int error; 1190 1191 if (!prop_dictionary_get_cstring_nocopy(dict, "file", &file)) 1192 return (EINVAL); 1193 1194 error = namei_simple_kernel(file, NSM_FOLLOW_NOEMULROOT, &vp); 1195 if (error) 1196 return (error); 1197 1198 /* Add only regular files. */ 1199 if (vp->v_type != VREG) { 1200 log(LOG_ERR, "Veriexec: Not adding `%s': Not a regular file.\n", 1201 file); 1202 error = EBADF; 1203 goto out; 1204 } 1205 1206 vfe = kmem_zalloc(sizeof(*vfe), KM_SLEEP); 1207 rw_init(&vfe->lock); 1208 1209 /* Lookup fingerprint hashing algorithm. */ 1210 fp_type = prop_string_cstring_nocopy(prop_dictionary_get(dict, 1211 "fp-type")); 1212 if ((vfe->ops = veriexec_fpops_lookup(fp_type)) == NULL) { 1213 log(LOG_ERR, "Veriexec: Invalid or unknown fingerprint type " 1214 "`%s' for file `%s'.\n", fp_type, file); 1215 error = EOPNOTSUPP; 1216 goto out; 1217 } 1218 1219 if (prop_data_size(prop_dictionary_get(dict, "fp")) != 1220 vfe->ops->hash_len) { 1221 log(LOG_ERR, "Veriexec: Bad fingerprint length for `%s'.\n", 1222 file); 1223 error = EINVAL; 1224 goto out; 1225 } 1226 1227 vfe->fp = kmem_alloc(vfe->ops->hash_len, KM_SLEEP); 1228 memcpy(vfe->fp, prop_data_data_nocopy(prop_dictionary_get(dict, "fp")), 1229 vfe->ops->hash_len); 1230 1231 rw_enter(&veriexec_op_lock, RW_WRITER); 1232 1233 /* 1234 * See if we already have an entry for this file. If we do, then 1235 * let the user know and silently pretend to succeed. 1236 */ 1237 hh = veriexec_get(vp); 1238 if (hh != NULL) { 1239 bool fp_mismatch; 1240 1241 if (strcmp(vfe->ops->type, fp_type) || 1242 memcmp(hh->fp, vfe->fp, hh->ops->hash_len)) 1243 fp_mismatch = true; 1244 else 1245 fp_mismatch = false; 1246 1247 if ((veriexec_verbose >= 1) || fp_mismatch) { 1248 log(LOG_NOTICE, "Veriexec: Duplicate entry for `%s' " 1249 "ignored. (%s fingerprint)\n", file, 1250 fp_mismatch ? "different" : "same"); 1251 } 1252 1253 veriexec_file_free(vfe); 1254 1255 /* XXX Should this be EEXIST if fp_mismatch is true? */ 1256 error = 0; 1257 goto unlock_out; 1258 } 1259 1260 /* Continue entry initialization. */ 1261 if (prop_dictionary_get_uint8(dict, "entry-type", &vfe->type) == FALSE) 1262 vfe->type = 0; 1263 else { 1264 uint8_t extra_flags; 1265 1266 extra_flags = vfe->type & ~(VERIEXEC_DIRECT | 1267 VERIEXEC_INDIRECT | VERIEXEC_FILE | VERIEXEC_UNTRUSTED); 1268 if (extra_flags) { 1269 log(LOG_NOTICE, "Veriexec: Contaminated flags `0x%x' " 1270 "for `%s', skipping.\n", extra_flags, file); 1271 error = EINVAL; 1272 goto unlock_out; 1273 } 1274 } 1275 if (!(vfe->type & (VERIEXEC_DIRECT | VERIEXEC_INDIRECT | 1276 VERIEXEC_FILE))) 1277 vfe->type |= VERIEXEC_DIRECT; 1278 1279 vfe->status = FINGERPRINT_NOTEVAL; 1280 if (prop_bool_true(prop_dictionary_get(dict, "keep-filename"))) { 1281 vfe->filename_len = strlen(file) + 1; 1282 vfe->filename = kmem_alloc(vfe->filename_len, KM_SLEEP); 1283 strlcpy(vfe->filename, file, vfe->filename_len); 1284 } else 1285 vfe->filename = NULL; 1286 1287 vfe->page_fp = NULL; 1288 vfe->page_fp_status = PAGE_FP_NONE; 1289 vfe->npages = 0; 1290 vfe->last_page_size = 0; 1291 1292 if (prop_bool_true(prop_dictionary_get(dict, "eval-on-load")) || 1293 (vfe->type & VERIEXEC_UNTRUSTED)) { 1294 u_char *digest; 1295 1296 digest = kmem_zalloc(vfe->ops->hash_len, KM_SLEEP); 1297 1298 error = veriexec_fp_calc(l, vp, VERIEXEC_FILE_UNLOCKED, 1299 vfe, digest); 1300 if (error) { 1301 kmem_free(digest, vfe->ops->hash_len); 1302 goto unlock_out; 1303 } 1304 1305 if (veriexec_fp_cmp(vfe->ops, vfe->fp, digest) == 0) 1306 vfe->status = FINGERPRINT_VALID; 1307 else 1308 vfe->status = FINGERPRINT_NOMATCH; 1309 1310 kmem_free(digest, vfe->ops->hash_len); 1311 } 1312 1313 vte = veriexec_table_lookup(vp->v_mount); 1314 if (vte == NULL) 1315 vte = veriexec_table_add(l, vp->v_mount); 1316 1317 /* XXX if we bail below this, we might want to gc newly created vtes. */ 1318 1319 error = fileassoc_add(vp, veriexec_hook, vfe); 1320 if (error) 1321 goto unlock_out; 1322 1323 vte->vte_count++; 1324 1325 veriexec_file_report(NULL, "New entry.", file, NULL, REPORT_DEBUG); 1326 veriexec_bypass = 0; 1327 1328 unlock_out: 1329 rw_exit(&veriexec_op_lock); 1330 1331 out: 1332 vrele(vp); 1333 if (error) 1334 veriexec_file_free(vfe); 1335 1336 return (error); 1337 } 1338 1339 int 1340 veriexec_table_delete(struct lwp *l, struct mount *mp) { 1341 struct veriexec_table_entry *vte; 1342 1343 vte = veriexec_table_lookup(mp); 1344 if (vte == NULL) 1345 return (ENOENT); 1346 1347 veriexec_mountspecific_dtor(vte); 1348 mount_setspecific(mp, veriexec_mountspecific_key, NULL); 1349 1350 return (fileassoc_table_clear(mp, veriexec_hook)); 1351 } 1352 1353 int 1354 veriexec_file_delete(struct lwp *l, struct vnode *vp) { 1355 struct veriexec_table_entry *vte; 1356 int error; 1357 1358 vte = veriexec_table_lookup(vp->v_mount); 1359 if (vte == NULL) 1360 return (ENOENT); 1361 1362 rw_enter(&veriexec_op_lock, RW_WRITER); 1363 error = fileassoc_clear(vp, veriexec_hook); 1364 rw_exit(&veriexec_op_lock); 1365 if (!error) 1366 vte->vte_count--; 1367 1368 return (error); 1369 } 1370 1371 /* 1372 * Convert Veriexec entry data to a dictionary readable by userland tools. 1373 */ 1374 static void 1375 veriexec_file_convert(struct veriexec_file_entry *vfe, prop_dictionary_t rdict) 1376 { 1377 if (vfe->filename) 1378 prop_dictionary_set(rdict, "file", 1379 prop_string_create_cstring(vfe->filename)); 1380 prop_dictionary_set_uint8(rdict, "entry-type", vfe->type); 1381 prop_dictionary_set_uint8(rdict, "status", vfe->status); 1382 prop_dictionary_set(rdict, "fp-type", 1383 prop_string_create_cstring(vfe->ops->type)); 1384 prop_dictionary_set(rdict, "fp", 1385 prop_data_create_data(vfe->fp, vfe->ops->hash_len)); 1386 } 1387 1388 int 1389 veriexec_convert(struct vnode *vp, prop_dictionary_t rdict) 1390 { 1391 struct veriexec_file_entry *vfe; 1392 1393 rw_enter(&veriexec_op_lock, RW_READER); 1394 1395 vfe = veriexec_get(vp); 1396 if (vfe == NULL) { 1397 rw_exit(&veriexec_op_lock); 1398 return (ENOENT); 1399 } 1400 1401 rw_enter(&vfe->lock, RW_READER); 1402 veriexec_file_convert(vfe, rdict); 1403 rw_exit(&vfe->lock); 1404 1405 rw_exit(&veriexec_op_lock); 1406 return (0); 1407 } 1408 1409 int 1410 veriexec_unmountchk(struct mount *mp) 1411 { 1412 int error; 1413 1414 if ((veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 1415 || doing_shutdown) 1416 return (0); 1417 1418 rw_enter(&veriexec_op_lock, RW_READER); 1419 1420 switch (veriexec_strict) { 1421 case VERIEXEC_LEARNING: 1422 error = 0; 1423 break; 1424 1425 case VERIEXEC_IDS: 1426 if (veriexec_table_lookup(mp) != NULL) { 1427 log(LOG_INFO, "Veriexec: IDS mode, allowing unmount " 1428 "of \"%s\".\n", mp->mnt_stat.f_mntonname); 1429 } 1430 1431 error = 0; 1432 break; 1433 1434 case VERIEXEC_IPS: { 1435 struct veriexec_table_entry *vte; 1436 1437 vte = veriexec_table_lookup(mp); 1438 if ((vte != NULL) && (vte->vte_count > 0)) { 1439 log(LOG_ALERT, "Veriexec: IPS mode, preventing" 1440 " unmount of \"%s\" with monitored files.\n", 1441 mp->mnt_stat.f_mntonname); 1442 1443 error = EPERM; 1444 } else 1445 error = 0; 1446 break; 1447 } 1448 1449 case VERIEXEC_LOCKDOWN: 1450 default: 1451 log(LOG_ALERT, "Veriexec: Lockdown mode, preventing unmount " 1452 "of \"%s\".\n", mp->mnt_stat.f_mntonname); 1453 error = EPERM; 1454 break; 1455 } 1456 1457 rw_exit(&veriexec_op_lock); 1458 return (error); 1459 } 1460 1461 int 1462 veriexec_openchk(struct lwp *l, struct vnode *vp, const char *path, int fmode) 1463 { 1464 struct veriexec_file_entry *vfe = NULL; 1465 int error = 0; 1466 1467 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 1468 return 0; 1469 1470 if (vp == NULL) { 1471 /* If no creation requested, let this fail normally. */ 1472 if (!(fmode & O_CREAT)) 1473 goto out; 1474 1475 /* Lockdown mode: Prevent creation of new files. */ 1476 if (veriexec_strict >= VERIEXEC_LOCKDOWN) { 1477 log(LOG_ALERT, "Veriexec: Preventing new file " 1478 "creation in `%s'.\n", path); 1479 error = EPERM; 1480 } 1481 1482 goto out; 1483 } 1484 1485 rw_enter(&veriexec_op_lock, RW_READER); 1486 error = veriexec_file_verify(l, vp, path, VERIEXEC_FILE, 1487 VERIEXEC_FILE_LOCKED, &vfe); 1488 1489 if (error) { 1490 rw_exit(&veriexec_op_lock); 1491 goto out; 1492 } 1493 1494 if ((vfe != NULL) && ((fmode & FWRITE) || (fmode & O_TRUNC))) { 1495 veriexec_file_report(vfe, "Write access request.", path, l, 1496 REPORT_ALWAYS | REPORT_ALARM); 1497 1498 /* IPS mode: Deny write access to monitored files. */ 1499 if (veriexec_strict >= VERIEXEC_IPS) 1500 error = EPERM; 1501 else 1502 veriexec_file_purge(vfe, VERIEXEC_LOCKED); 1503 } 1504 1505 if (vfe != NULL) 1506 rw_exit(&vfe->lock); 1507 1508 rw_exit(&veriexec_op_lock); 1509 out: 1510 return (error); 1511 } 1512 1513 static void 1514 veriexec_file_dump(struct veriexec_file_entry *vfe, prop_array_t entries) 1515 { 1516 prop_dictionary_t entry; 1517 1518 /* If we don't have a filename, this is meaningless. */ 1519 if (vfe->filename == NULL) 1520 return; 1521 1522 entry = prop_dictionary_create(); 1523 1524 veriexec_file_convert(vfe, entry); 1525 1526 prop_array_add(entries, entry); 1527 } 1528 1529 int 1530 veriexec_dump(struct lwp *l, prop_array_t rarray) 1531 { 1532 struct mount *mp, *nmp; 1533 1534 mutex_enter(&mountlist_lock); 1535 for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { 1536 /* If it fails, the file-system is [being] unmounted. */ 1537 if (vfs_busy(mp, &nmp) != 0) 1538 continue; 1539 1540 fileassoc_table_run(mp, veriexec_hook, 1541 (fileassoc_cb_t)veriexec_file_dump, rarray); 1542 1543 vfs_unbusy(mp, false, &nmp); 1544 } 1545 mutex_exit(&mountlist_lock); 1546 1547 return (0); 1548 } 1549 1550 int 1551 veriexec_flush(struct lwp *l) 1552 { 1553 struct mount *mp, *nmp; 1554 int error = 0; 1555 1556 mutex_enter(&mountlist_lock); 1557 for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { 1558 int lerror; 1559 1560 /* If it fails, the file-system is [being] unmounted. */ 1561 if (vfs_busy(mp, &nmp) != 0) 1562 continue; 1563 1564 lerror = veriexec_table_delete(l, mp); 1565 if (lerror && lerror != ENOENT) 1566 error = lerror; 1567 1568 vfs_unbusy(mp, false, &nmp); 1569 } 1570 mutex_exit(&mountlist_lock); 1571 1572 return (error); 1573 } 1574
Indexes created Sat Sep 20 22:09:52 GMT 2025