Home | History | Annotate | Line # | Download | only in veriexecgen
veriexecgen.c revision 1.9 
      1 /* $NetBSD: veriexecgen.c,v 1.9 2006/12/04 07:06:56 agc Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2006 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Matt Fleming.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *        This product includes software developed by the NetBSD
     21  *        Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 #include <sys/param.h>
     40 #include <sys/types.h>
     41 #include <sys/queue.h>
     42 #include <sys/stat.h>
     43 #include <sys/dirent.h>
     44 #include <sys/verified_exec.h>
     45 
     46 #include <err.h>
     47 #include <errno.h>
     48 #include <fts.h>
     49 #include <stdio.h>
     50 #include <stdlib.h>
     51 #include <string.h>
     52 #include <time.h>
     53 #include <unistd.h>
     54 #include <util.h>
     55 
     56 #include <md5.h>
     57 #include <sha1.h>
     58 #include <sha2.h>
     59 #include <rmd160.h>
     60 
     61 #define IS_EXEC(mode) ((mode) & (S_IXUSR | S_IXGRP | S_IXOTH))
     62 
     63 #define DEFAULT_DBFILE  "/etc/signatures"
     64 #define DEFAULT_HASH    "sha256"
     65 #define DEFAULT_SYSPATHS { "/bin", "/sbin", "/usr/bin", "/usr/sbin", \
     66 			   "/lib", "/usr/lib", "/libexec", "/usr/libexec", \
     67 			   NULL }
     68 
     69 struct fentry {
     70 	char filename[MAXPATHLEN];
     71 	char *hash_val;
     72 	int flags;
     73 	TAILQ_ENTRY(fentry) f;
     74 };
     75 TAILQ_HEAD(, fentry) fehead;
     76 
     77 struct hash {
     78 	const char     *hashname;
     79 	char           *(*filefunc) (const char *, char *);
     80 } hashes[] = {
     81 	{ "MD5", MD5File },
     82 	{ "SHA1", SHA1File },
     83 	{ "SHA256", SHA256_File },
     84 	{ "SHA384", SHA384_File },
     85 	{ "SHA512", SHA512_File },
     86 	{ "RMD160", RMD160File },
     87 	{ NULL, NULL },
     88 };
     89 
     90 static int Aflag, aflag, Dflag, Fflag, rflag, Sflag, vflag;
     91 
     92 static int	exit_on_error;
     93 
     94 /* warn about a problem - exit if exit_on_error is set */
     95 static void
     96 gripe(const char *fmt, const char *filename)
     97 {
     98 	warn(fmt, filename);
     99 	if (exit_on_error) {
    100 		/* error out on problematic files */
    101 		exit(EXIT_FAILURE);
    102 	}
    103 }
    104 
    105 static void
    106 usage(void)
    107 {
    108 	(void)fprintf(stderr,
    109 	    "usage: %s [-AaDrSv] [-d dir] [-o fingerprintdb]"
    110 	    " [-t algorithm]\n", getprogname());
    111 }
    112 
    113 static void
    114 banner(struct hash *hash_type, char **search_path)
    115 {
    116 	int j;
    117 
    118 	(void)printf("Fingerprinting ");
    119 
    120 	for (j = 0; search_path[j] != NULL; j++)
    121 		(void)printf("%s ", search_path[j]);
    122 
    123 	(void)printf("(%s) (%s) using %s\n",
    124 	    aflag ? "all files" : "executables only",
    125 	    rflag ? "recursive" : "non-recursive",
    126 	    hash_type->hashname);
    127 }
    128 
    129 static struct hash *
    130 find_hash(char *hash_type)
    131 {
    132 	struct hash *hash;
    133 
    134 	for (hash = hashes; hash->hashname != NULL; hash++)
    135 		if (strcasecmp(hash_type, hash->hashname) == 0)
    136 			return hash;
    137 	return NULL;
    138 }
    139 
    140 static char *
    141 do_hash(char *filename, struct hash * h)
    142 {
    143 	return h->filefunc(filename, NULL);
    144 }
    145 
    146 static int
    147 figure_flags(char *path, mode_t mode)
    148 {
    149 #ifdef notyet
    150 	if (Fflag) {
    151 		/* Try to figure out right flag(s). */
    152 		return VERIEXEC_DIRECT;
    153 }
    154 #endif /* notyet */
    155 
    156 	if (!IS_EXEC(mode))
    157 		return VERIEXEC_FILE;
    158 	else
    159 		return 0;
    160 }
    161 
    162 static int
    163 check_dup(char *filename)
    164 {
    165 	struct fentry *lwalk;
    166 
    167 	TAILQ_FOREACH(lwalk, &fehead, f) {
    168 		if (strncmp(lwalk->filename, filename,
    169 			    (unsigned long) MAXPATHLEN) == 0)
    170 			return 1;
    171 	}
    172 
    173 	return 0;
    174 }
    175 
    176 static void
    177 add_new_entry(FTSENT *file, struct hash *hash)
    178 {
    179 	struct fentry *e;
    180 	struct stat sb;
    181 
    182 	if (file->fts_info == FTS_SL) {
    183 		if (stat(file->fts_path, &sb) == -1) {
    184 			gripe("Cannot stat symlink `%s'", file->fts_path);
    185 			return;
    186 		}
    187 	} else
    188 		sb = *file->fts_statp;
    189 
    190 	if (!aflag && !Dflag && !IS_EXEC(sb.st_mode))
    191 		return;
    192 
    193 	e = ecalloc(1UL, sizeof(*e));
    194 
    195 	if (realpath(file->fts_accpath, e->filename) == NULL) {
    196 		gripe("Cannot find absolute path `%s'", file->fts_accpath);
    197 		return;
    198 	}
    199 	if (check_dup(e->filename)) {
    200 		free(e);
    201 		return;
    202 	}
    203 	if ((e->hash_val = do_hash(e->filename, hash)) == NULL) {
    204 		gripe("Cannot calculate hash `%s'", e->filename);
    205 		return;
    206 	}
    207 	e->flags = figure_flags(e->filename, sb.st_mode);
    208 
    209 	TAILQ_INSERT_TAIL(&fehead, e, f);
    210 }
    211 
    212 static void
    213 walk_dir(char **search_path, struct hash *hash)
    214 {
    215 	FTS *fh;
    216 	FTSENT *file;
    217 
    218 	if ((fh = fts_open(search_path, FTS_PHYSICAL, NULL)) == NULL) {
    219 		gripe("fts_open `%s'", (const char *)search_path);
    220 		return;
    221 	}
    222 
    223 	while ((file = fts_read(fh)) != NULL) {
    224 		if (!rflag && file->fts_level > 1) {
    225 			fts_set(fh, file, FTS_SKIP);
    226 			continue;
    227 		}
    228 
    229 		switch (file->fts_info) {
    230 		case FTS_D:
    231 		case FTS_DC:
    232 		case FTS_DP:
    233 			continue;
    234 		default:
    235 			break;
    236 		}
    237 
    238 		if (file->fts_errno) {
    239 			errx(1, "%s: %s", file->fts_path,
    240 			    strerror(file->fts_errno));
    241 		}
    242 
    243 		add_new_entry(file, hash);
    244 	}
    245 
    246 	fts_close(fh);
    247 }
    248 
    249 static char *
    250 flags2str(int flags)
    251 {
    252 	if (flags != 0)
    253 		return "FILE, INDIRECT";
    254 	else
    255 		return "";
    256 }
    257 
    258 static void
    259 store_entries(char *dbfile, struct hash *hash)
    260 {
    261 	FILE *fp;
    262 	int move = 1;
    263 	char old_dbfile[MAXPATHLEN];
    264 	time_t ct;
    265 	struct stat sb;
    266 	struct fentry  *e;
    267 
    268 	if (stat(dbfile, &sb) != 0) {
    269 		if (errno == ENOENT)
    270 			move = 0;
    271 		else
    272 			err(1, "could not stat %s", dbfile);
    273 	}
    274 	if (move && !Aflag) {
    275 		if (vflag)
    276 			(void)printf("\nBacking up existing fingerprint file "
    277 			    "to \"%s.old\"\n\n", dbfile);
    278 
    279 		if (snprintf(old_dbfile, MAXPATHLEN, "%s.old", dbfile) <
    280 		    strlen(dbfile) + 4) {
    281 			err(1, "%s", old_dbfile);
    282 		}
    283 		if (rename(dbfile, old_dbfile) == -1)
    284 			err(1, "could not rename file");
    285 	}
    286 
    287 	fp = efopen(dbfile, Aflag ? "a" : "w+");
    288 
    289 	time(&ct);
    290 	(void)fprintf(fp, "# Generated by %s, %.24s\n",
    291 		getlogin(), ctime(&ct));
    292 
    293 	TAILQ_FOREACH(e, &fehead, f) {
    294 		if (vflag)
    295 			(void)printf("Adding %s.\n", e->filename);
    296 
    297 		(void)fprintf(fp, "%s %s %s %s\n", e->filename,
    298 			hash->hashname, e->hash_val, flags2str(e->flags));
    299 	}
    300 
    301 	(void)fclose(fp);
    302 
    303 	if (!vflag)
    304 		return;
    305 
    306 	(void)printf("\n\n"
    307 	   "#############################################################\n"
    308 	   "  PLEASE VERIFY CONTENTS OF %s AND FINE-TUNE THE\n"
    309 	   "  FLAGS WHERE APPROPRIATE AFTER READING veriexecctl(8)\n"
    310 	   "#############################################################\n",
    311 	   dbfile);
    312 }
    313 
    314 int
    315 main(int argc, char **argv)
    316 {
    317 	int ch, total = 0;
    318 	char *dbfile = NULL;
    319 	char **search_path = NULL;
    320 	struct hash *hash = NULL;
    321 
    322 	Aflag = aflag = Dflag = Fflag = rflag = Sflag = vflag = 0;
    323 
    324 	/* error out if we have a dangling symlink or other fs problem */
    325 	exit_on_error = 1;
    326 
    327 	while ((ch = getopt(argc, argv, "AaDd:ho:rSt:vW")) != -1) {
    328 		switch (ch) {
    329 		case 'A':
    330 			Aflag = 1;
    331 			break;
    332 		case 'a':
    333 			aflag = 1;
    334 			break;
    335 		case 'D':
    336 			Dflag = 1;
    337 			break;
    338 		case 'd':
    339 			search_path = erealloc(search_path, sizeof(char *) *
    340 			    (total + 1));
    341 			search_path[total] = optarg;
    342 			search_path[++total] = NULL;
    343 			break;
    344 #ifdef notyet
    345 		case 'F':
    346 			Fflag = 1;
    347 			break;
    348 #endif /* notyet */
    349 		case 'h':
    350 			usage();
    351 			return 0;
    352 		case 'o':
    353 			dbfile = optarg;
    354 			break;
    355 		case 'r':
    356 			rflag = 1;
    357 			break;
    358 		case 'S':
    359 			Sflag = 1;
    360 			break;
    361 		case 't':
    362 			hash = find_hash(optarg);
    363 			break;
    364 		case 'v':
    365 			vflag = 1;
    366 			break;
    367 		case 'W':
    368 			exit_on_error = 0;
    369 			break;
    370 		default:
    371 			usage();
    372 			return 1;
    373 		}
    374 	}
    375 
    376 	if (dbfile == NULL)
    377 		dbfile = DEFAULT_DBFILE;
    378 
    379 	if (hash == NULL) {
    380 		if ((hash = find_hash(DEFAULT_HASH)) == NULL)
    381 			errx(1, "No hash algorithm");
    382 	}
    383 
    384 	TAILQ_INIT(&fehead);
    385 
    386 	if (search_path == NULL)
    387 		Dflag = 1;
    388 
    389 	if (Dflag) {
    390 		char *sys_paths[] = DEFAULT_SYSPATHS;
    391 
    392 		if (vflag)
    393 			banner(hash, sys_paths);
    394 		walk_dir(sys_paths, hash);
    395 	}
    396 
    397 	if (search_path != NULL) {
    398 		if (vflag)
    399 			banner(hash, search_path);
    400 		walk_dir(search_path, hash);
    401 	}
    402 
    403 	store_entries(dbfile, hash);
    404 
    405 	if (Sflag && chflags(dbfile, SF_IMMUTABLE) != 0)
    406 		err(1, "Can't set immutable flag");
    407 
    408 	return 0;
    409 }
    410