kern_veriexec.c revision 1.6
1 /* $NetBSD: kern_veriexec.c,v 1.6 2015/04/26 09:16:06 maxv Exp $ */ 2 3 /*- 4 * Copyright (c) 2005, 2006 Elad Efrat <elad (at) NetBSD.org> 5 * Copyright (c) 2005, 2006 Brett Lymn <blymn (at) NetBSD.org> 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the authors may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <sys/cdefs.h> 32 __KERNEL_RCSID(0, "$NetBSD: kern_veriexec.c,v 1.6 2015/04/26 09:16:06 maxv Exp $"); 33 34 #include "opt_veriexec.h" 35 36 #include <sys/param.h> 37 #include <sys/mount.h> 38 #include <sys/kmem.h> 39 #include <sys/vnode.h> 40 #include <sys/namei.h> 41 #include <sys/exec.h> 42 #include <sys/once.h> 43 #include <sys/proc.h> 44 #include <sys/rwlock.h> 45 #include <sys/syslog.h> 46 #include <sys/sysctl.h> 47 #include <sys/inttypes.h> 48 #include <sys/verified_exec.h> 49 #if defined(__FreeBSD__) 50 # include <sys/systm.h> 51 # include <sys/imgact.h> 52 # include <crypto/sha1.h> 53 # include <crypto/sha2/sha2.h> 54 # include <crypto/ripemd160/rmd160.h> 55 #else 56 # include <sys/sha1.h> 57 # include <sys/sha2.h> 58 # include <sys/rmd160.h> 59 #endif 60 #include <sys/md5.h> 61 #include <uvm/uvm_extern.h> 62 #include <sys/fileassoc.h> 63 #include <sys/kauth.h> 64 #include <sys/conf.h> 65 #include <miscfs/specfs/specdev.h> 66 #include <prop/proplib.h> 67 #include <sys/fcntl.h> 68 69 /* Readable values for veriexec_file_report(). */ 70 #define REPORT_ALWAYS 0x01 /* Always print */ 71 #define REPORT_VERBOSE 0x02 /* Print when verbose >= 1 */ 72 #define REPORT_DEBUG 0x04 /* Print when verbose >= 2 (debug) */ 73 #define REPORT_PANIC 0x08 /* Call panic() */ 74 #define REPORT_ALARM 0x10 /* Alarm - also print pid/uid/.. */ 75 #define REPORT_LOGMASK (REPORT_ALWAYS|REPORT_VERBOSE|REPORT_DEBUG) 76 77 /* state of locking for veriexec_file_verify */ 78 #define VERIEXEC_UNLOCKED 0x00 /* Nothing locked, callee does it */ 79 #define VERIEXEC_LOCKED 0x01 /* Global op lock held */ 80 81 /* state of file locking for veriexec_file_verify */ 82 #define VERIEXEC_FILE_UNLOCKED 0x02 /* Nothing locked, callee does it */ 83 #define VERIEXEC_FILE_LOCKED 0x04 /* File locked */ 84 85 #define VERIEXEC_RW_UPGRADE(lock) while((rw_tryupgrade(lock)) == 0){}; 86 87 struct veriexec_fpops { 88 const char *type; 89 size_t hash_len; 90 size_t context_size; 91 veriexec_fpop_init_t init; 92 veriexec_fpop_update_t update; 93 veriexec_fpop_final_t final; 94 LIST_ENTRY(veriexec_fpops) entries; 95 }; 96 97 /* Veriexec per-file entry data. */ 98 struct veriexec_file_entry { 99 krwlock_t lock; /* r/w lock */ 100 u_char *filename; /* File name. */ 101 u_char type; /* Entry type. */ 102 u_char status; /* Evaluation status. */ 103 u_char page_fp_status; /* Per-page FP status. */ 104 u_char *fp; /* Fingerprint. */ 105 void *page_fp; /* Per-page fingerprints */ 106 size_t npages; /* Number of pages. */ 107 size_t last_page_size; /* To support < PAGE_SIZE */ 108 struct veriexec_fpops *ops; /* Fingerprint ops vector*/ 109 size_t filename_len; /* Length of filename. */ 110 }; 111 112 /* Veriexec per-table data. */ 113 struct veriexec_table_entry { 114 uint64_t vte_count; /* Number of Veriexec entries. */ 115 const struct sysctlnode *vte_node; 116 }; 117 118 static int veriexec_verbose; 119 static int veriexec_strict; 120 static int veriexec_bypass = 1; 121 122 static char *veriexec_fp_names = NULL; 123 static size_t veriexec_name_max = 0; 124 125 static const struct sysctlnode *veriexec_count_node; 126 127 static fileassoc_t veriexec_hook; 128 static specificdata_key_t veriexec_mountspecific_key; 129 130 static LIST_HEAD(, veriexec_fpops) veriexec_fpops_list = 131 LIST_HEAD_INITIALIZER(veriexec_fpops_list); 132 133 static int veriexec_raw_cb(kauth_cred_t, kauth_action_t, void *, 134 void *, void *, void *, void *); 135 static struct veriexec_fpops *veriexec_fpops_lookup(const char *); 136 static void veriexec_file_free(struct veriexec_file_entry *); 137 138 static unsigned int veriexec_tablecount = 0; 139 140 /* 141 * Veriexec operations global lock - most ops hold this as a read 142 * lock, it is upgraded to a write lock when destroying veriexec file 143 * table entries. 144 */ 145 static krwlock_t veriexec_op_lock; 146 147 /* 148 * Sysctl helper routine for Veriexec. 149 */ 150 static int 151 sysctl_kern_veriexec_algorithms(SYSCTLFN_ARGS) 152 { 153 size_t len; 154 int error; 155 const char *p; 156 157 if (newp != NULL) 158 return EPERM; 159 160 if (namelen != 0) 161 return EINVAL; 162 163 p = veriexec_fp_names == NULL ? "" : veriexec_fp_names; 164 165 len = strlen(p) + 1; 166 167 if (*oldlenp < len && oldp) 168 return ENOMEM; 169 170 if (oldp && (error = copyout(p, oldp, len)) != 0) 171 return error; 172 173 *oldlenp = len; 174 return 0; 175 } 176 177 static int 178 sysctl_kern_veriexec_strict(SYSCTLFN_ARGS) 179 { 180 struct sysctlnode node; 181 int error, newval; 182 183 node = *rnode; 184 node.sysctl_data = &newval; 185 186 newval = veriexec_strict; 187 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 188 if (error || newp == NULL) 189 return error; 190 191 if (newval < veriexec_strict) 192 return EPERM; 193 194 veriexec_strict = newval; 195 196 return 0; 197 } 198 199 SYSCTL_SETUP(sysctl_kern_veriexec_setup, "sysctl kern.veriexec setup") 200 { 201 const struct sysctlnode *rnode = NULL; 202 203 sysctl_createv(clog, 0, NULL, &rnode, 204 CTLFLAG_PERMANENT, 205 CTLTYPE_NODE, "veriexec", 206 SYSCTL_DESCR("Veriexec"), 207 NULL, 0, NULL, 0, 208 CTL_KERN, CTL_CREATE, CTL_EOL); 209 210 sysctl_createv(clog, 0, &rnode, NULL, 211 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 212 CTLTYPE_INT, "verbose", 213 SYSCTL_DESCR("Veriexec verbose level"), 214 NULL, 0, &veriexec_verbose, 0, 215 CTL_CREATE, CTL_EOL); 216 sysctl_createv(clog, 0, &rnode, NULL, 217 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 218 CTLTYPE_INT, "strict", 219 SYSCTL_DESCR("Veriexec strict level"), 220 sysctl_kern_veriexec_strict, 0, NULL, 0, 221 CTL_CREATE, CTL_EOL); 222 sysctl_createv(clog, 0, &rnode, NULL, 223 CTLFLAG_PERMANENT, 224 CTLTYPE_STRING, "algorithms", 225 SYSCTL_DESCR("Veriexec supported hashing " 226 "algorithms"), 227 sysctl_kern_veriexec_algorithms, 0, NULL, 0, 228 CTL_CREATE, CTL_EOL); 229 sysctl_createv(clog, 0, &rnode, &veriexec_count_node, 230 CTLFLAG_PERMANENT, 231 CTLTYPE_NODE, "count", 232 SYSCTL_DESCR("Number of fingerprints on mount(s)"), 233 NULL, 0, NULL, 0, 234 CTL_CREATE, CTL_EOL); 235 } 236 237 /* 238 * Add ops to the fignerprint ops vector list. 239 */ 240 int 241 veriexec_fpops_add(const char *fp_type, size_t hash_len, size_t ctx_size, 242 veriexec_fpop_init_t init, veriexec_fpop_update_t update, 243 veriexec_fpop_final_t final) 244 { 245 struct veriexec_fpops *ops; 246 247 /* Sanity check all parameters. */ 248 if ((fp_type == NULL) || (hash_len == 0) || (ctx_size == 0) || 249 (init == NULL) || (update == NULL) || (final == NULL)) 250 return (EFAULT); 251 252 if (veriexec_fpops_lookup(fp_type) != NULL) 253 return (EEXIST); 254 255 ops = kmem_alloc(sizeof(*ops), KM_SLEEP); 256 257 ops->type = fp_type; 258 ops->hash_len = hash_len; 259 ops->context_size = ctx_size; 260 ops->init = init; 261 ops->update = update; 262 ops->final = final; 263 264 LIST_INSERT_HEAD(&veriexec_fpops_list, ops, entries); 265 266 /* 267 * If we don't have space for any names, allocate enough for six 268 * which should be sufficient. (it's also enough for all algorithms 269 * we can support at the moment) 270 */ 271 if (veriexec_fp_names == NULL) { 272 veriexec_name_max = 64; 273 veriexec_fp_names = kmem_zalloc(veriexec_name_max, KM_SLEEP); 274 } 275 276 /* 277 * If we're running out of space for storing supported algorithms, 278 * extend the buffer with space for four names. 279 */ 280 while (veriexec_name_max - (strlen(veriexec_fp_names) + 1) < 281 strlen(fp_type)) { 282 char *newp; 283 unsigned int new_max; 284 285 /* Add space for four algorithm names. */ 286 new_max = veriexec_name_max + 64; 287 newp = kmem_zalloc(new_max, KM_SLEEP); 288 strlcpy(newp, veriexec_fp_names, new_max); 289 kmem_free(veriexec_fp_names, veriexec_name_max); 290 veriexec_fp_names = newp; 291 veriexec_name_max = new_max; 292 } 293 294 if (*veriexec_fp_names != '\0') 295 strlcat(veriexec_fp_names, " ", veriexec_name_max); 296 297 strlcat(veriexec_fp_names, fp_type, veriexec_name_max); 298 299 return (0); 300 } 301 302 static void 303 veriexec_mountspecific_dtor(void *v) 304 { 305 struct veriexec_table_entry *vte = v; 306 307 if (vte == NULL) { 308 return; 309 } 310 sysctl_free(__UNCONST(vte->vte_node)); 311 veriexec_tablecount--; 312 kmem_free(vte, sizeof(*vte)); 313 } 314 315 static int 316 veriexec_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 317 void *arg0, void *arg1, void *arg2, void *arg3) 318 { 319 int result; 320 enum kauth_system_req req; 321 322 if (action != KAUTH_SYSTEM_VERIEXEC) 323 return KAUTH_RESULT_DEFER; 324 325 result = KAUTH_RESULT_DEFER; 326 req = (enum kauth_system_req)arg0; 327 328 if (req == KAUTH_REQ_SYSTEM_VERIEXEC_MODIFY && 329 veriexec_strict > VERIEXEC_LEARNING) { 330 log(LOG_WARNING, "Veriexec: Strict mode, modifying " 331 "tables not permitted.\n"); 332 333 result = KAUTH_RESULT_DENY; 334 } 335 336 return result; 337 } 338 339 /* 340 * Initialise Veriexec. 341 */ 342 void 343 veriexec_init(void) 344 { 345 int error; 346 347 /* Register a fileassoc for Veriexec. */ 348 error = fileassoc_register("veriexec", 349 (fileassoc_cleanup_cb_t)veriexec_file_free, &veriexec_hook); 350 if (error) 351 panic("Veriexec: Can't register fileassoc: error=%d", error); 352 353 /* Register listener to handle raw disk access. */ 354 if (kauth_listen_scope(KAUTH_SCOPE_DEVICE, veriexec_raw_cb, NULL) == 355 NULL) 356 panic("Veriexec: Can't listen on device scope"); 357 358 error = mount_specific_key_create(&veriexec_mountspecific_key, 359 veriexec_mountspecific_dtor); 360 if (error) 361 panic("Veriexec: Can't create mountspecific key"); 362 363 if (kauth_listen_scope(KAUTH_SCOPE_SYSTEM, veriexec_listener_cb, 364 NULL) == NULL) 365 panic("Veriexec: Can't listen on system scope"); 366 367 rw_init(&veriexec_op_lock); 368 369 #define FPOPS_ADD(a, b, c, d, e, f) \ 370 veriexec_fpops_add(a, b, c, (veriexec_fpop_init_t)d, \ 371 (veriexec_fpop_update_t)e, (veriexec_fpop_final_t)f) 372 373 #ifdef VERIFIED_EXEC_FP_RMD160 374 FPOPS_ADD("RMD160", RMD160_DIGEST_LENGTH, sizeof(RMD160_CTX), 375 RMD160Init, RMD160Update, RMD160Final); 376 #endif /* VERIFIED_EXEC_FP_RMD160 */ 377 378 #ifdef VERIFIED_EXEC_FP_SHA256 379 FPOPS_ADD("SHA256", SHA256_DIGEST_LENGTH, sizeof(SHA256_CTX), 380 SHA256_Init, SHA256_Update, SHA256_Final); 381 #endif /* VERIFIED_EXEC_FP_SHA256 */ 382 383 #ifdef VERIFIED_EXEC_FP_SHA384 384 FPOPS_ADD("SHA384", SHA384_DIGEST_LENGTH, sizeof(SHA384_CTX), 385 SHA384_Init, SHA384_Update, SHA384_Final); 386 #endif /* VERIFIED_EXEC_FP_SHA384 */ 387 388 #ifdef VERIFIED_EXEC_FP_SHA512 389 FPOPS_ADD("SHA512", SHA512_DIGEST_LENGTH, sizeof(SHA512_CTX), 390 SHA512_Init, SHA512_Update, SHA512_Final); 391 #endif /* VERIFIED_EXEC_FP_SHA512 */ 392 393 #ifdef VERIFIED_EXEC_FP_SHA1 394 FPOPS_ADD("SHA1", SHA1_DIGEST_LENGTH, sizeof(SHA1_CTX), 395 SHA1Init, SHA1Update, SHA1Final); 396 #endif /* VERIFIED_EXEC_FP_SHA1 */ 397 398 #ifdef VERIFIED_EXEC_FP_MD5 399 FPOPS_ADD("MD5", MD5_DIGEST_LENGTH, sizeof(MD5_CTX), 400 MD5Init, MD5Update, MD5Final); 401 #endif /* VERIFIED_EXEC_FP_MD5 */ 402 403 #undef FPOPS_ADD 404 } 405 406 static struct veriexec_fpops * 407 veriexec_fpops_lookup(const char *name) 408 { 409 struct veriexec_fpops *ops; 410 411 if (name == NULL) 412 return (NULL); 413 414 LIST_FOREACH(ops, &veriexec_fpops_list, entries) { 415 if (strcasecmp(name, ops->type) == 0) 416 return (ops); 417 } 418 419 return (NULL); 420 } 421 422 /* 423 * Calculate fingerprint. Information on hash length and routines used is 424 * extracted from veriexec_hash_list according to the hash type. 425 * 426 * NOTE: vfe is assumed to be locked for writing on entry. 427 */ 428 static int 429 veriexec_fp_calc(struct lwp *l, struct vnode *vp, int file_lock_state, 430 struct veriexec_file_entry *vfe, u_char *fp) 431 { 432 struct vattr va; 433 void *ctx, *page_ctx; 434 u_char *buf, *page_fp; 435 off_t offset, len; 436 size_t resid, npages; 437 int error, do_perpage, pagen; 438 439 KASSERT((file_lock_state != VERIEXEC_LOCKED) && 440 (file_lock_state != VERIEXEC_UNLOCKED)); 441 442 if (file_lock_state == VERIEXEC_FILE_UNLOCKED) 443 vn_lock(vp, LK_SHARED | LK_RETRY); 444 error = VOP_GETATTR(vp, &va, l->l_cred); 445 if (file_lock_state == VERIEXEC_FILE_UNLOCKED) 446 VOP_UNLOCK(vp); 447 if (error) 448 return (error); 449 450 #ifdef notyet /* XXX - for now */ 451 if ((vfe->type & VERIEXEC_UNTRUSTED) && 452 (vfe->page_fp_status == PAGE_FP_NONE)) 453 do_perpage = 1; 454 else 455 #endif /* notyet */ 456 do_perpage = 0; 457 458 ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 459 buf = kmem_alloc(PAGE_SIZE, KM_SLEEP); 460 461 page_ctx = NULL; 462 page_fp = NULL; 463 npages = 0; 464 if (do_perpage) { 465 npages = (va.va_size >> PAGE_SHIFT) + 1; 466 page_fp = kmem_alloc(vfe->ops->hash_len * npages, KM_SLEEP); 467 vfe->page_fp = page_fp; 468 page_ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 469 } 470 471 (vfe->ops->init)(ctx); 472 473 len = 0; 474 error = 0; 475 pagen = 0; 476 for (offset = 0; offset < va.va_size; offset += PAGE_SIZE) { 477 len = ((va.va_size - offset) < PAGE_SIZE) ? 478 (va.va_size - offset) : PAGE_SIZE; 479 480 error = vn_rdwr(UIO_READ, vp, buf, len, offset, 481 UIO_SYSSPACE, 482 ((file_lock_state == VERIEXEC_FILE_LOCKED)? 483 IO_NODELOCKED : 0), 484 l->l_cred, &resid, NULL); 485 486 if (error) { 487 if (do_perpage) { 488 kmem_free(vfe->page_fp, 489 vfe->ops->hash_len * npages); 490 vfe->page_fp = NULL; 491 } 492 493 goto bad; 494 } 495 496 (vfe->ops->update)(ctx, buf, (unsigned int) len); 497 498 if (do_perpage) { 499 (vfe->ops->init)(page_ctx); 500 (vfe->ops->update)(page_ctx, buf, (unsigned int)len); 501 (vfe->ops->final)(page_fp, page_ctx); 502 503 if (veriexec_verbose >= 2) { 504 int i; 505 506 printf("hash for page %d: ", pagen); 507 for (i = 0; i < vfe->ops->hash_len; i++) 508 printf("%02x", page_fp[i]); 509 printf("\n"); 510 } 511 512 page_fp += vfe->ops->hash_len; 513 pagen++; 514 } 515 516 if (len != PAGE_SIZE) 517 break; 518 } 519 520 (vfe->ops->final)(fp, ctx); 521 522 if (do_perpage) { 523 vfe->last_page_size = len; 524 vfe->page_fp_status = PAGE_FP_READY; 525 vfe->npages = npages; 526 } 527 528 bad: 529 if (do_perpage) 530 kmem_free(page_ctx, vfe->ops->context_size); 531 532 kmem_free(ctx, vfe->ops->context_size); 533 kmem_free(buf, PAGE_SIZE); 534 535 return (error); 536 } 537 538 /* Compare two fingerprints of the same type. */ 539 static int 540 veriexec_fp_cmp(struct veriexec_fpops *ops, u_char *fp1, u_char *fp2) 541 { 542 if (veriexec_verbose >= 2) { 543 int i; 544 545 printf("comparing hashes...\n"); 546 printf("fp1: "); 547 for (i = 0; i < ops->hash_len; i++) { 548 printf("%02x", fp1[i]); 549 } 550 printf("\nfp2: "); 551 for (i = 0; i < ops->hash_len; i++) { 552 printf("%02x", fp2[i]); 553 } 554 printf("\n"); 555 } 556 557 return (memcmp(fp1, fp2, ops->hash_len)); 558 } 559 560 static int 561 veriexec_fp_status(struct lwp *l, struct vnode *vp, int file_lock_state, 562 struct veriexec_file_entry *vfe, u_char *status) 563 { 564 size_t hash_len = vfe->ops->hash_len; 565 u_char *digest; 566 int error = 0; 567 568 digest = kmem_zalloc(hash_len, KM_SLEEP); 569 570 error = veriexec_fp_calc(l, vp, file_lock_state, vfe, digest); 571 if (error) 572 goto out; 573 574 /* Compare fingerprint with loaded data. */ 575 if (veriexec_fp_cmp(vfe->ops, vfe->fp, digest) == 0) 576 *status = FINGERPRINT_VALID; 577 else 578 *status = FINGERPRINT_NOMATCH; 579 580 out: 581 kmem_free(digest, hash_len); 582 return error; 583 } 584 585 586 static struct veriexec_table_entry * 587 veriexec_table_lookup(struct mount *mp) 588 { 589 /* XXX: From raidframe init */ 590 if (mp == NULL) 591 return NULL; 592 593 return mount_getspecific(mp, veriexec_mountspecific_key); 594 } 595 596 static struct veriexec_file_entry * 597 veriexec_get(struct vnode *vp) 598 { 599 return (fileassoc_lookup(vp, veriexec_hook)); 600 } 601 602 bool 603 veriexec_lookup(struct vnode *vp) 604 { 605 return (veriexec_get(vp) == NULL ? false : true); 606 } 607 608 /* 609 * Routine for maintaining mostly consistent message formats in Veriexec. 610 */ 611 static void 612 veriexec_file_report(struct veriexec_file_entry *vfe, const u_char *msg, 613 const u_char *filename, struct lwp *l, int f) 614 { 615 if (vfe != NULL && vfe->filename != NULL) 616 filename = vfe->filename; 617 618 if (filename == NULL) 619 return; 620 621 if (((f & REPORT_LOGMASK) >> 1) <= veriexec_verbose) { 622 if (!(f & REPORT_ALARM) || (l == NULL)) 623 log(LOG_NOTICE, "Veriexec: %s [%s]\n", msg, 624 filename); 625 else 626 log(LOG_ALERT, "Veriexec: %s [%s, prog=%s pid=%u, " 627 "uid=%u, gid=%u]\n", msg, filename, 628 l->l_proc->p_comm, l->l_proc->p_pid, 629 kauth_cred_getuid(l->l_cred), 630 kauth_cred_getgid(l->l_cred)); 631 } 632 633 if (f & REPORT_PANIC) 634 panic("Veriexec: Unrecoverable error."); 635 } 636 637 /* 638 * Verify the fingerprint of the given file. If we're called directly from 639 * sys_execve(), 'flag' will be VERIEXEC_DIRECT. If we're called from 640 * exec_script(), 'flag' will be VERIEXEC_INDIRECT. If we are called from 641 * vn_open(), 'flag' will be VERIEXEC_FILE. 642 * 643 * 'veriexec_op_lock' must be locked (and remains locked). 644 * 645 * NOTE: The veriexec file entry pointer (vfep) will be returned LOCKED 646 * on no error. 647 */ 648 static int 649 veriexec_file_verify(struct lwp *l, struct vnode *vp, const u_char *name, 650 int flag, int file_lock_state, struct veriexec_file_entry **vfep) 651 { 652 struct veriexec_file_entry *vfe; 653 int error = 0; 654 655 KASSERT(rw_lock_held(&veriexec_op_lock)); 656 KASSERT((file_lock_state != VERIEXEC_LOCKED) && 657 (file_lock_state != VERIEXEC_UNLOCKED)); 658 659 #define VFE_NEEDS_EVAL(vfe) ((vfe->status == FINGERPRINT_NOTEVAL) || \ 660 (vfe->type & VERIEXEC_UNTRUSTED)) 661 662 if (vfep != NULL) 663 *vfep = NULL; 664 665 if (vp->v_type != VREG) 666 return (0); 667 668 /* Lookup veriexec table entry, save pointer if requested. */ 669 vfe = veriexec_get(vp); 670 if (vfep != NULL) 671 *vfep = vfe; 672 673 /* No entry in the veriexec tables. */ 674 if (vfe == NULL) { 675 veriexec_file_report(NULL, "No entry.", name, 676 l, REPORT_VERBOSE); 677 678 /* 679 * Lockdown mode: Deny access to non-monitored files. 680 * IPS mode: Deny execution of non-monitored files. 681 */ 682 if ((veriexec_strict >= VERIEXEC_LOCKDOWN) || 683 ((veriexec_strict >= VERIEXEC_IPS) && 684 (flag != VERIEXEC_FILE))) 685 return (EPERM); 686 687 return (0); 688 } 689 690 /* 691 * Grab the lock for the entry, if we need to do an evaluation 692 * then the lock is a write lock, after we have the write 693 * lock, check if we really need it - some other thread may 694 * have already done the work for us. 695 */ 696 if (VFE_NEEDS_EVAL(vfe)) { 697 rw_enter(&vfe->lock, RW_WRITER); 698 if (!VFE_NEEDS_EVAL(vfe)) 699 rw_downgrade(&vfe->lock); 700 } else 701 rw_enter(&vfe->lock, RW_READER); 702 703 /* Evaluate fingerprint if needed. */ 704 if (VFE_NEEDS_EVAL(vfe)) { 705 u_char status; 706 707 error = veriexec_fp_status(l, vp, file_lock_state, vfe, &status); 708 if (error) { 709 veriexec_file_report(vfe, "Fingerprint calculation error.", 710 name, NULL, REPORT_ALWAYS); 711 rw_exit(&vfe->lock); 712 return (error); 713 } 714 vfe->status = status; 715 rw_downgrade(&vfe->lock); 716 } 717 718 if (!(vfe->type & flag)) { 719 veriexec_file_report(vfe, "Incorrect access type.", name, l, 720 REPORT_ALWAYS|REPORT_ALARM); 721 722 /* IPS mode: Enforce access type. */ 723 if (veriexec_strict >= VERIEXEC_IPS) { 724 rw_exit(&vfe->lock); 725 return (EPERM); 726 } 727 } 728 729 switch (vfe->status) { 730 case FINGERPRINT_NOTEVAL: 731 /* Should not happen. */ 732 rw_exit(&vfe->lock); 733 veriexec_file_report(vfe, "Not-evaluated status " 734 "post evaluation; inconsistency detected.", name, 735 NULL, REPORT_ALWAYS|REPORT_PANIC); 736 /* NOTREACHED */ 737 738 case FINGERPRINT_VALID: 739 /* Valid fingerprint. */ 740 veriexec_file_report(vfe, "Match.", name, NULL, 741 REPORT_VERBOSE); 742 743 break; 744 745 case FINGERPRINT_NOMATCH: 746 /* Fingerprint mismatch. */ 747 veriexec_file_report(vfe, "Mismatch.", name, 748 NULL, REPORT_ALWAYS|REPORT_ALARM); 749 750 /* IDS mode: Deny access on fingerprint mismatch. */ 751 if (veriexec_strict >= VERIEXEC_IDS) { 752 rw_exit(&vfe->lock); 753 error = EPERM; 754 } 755 756 break; 757 758 default: 759 /* Should never happen. */ 760 rw_exit(&vfe->lock); 761 veriexec_file_report(vfe, "Invalid status " 762 "post evaluation.", name, NULL, REPORT_ALWAYS|REPORT_PANIC); 763 /* NOTREACHED */ 764 } 765 766 return (error); 767 } 768 769 int 770 veriexec_verify(struct lwp *l, struct vnode *vp, const u_char *name, int flag, 771 bool *found) 772 { 773 struct veriexec_file_entry *vfe; 774 int r; 775 776 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 777 return 0; 778 779 rw_enter(&veriexec_op_lock, RW_READER); 780 r = veriexec_file_verify(l, vp, name, flag, VERIEXEC_FILE_UNLOCKED, 781 &vfe); 782 rw_exit(&veriexec_op_lock); 783 784 if ((r == 0) && (vfe != NULL)) 785 rw_exit(&vfe->lock); 786 787 if (found != NULL) 788 *found = (vfe != NULL) ? true : false; 789 790 return (r); 791 } 792 793 #ifdef notyet 794 /* 795 * Evaluate per-page fingerprints. 796 */ 797 int 798 veriexec_page_verify(struct veriexec_file_entry *vfe, struct vm_page *pg, 799 size_t idx, struct lwp *l) 800 { 801 void *ctx; 802 u_char *fp; 803 u_char *page_fp; 804 int error; 805 vaddr_t kva; 806 807 if (vfe->page_fp_status == PAGE_FP_NONE) 808 return (0); 809 810 if (vfe->page_fp_status == PAGE_FP_FAIL) 811 return (EPERM); 812 813 if (idx >= vfe->npages) 814 return (0); 815 816 ctx = kmem_alloc(vfe->ops->context_size, KM_SLEEP); 817 fp = kmem_alloc(vfe->ops->hash_len, KM_SLEEP); 818 kva = uvm_km_alloc(kernel_map, PAGE_SIZE, VM_PGCOLOR_BUCKET(pg), 819 UVM_KMF_COLORMATCH | UVM_KMF_VAONLY | UVM_KMF_WAITVA); 820 pmap_kenter_pa(kva, VM_PAGE_TO_PHYS(pg), VM_PROT_READ, 0); 821 pmap_update(pmap_kernel()); 822 823 page_fp = (u_char *) vfe->page_fp + (vfe->ops->hash_len * idx); 824 (vfe->ops->init)(ctx); 825 (vfe->ops->update)(ctx, (void *) kva, 826 ((vfe->npages - 1) == idx) ? vfe->last_page_size 827 : PAGE_SIZE); 828 (vfe->ops->final)(fp, ctx); 829 830 pmap_kremove(kva, PAGE_SIZE); 831 pmap_update(pmap_kernel()); 832 uvm_km_free(kernel_map, kva, PAGE_SIZE, UVM_KMF_VAONLY); 833 834 error = veriexec_fp_cmp(vfe->ops, page_fp, fp); 835 if (error) { 836 const char *msg; 837 838 if (veriexec_strict > VERIEXEC_LEARNING) { 839 msg = "Pages modified: Killing process."; 840 } else { 841 msg = "Pages modified."; 842 error = 0; 843 } 844 845 veriexec_file_report(msg, "[page_in]", l, 846 REPORT_ALWAYS|REPORT_ALARM); 847 848 if (error) { 849 ksiginfo_t ksi; 850 851 KSI_INIT(&ksi); 852 ksi.ksi_signo = SIGKILL; 853 ksi.ksi_code = SI_NOINFO; 854 ksi.ksi_pid = l->l_proc->p_pid; 855 ksi.ksi_uid = 0; 856 857 kpsignal(l->l_proc, &ksi, NULL); 858 } 859 } 860 861 kmem_free(ctx, vfe->ops->context_size); 862 kmem_free(fp, vfe->ops->hash_len); 863 864 return (error); 865 } 866 #endif /* notyet */ 867 868 /* 869 * Veriexec remove policy code. 870 */ 871 int 872 veriexec_removechk(struct lwp *l, struct vnode *vp, const char *pathbuf) 873 { 874 struct veriexec_file_entry *vfe; 875 int error; 876 877 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 878 return 0; 879 880 rw_enter(&veriexec_op_lock, RW_READER); 881 vfe = veriexec_get(vp); 882 rw_exit(&veriexec_op_lock); 883 884 if (vfe == NULL) { 885 /* Lockdown mode: Deny access to non-monitored files. */ 886 if (veriexec_strict >= VERIEXEC_LOCKDOWN) 887 return (EPERM); 888 889 return (0); 890 } 891 892 veriexec_file_report(vfe, "Remove request.", pathbuf, l, 893 REPORT_ALWAYS|REPORT_ALARM); 894 895 /* IDS mode: Deny removal of monitored files. */ 896 if (veriexec_strict >= VERIEXEC_IDS) 897 error = EPERM; 898 else 899 error = veriexec_file_delete(l, vp); 900 901 return error; 902 } 903 904 /* 905 * Veriexec rename policy. 906 * 907 * XXX: Once there's a way to hook after a successful rename, it would be 908 * XXX: nice to update vfe->filename to the new name if it's not NULL and 909 * XXX: the new name is absolute (ie., starts with a slash). 910 */ 911 int 912 veriexec_renamechk(struct lwp *l, struct vnode *fromvp, const char *fromname, 913 struct vnode *tovp, const char *toname) 914 { 915 struct veriexec_file_entry *fvfe = NULL, *tvfe = NULL; 916 917 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 918 return 0; 919 920 rw_enter(&veriexec_op_lock, RW_READER); 921 922 if (veriexec_strict >= VERIEXEC_LOCKDOWN) { 923 log(LOG_ALERT, "Veriexec: Preventing rename of `%s' to " 924 "`%s', uid=%u, pid=%u: Lockdown mode.\n", fromname, toname, 925 kauth_cred_geteuid(l->l_cred), l->l_proc->p_pid); 926 rw_exit(&veriexec_op_lock); 927 return (EPERM); 928 } 929 930 fvfe = veriexec_get(fromvp); 931 if (tovp != NULL) 932 tvfe = veriexec_get(tovp); 933 934 if ((fvfe == NULL) && (tvfe == NULL)) { 935 /* None of them is monitored */ 936 rw_exit(&veriexec_op_lock); 937 return 0; 938 } 939 940 if (veriexec_strict >= VERIEXEC_IPS) { 941 log(LOG_ALERT, "Veriexec: Preventing rename of `%s' " 942 "to `%s', uid=%u, pid=%u: IPS mode, %s " 943 "monitored.\n", fromname, toname, 944 kauth_cred_geteuid(l->l_cred), 945 l->l_proc->p_pid, (fvfe != NULL && tvfe != NULL) ? 946 "files" : "file"); 947 rw_exit(&veriexec_op_lock); 948 return (EPERM); 949 } 950 951 if (fvfe != NULL) { 952 /* 953 * Monitored file is renamed; filename no longer relevant. 954 */ 955 956 /* 957 * XXX: We could keep the buffer, and when (and if) updating the 958 * XXX: filename post-rename, re-allocate it only if it's not 959 * XXX: big enough for the new filename. 960 */ 961 962 /* XXX: Get write lock on fvfe here? */ 963 964 VERIEXEC_RW_UPGRADE(&veriexec_op_lock); 965 /* once we have the op lock in write mode 966 * there should be no locks on any file 967 * entries so we can destroy the object. 968 */ 969 970 if (fvfe->filename_len > 0) 971 kmem_free(fvfe->filename, fvfe->filename_len); 972 973 fvfe->filename = NULL; 974 fvfe->filename_len = 0; 975 976 rw_downgrade(&veriexec_op_lock); 977 } 978 979 log(LOG_NOTICE, "Veriexec: %s file `%s' renamed to " 980 "%s file `%s', uid=%u, pid=%u.\n", (fvfe != NULL) ? 981 "Monitored" : "Non-monitored", fromname, (tvfe != NULL) ? 982 "monitored" : "non-monitored", toname, 983 kauth_cred_geteuid(l->l_cred), l->l_proc->p_pid); 984 985 rw_exit(&veriexec_op_lock); 986 987 if (tvfe != NULL) { 988 /* 989 * Monitored file is overwritten. Remove the entry. 990 */ 991 (void)veriexec_file_delete(l, tovp); 992 } 993 994 return (0); 995 } 996 997 static void 998 veriexec_file_free(struct veriexec_file_entry *vfe) 999 { 1000 if (vfe != NULL) { 1001 if (vfe->fp != NULL) 1002 kmem_free(vfe->fp, vfe->ops->hash_len); 1003 if (vfe->page_fp != NULL) 1004 kmem_free(vfe->page_fp, vfe->ops->hash_len); 1005 if (vfe->filename != NULL) 1006 kmem_free(vfe->filename, vfe->filename_len); 1007 rw_destroy(&vfe->lock); 1008 kmem_free(vfe, sizeof(*vfe)); 1009 } 1010 } 1011 1012 static void 1013 veriexec_file_purge(struct veriexec_file_entry *vfe, int have_lock) 1014 { 1015 if (vfe == NULL) 1016 return; 1017 1018 if (have_lock == VERIEXEC_UNLOCKED) 1019 rw_enter(&vfe->lock, RW_WRITER); 1020 else 1021 VERIEXEC_RW_UPGRADE(&vfe->lock); 1022 1023 vfe->status = FINGERPRINT_NOTEVAL; 1024 if (have_lock == VERIEXEC_UNLOCKED) 1025 rw_exit(&vfe->lock); 1026 else 1027 rw_downgrade(&vfe->lock); 1028 } 1029 1030 static void 1031 veriexec_file_purge_cb(struct veriexec_file_entry *vfe, void *cookie) 1032 { 1033 veriexec_file_purge(vfe, VERIEXEC_UNLOCKED); 1034 } 1035 1036 /* 1037 * Invalidate a Veriexec file entry. 1038 * XXX: This should be updated when per-page fingerprints are added. 1039 */ 1040 void 1041 veriexec_purge(struct vnode *vp) 1042 { 1043 rw_enter(&veriexec_op_lock, RW_READER); 1044 veriexec_file_purge(veriexec_get(vp), VERIEXEC_UNLOCKED); 1045 rw_exit(&veriexec_op_lock); 1046 } 1047 1048 /* 1049 * Enforce raw disk access policy. 1050 * 1051 * IDS mode: Invalidate fingerprints on a mount if it's opened for writing. 1052 * IPS mode: Don't allow raw writing to disks we monitor. 1053 * Lockdown mode: Don't allow raw writing to all disks. 1054 * 1055 * XXX: This is bogus. There's an obvious race condition between the time 1056 * XXX: the disk is open for writing, in which an attacker can access a 1057 * XXX: monitored file to get its signature cached again, and when the raw 1058 * XXX: file is overwritten on disk. 1059 * XXX: 1060 * XXX: To solve this, we need something like the following: 1061 * XXX: open raw disk: 1062 * XXX: - raise refcount, 1063 * XXX: - invalidate fingerprints, 1064 * XXX: - mark all entries for that disk with "no cache" flag 1065 * XXX: 1066 * XXX: veriexec_verify: 1067 * XXX: - if "no cache", don't cache evaluation result 1068 * XXX: 1069 * XXX: close raw disk: 1070 * XXX: - lower refcount, 1071 * XXX: - if refcount == 0, remove "no cache" flag from all entries 1072 */ 1073 static int 1074 veriexec_raw_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 1075 void *arg0, void *arg1, void *arg2, void *arg3) 1076 { 1077 int result; 1078 enum kauth_device_req req; 1079 struct veriexec_table_entry *vte; 1080 1081 result = KAUTH_RESULT_DENY; 1082 req = (enum kauth_device_req)arg0; 1083 1084 switch (action) { 1085 case KAUTH_DEVICE_RAWIO_SPEC: { 1086 struct vnode *vp, *bvp; 1087 int error; 1088 1089 if (req == KAUTH_REQ_DEVICE_RAWIO_SPEC_READ) { 1090 result = KAUTH_RESULT_DEFER; 1091 break; 1092 } 1093 1094 vp = arg1; 1095 KASSERT(vp != NULL); 1096 1097 /* Handle /dev/mem and /dev/kmem. */ 1098 if (iskmemvp(vp)) { 1099 if (veriexec_strict < VERIEXEC_IPS) 1100 result = KAUTH_RESULT_DEFER; 1101 1102 break; 1103 } 1104 1105 error = rawdev_mounted(vp, &bvp); 1106 if (error == EINVAL) { 1107 result = KAUTH_RESULT_DEFER; 1108 break; 1109 } 1110 1111 /* 1112 * XXX: See vfs_mountedon() comment in rawdev_mounted(). 1113 */ 1114 vte = veriexec_table_lookup(bvp->v_mount); 1115 if (vte == NULL) { 1116 result = KAUTH_RESULT_DEFER; 1117 break; 1118 } 1119 1120 switch (veriexec_strict) { 1121 case VERIEXEC_LEARNING: 1122 case VERIEXEC_IDS: 1123 result = KAUTH_RESULT_DEFER; 1124 1125 rw_enter(&veriexec_op_lock, RW_WRITER); 1126 fileassoc_table_run(bvp->v_mount, veriexec_hook, 1127 (fileassoc_cb_t)veriexec_file_purge_cb, NULL); 1128 rw_exit(&veriexec_op_lock); 1129 1130 break; 1131 case VERIEXEC_IPS: 1132 result = KAUTH_RESULT_DENY; 1133 break; 1134 case VERIEXEC_LOCKDOWN: 1135 result = KAUTH_RESULT_DENY; 1136 break; 1137 } 1138 1139 break; 1140 } 1141 1142 case KAUTH_DEVICE_RAWIO_PASSTHRU: 1143 /* XXX What can we do here? */ 1144 if (veriexec_strict < VERIEXEC_IPS) 1145 result = KAUTH_RESULT_DEFER; 1146 1147 break; 1148 1149 default: 1150 result = KAUTH_RESULT_DEFER; 1151 break; 1152 } 1153 1154 return (result); 1155 } 1156 1157 /* 1158 * Create a new Veriexec table. 1159 */ 1160 static struct veriexec_table_entry * 1161 veriexec_table_add(struct lwp *l, struct mount *mp) 1162 { 1163 struct veriexec_table_entry *vte; 1164 u_char buf[16]; 1165 1166 vte = kmem_zalloc(sizeof(*vte), KM_SLEEP); 1167 mount_setspecific(mp, veriexec_mountspecific_key, vte); 1168 1169 snprintf(buf, sizeof(buf), "table%u", veriexec_tablecount++); 1170 sysctl_createv(NULL, 0, &veriexec_count_node, &vte->vte_node, 1171 0, CTLTYPE_NODE, buf, NULL, NULL, 0, NULL, 1172 0, CTL_CREATE, CTL_EOL); 1173 1174 sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1175 CTLFLAG_READONLY, CTLTYPE_STRING, "mntpt", 1176 NULL, NULL, 0, mp->mnt_stat.f_mntonname, 1177 0, CTL_CREATE, CTL_EOL); 1178 sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1179 CTLFLAG_READONLY, CTLTYPE_STRING, "fstype", 1180 NULL, NULL, 0, mp->mnt_stat.f_fstypename, 1181 0, CTL_CREATE, CTL_EOL); 1182 sysctl_createv(NULL, 0, &vte->vte_node, NULL, 1183 CTLFLAG_READONLY, CTLTYPE_QUAD, "nentries", 1184 NULL, NULL, 0, &vte->vte_count, 0, CTL_CREATE, CTL_EOL); 1185 1186 return (vte); 1187 } 1188 1189 /* 1190 * Add a file to be monitored by Veriexec. 1191 * 1192 * Expected elements in dict: file, fp, fp-type, entry-type. 1193 */ 1194 int 1195 veriexec_file_add(struct lwp *l, prop_dictionary_t dict) 1196 { 1197 struct veriexec_table_entry *vte; 1198 struct veriexec_file_entry *vfe = NULL; 1199 struct vnode *vp; 1200 const char *file, *fp_type; 1201 int error; 1202 1203 if (!prop_dictionary_get_cstring_nocopy(dict, "file", &file)) 1204 return (EINVAL); 1205 1206 error = namei_simple_kernel(file, NSM_FOLLOW_NOEMULROOT, &vp); 1207 if (error) 1208 return (error); 1209 1210 /* Add only regular files. */ 1211 if (vp->v_type != VREG) { 1212 log(LOG_ERR, "Veriexec: Not adding `%s': Not a regular file.\n", 1213 file); 1214 error = EBADF; 1215 goto out; 1216 } 1217 1218 vfe = kmem_zalloc(sizeof(*vfe), KM_SLEEP); 1219 rw_init(&vfe->lock); 1220 1221 /* Lookup fingerprint hashing algorithm. */ 1222 fp_type = prop_string_cstring_nocopy(prop_dictionary_get(dict, 1223 "fp-type")); 1224 if ((vfe->ops = veriexec_fpops_lookup(fp_type)) == NULL) { 1225 log(LOG_ERR, "Veriexec: Invalid or unknown fingerprint type " 1226 "`%s' for file `%s'.\n", fp_type, file); 1227 error = EOPNOTSUPP; 1228 goto out; 1229 } 1230 1231 if (prop_data_size(prop_dictionary_get(dict, "fp")) != 1232 vfe->ops->hash_len) { 1233 log(LOG_ERR, "Veriexec: Bad fingerprint length for `%s'.\n", 1234 file); 1235 error = EINVAL; 1236 goto out; 1237 } 1238 1239 vfe->fp = kmem_alloc(vfe->ops->hash_len, KM_SLEEP); 1240 memcpy(vfe->fp, prop_data_data_nocopy(prop_dictionary_get(dict, "fp")), 1241 vfe->ops->hash_len); 1242 1243 rw_enter(&veriexec_op_lock, RW_WRITER); 1244 1245 if (veriexec_get(vp)) { 1246 /* We already have an entry for this file. */ 1247 error = EEXIST; 1248 goto unlock_out; 1249 } 1250 1251 /* Continue entry initialization. */ 1252 if (prop_dictionary_get_uint8(dict, "entry-type", &vfe->type) == FALSE) 1253 vfe->type = 0; 1254 else { 1255 uint8_t extra_flags; 1256 1257 extra_flags = vfe->type & ~(VERIEXEC_DIRECT | 1258 VERIEXEC_INDIRECT | VERIEXEC_FILE | VERIEXEC_UNTRUSTED); 1259 if (extra_flags) { 1260 log(LOG_NOTICE, "Veriexec: Contaminated flags `0x%x' " 1261 "for `%s', skipping.\n", extra_flags, file); 1262 error = EINVAL; 1263 goto unlock_out; 1264 } 1265 } 1266 if (!(vfe->type & (VERIEXEC_DIRECT | VERIEXEC_INDIRECT | 1267 VERIEXEC_FILE))) 1268 vfe->type |= VERIEXEC_DIRECT; 1269 1270 vfe->status = FINGERPRINT_NOTEVAL; 1271 if (prop_bool_true(prop_dictionary_get(dict, "keep-filename"))) { 1272 vfe->filename_len = strlen(file) + 1; 1273 vfe->filename = kmem_alloc(vfe->filename_len, KM_SLEEP); 1274 strlcpy(vfe->filename, file, vfe->filename_len); 1275 } else 1276 vfe->filename = NULL; 1277 1278 vfe->page_fp = NULL; 1279 vfe->page_fp_status = PAGE_FP_NONE; 1280 vfe->npages = 0; 1281 vfe->last_page_size = 0; 1282 1283 if (prop_bool_true(prop_dictionary_get(dict, "eval-on-load")) || 1284 (vfe->type & VERIEXEC_UNTRUSTED)) { 1285 u_char status; 1286 1287 error = veriexec_fp_status(l, vp, VERIEXEC_FILE_UNLOCKED, 1288 vfe, &status); 1289 if (error) 1290 goto unlock_out; 1291 vfe->status = status; 1292 } 1293 1294 vte = veriexec_table_lookup(vp->v_mount); 1295 if (vte == NULL) 1296 vte = veriexec_table_add(l, vp->v_mount); 1297 1298 /* XXX if we bail below this, we might want to gc newly created vtes. */ 1299 1300 error = fileassoc_add(vp, veriexec_hook, vfe); 1301 if (error) 1302 goto unlock_out; 1303 1304 vte->vte_count++; 1305 1306 veriexec_file_report(NULL, "New entry.", file, NULL, REPORT_DEBUG); 1307 veriexec_bypass = 0; 1308 1309 unlock_out: 1310 rw_exit(&veriexec_op_lock); 1311 1312 out: 1313 vrele(vp); 1314 if (error) 1315 veriexec_file_free(vfe); 1316 1317 return (error); 1318 } 1319 1320 int 1321 veriexec_table_delete(struct lwp *l, struct mount *mp) 1322 { 1323 struct veriexec_table_entry *vte; 1324 1325 vte = veriexec_table_lookup(mp); 1326 if (vte == NULL) 1327 return (ENOENT); 1328 1329 veriexec_mountspecific_dtor(vte); 1330 mount_setspecific(mp, veriexec_mountspecific_key, NULL); 1331 1332 return (fileassoc_table_clear(mp, veriexec_hook)); 1333 } 1334 1335 int 1336 veriexec_file_delete(struct lwp *l, struct vnode *vp) 1337 { 1338 struct veriexec_table_entry *vte; 1339 int error; 1340 1341 vte = veriexec_table_lookup(vp->v_mount); 1342 if (vte == NULL) 1343 return (ENOENT); 1344 1345 rw_enter(&veriexec_op_lock, RW_WRITER); 1346 error = fileassoc_clear(vp, veriexec_hook); 1347 rw_exit(&veriexec_op_lock); 1348 if (!error) { 1349 KASSERT(vte->vte_count > 0); 1350 vte->vte_count--; 1351 } 1352 1353 return (error); 1354 } 1355 1356 /* 1357 * Convert Veriexec entry data to a dictionary readable by userland tools. 1358 */ 1359 static void 1360 veriexec_file_convert(struct veriexec_file_entry *vfe, prop_dictionary_t rdict) 1361 { 1362 if (vfe->filename) 1363 prop_dictionary_set(rdict, "file", 1364 prop_string_create_cstring(vfe->filename)); 1365 prop_dictionary_set_uint8(rdict, "entry-type", vfe->type); 1366 prop_dictionary_set_uint8(rdict, "status", vfe->status); 1367 prop_dictionary_set(rdict, "fp-type", 1368 prop_string_create_cstring(vfe->ops->type)); 1369 prop_dictionary_set(rdict, "fp", 1370 prop_data_create_data(vfe->fp, vfe->ops->hash_len)); 1371 } 1372 1373 int 1374 veriexec_convert(struct vnode *vp, prop_dictionary_t rdict) 1375 { 1376 struct veriexec_file_entry *vfe; 1377 1378 rw_enter(&veriexec_op_lock, RW_READER); 1379 1380 vfe = veriexec_get(vp); 1381 if (vfe == NULL) { 1382 rw_exit(&veriexec_op_lock); 1383 return (ENOENT); 1384 } 1385 1386 rw_enter(&vfe->lock, RW_READER); 1387 veriexec_file_convert(vfe, rdict); 1388 rw_exit(&vfe->lock); 1389 1390 rw_exit(&veriexec_op_lock); 1391 return (0); 1392 } 1393 1394 int 1395 veriexec_unmountchk(struct mount *mp) 1396 { 1397 int error; 1398 1399 if ((veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 1400 || doing_shutdown) 1401 return (0); 1402 1403 rw_enter(&veriexec_op_lock, RW_READER); 1404 1405 switch (veriexec_strict) { 1406 case VERIEXEC_LEARNING: 1407 error = 0; 1408 break; 1409 1410 case VERIEXEC_IDS: 1411 if (veriexec_table_lookup(mp) != NULL) { 1412 log(LOG_INFO, "Veriexec: IDS mode, allowing unmount " 1413 "of \"%s\".\n", mp->mnt_stat.f_mntonname); 1414 } 1415 1416 error = 0; 1417 break; 1418 1419 case VERIEXEC_IPS: { 1420 struct veriexec_table_entry *vte; 1421 1422 vte = veriexec_table_lookup(mp); 1423 if ((vte != NULL) && (vte->vte_count > 0)) { 1424 log(LOG_ALERT, "Veriexec: IPS mode, preventing" 1425 " unmount of \"%s\" with monitored files.\n", 1426 mp->mnt_stat.f_mntonname); 1427 1428 error = EPERM; 1429 } else 1430 error = 0; 1431 break; 1432 } 1433 1434 case VERIEXEC_LOCKDOWN: 1435 default: 1436 log(LOG_ALERT, "Veriexec: Lockdown mode, preventing unmount " 1437 "of \"%s\".\n", mp->mnt_stat.f_mntonname); 1438 error = EPERM; 1439 break; 1440 } 1441 1442 rw_exit(&veriexec_op_lock); 1443 return (error); 1444 } 1445 1446 int 1447 veriexec_openchk(struct lwp *l, struct vnode *vp, const char *path, int fmode) 1448 { 1449 struct veriexec_file_entry *vfe = NULL; 1450 int error = 0; 1451 1452 if (veriexec_bypass && (veriexec_strict == VERIEXEC_LEARNING)) 1453 return 0; 1454 1455 if (vp == NULL) { 1456 /* If no creation requested, let this fail normally. */ 1457 if (!(fmode & O_CREAT)) 1458 goto out; 1459 1460 /* Lockdown mode: Prevent creation of new files. */ 1461 if (veriexec_strict >= VERIEXEC_LOCKDOWN) { 1462 log(LOG_ALERT, "Veriexec: Preventing new file " 1463 "creation in `%s'.\n", path); 1464 error = EPERM; 1465 } 1466 1467 goto out; 1468 } 1469 1470 rw_enter(&veriexec_op_lock, RW_READER); 1471 error = veriexec_file_verify(l, vp, path, VERIEXEC_FILE, 1472 VERIEXEC_FILE_LOCKED, &vfe); 1473 1474 if (error) { 1475 rw_exit(&veriexec_op_lock); 1476 goto out; 1477 } 1478 1479 if ((vfe != NULL) && ((fmode & FWRITE) || (fmode & O_TRUNC))) { 1480 veriexec_file_report(vfe, "Write access request.", path, l, 1481 REPORT_ALWAYS | REPORT_ALARM); 1482 1483 /* IPS mode: Deny write access to monitored files. */ 1484 if (veriexec_strict >= VERIEXEC_IPS) 1485 error = EPERM; 1486 else 1487 veriexec_file_purge(vfe, VERIEXEC_LOCKED); 1488 } 1489 1490 if (vfe != NULL) 1491 rw_exit(&vfe->lock); 1492 1493 rw_exit(&veriexec_op_lock); 1494 out: 1495 return (error); 1496 } 1497 1498 static void 1499 veriexec_file_dump(struct veriexec_file_entry *vfe, prop_array_t entries) 1500 { 1501 prop_dictionary_t entry; 1502 1503 /* If we don't have a filename, this is meaningless. */ 1504 if (vfe->filename == NULL) 1505 return; 1506 1507 entry = prop_dictionary_create(); 1508 1509 veriexec_file_convert(vfe, entry); 1510 1511 prop_array_add(entries, entry); 1512 } 1513 1514 int 1515 veriexec_dump(struct lwp *l, prop_array_t rarray) 1516 { 1517 struct mount *mp, *nmp; 1518 1519 mutex_enter(&mountlist_lock); 1520 for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { 1521 /* If it fails, the file-system is [being] unmounted. */ 1522 if (vfs_busy(mp, &nmp) != 0) 1523 continue; 1524 1525 fileassoc_table_run(mp, veriexec_hook, 1526 (fileassoc_cb_t)veriexec_file_dump, rarray); 1527 1528 vfs_unbusy(mp, false, &nmp); 1529 } 1530 mutex_exit(&mountlist_lock); 1531 1532 return (0); 1533 } 1534 1535 int 1536 veriexec_flush(struct lwp *l) 1537 { 1538 struct mount *mp, *nmp; 1539 int error = 0; 1540 1541 mutex_enter(&mountlist_lock); 1542 for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { 1543 int lerror; 1544 1545 /* If it fails, the file-system is [being] unmounted. */ 1546 if (vfs_busy(mp, &nmp) != 0) 1547 continue; 1548 1549 lerror = veriexec_table_delete(l, mp); 1550 if (lerror && lerror != ENOENT) 1551 error = lerror; 1552 1553 vfs_unbusy(mp, false, &nmp); 1554 } 1555 mutex_exit(&mountlist_lock); 1556 1557 return (error); 1558 } 1559
Indexes created Sat Sep 20 22:09:52 GMT 2025