diff options
| author | elad <elad@NetBSD.org> | 2007-05-15 19:47:43 +0000 |
|---|---|---|
| committer | elad <elad@NetBSD.org> | 2007-05-15 19:47:43 +0000 |
| commit | 6700cfccd6fc77b676d11ebee0b31cf4f4448de6 (patch) | |
| tree | f26dc22f856b50f7795dc3c220350cbc831244e4 /sys/dev/verified_exec.c | |
| parent | c2fc013d5f0a42398b9ffa468558a582a7c87c45 (diff) | |
Some Veriexec stuff that's been rotting in my tree for months.
Bug fixes:
- Fix crash reported by Scott Ellis on current-users@.
- Fix race conditions in enforcing the Veriexec rename and remove
policies. These are NOT security issues.
- Fix memory leak in rename handling when overwriting a monitored
file.
- Fix table deletion logic.
- Don't prevent query requests if not in learning mode.
KPI updates:
- fileassoc_table_run() now takes a cookie to pass to the callback.
- veriexec_table_add() was removed, it is now done internally. As a
result, there's no longer a need for VERIEXEC_TABLESIZE.
- veriexec_report() was removed, it is now internal.
- Perform sanity checks on the entry type, and enforce default type
in veriexec_file_add() rather than in veriexecctl.
- Add veriexec_flush(), used to delete all Veriexec tables, and
veriexec_dump(), used to fill an array with all Veriexec entries.
New features:
- Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
database. This allows Veriexec to produce slightly more accurate
logs under certain circumstances. In the future, this can be either
replaced by vnode->pathname translation, or combined with it.
- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
This can be used to recover a database if the file was lost.
Example usage:
# veriexecctl dump > /etc/signatures
Note that only entries with the filename kept (that is, were loaded
with the '-k' flag) will be dumped.
Idea from Brett Lymn.
- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
usage:
# veriexecctl flush
- Add a 'veriexec_flags' rc(8) variable, and make its default have
the '-k' flag. On systems using the default signatures file
(generaetd from running 'veriexecgen' with no arguments), this will
use additional 32kb of kernel memory on average.
- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
load. This is done automatically for files marked as 'untrusted'.
Misc. stuff:
- The code for veriexecctl was massively simplified as a result of
eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
pass of the signatures file, making the loading somewhat faster.
- Lots of minor fixes found using the (still under development)
Veriexec regression testsuite.
- Some of the messages Veriexec prints were improved.
- Various documentation fixes.
All relevant man-pages were updated to reflect the above changes.
Binary compatibility with existing veriexecctl binaries is maintained.
Diffstat (limited to 'sys/dev/verified_exec.c')
| -rw-r--r-- | sys/dev/verified_exec.c | 179 |
1 files changed, 103 insertions, 76 deletions
diff --git a/sys/dev/verified_exec.c b/sys/dev/verified_exec.c index 3a9a27196fe..f3d371702df 100644 --- a/sys/dev/verified_exec.c +++ b/sys/dev/verified_exec.c @@ -1,4 +1,4 @@ -/* $NetBSD: verified_exec.c,v 1.59 2007/03/04 06:01:43 christos Exp $ */ +/* $NetBSD: verified_exec.c,v 1.60 2007/05/15 19:47:45 elad Exp $ */ /*- * Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org> @@ -30,9 +30,9 @@ #include <sys/cdefs.h> #if defined(__NetBSD__) -__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.59 2007/03/04 06:01:43 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.60 2007/05/15 19:47:45 elad Exp $"); #else -__RCSID("$Id: verified_exec.c,v 1.59 2007/03/04 06:01:43 christos Exp $\n$NetBSD: verified_exec.c,v 1.59 2007/03/04 06:01:43 christos Exp $"); +__RCSID("$Id: verified_exec.c,v 1.60 2007/05/15 19:47:45 elad Exp $\n$NetBSD: verified_exec.c,v 1.60 2007/05/15 19:47:45 elad Exp $"); #endif #include <sys/param.h> @@ -57,6 +57,11 @@ __RCSID("$Id: verified_exec.c,v 1.59 2007/03/04 06:01:43 christos Exp $\n$NetBSD #include <prop/proplib.h> +void veriexecattach(struct device *, struct device *, void *); +static dev_type_open(veriexecopen); +static dev_type_close(veriexecclose); +static dev_type_ioctl(veriexecioctl); + struct veriexec_softc { DEVPORT_DEVICE veriexec_dev; }; @@ -92,75 +97,115 @@ const struct cdevsw veriexec_cdevsw = { #endif }; -static int veriexec_query(prop_dictionary_t, prop_dictionary_t, struct lwp *); -static int veriexec_delete(prop_dictionary_t, struct lwp *); - /* count of number of times device is open (we really only allow one open) */ -static unsigned int veriexec_dev_usage; +static unsigned int veriexec_dev_usage = 0; void veriexecattach(DEVPORT_DEVICE *parent, DEVPORT_DEVICE *self, void *aux) { veriexec_dev_usage = 0; - - veriexec_report("Pseudo-device attached.", "(internal)", NULL, - REPORT_DEBUG); } -int +static int veriexecopen(dev_t dev, int flags, int fmt, struct lwp *l) { - veriexec_report("Pseudo-device open attempt.", "(internal)", l, - REPORT_DEBUG | REPORT_ALARM); - if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) return (EPERM); - if (veriexec_dev_usage > 0) { - veriexec_report("Pseudo-device already in use.", "(internal)", - NULL, REPORT_DEBUG); - + if (veriexec_dev_usage > 0) return(EBUSY); - } veriexec_dev_usage++; return (0); } -int -veriexecclose(dev_t dev, int flags, int fmt, - struct lwp *l) +static int +veriexecclose(dev_t dev, int flags, int fmt, struct lwp *l) { if (veriexec_dev_usage > 0) veriexec_dev_usage--; return (0); } +static int +veriexec_delete(prop_dictionary_t dict, struct lwp *l) +{ + struct nameidata nid; + int error; + + NDINIT(&nid, LOOKUP, FOLLOW, UIO_SYSSPACE, + prop_string_cstring_nocopy(prop_dictionary_get(dict, "file")), l); + error = namei(&nid); + if (error) + return (error); + + /* XXX this should be done differently... */ + if (nid.ni_vp->v_type == VREG) + error = veriexec_file_delete(l, nid.ni_vp); + else if (nid.ni_vp->v_type == VDIR) + error = veriexec_table_delete(l, nid.ni_vp->v_mount); + + vrele(nid.ni_vp); + + return (error); +} + +static int +veriexec_query(prop_dictionary_t dict, prop_dictionary_t rdict, struct lwp *l) +{ + struct nameidata nid; + int error; + + NDINIT(&nid, LOOKUP, FOLLOW, UIO_SYSSPACE, + prop_string_cstring_nocopy(prop_dictionary_get(dict, "file")), l); + error = namei(&nid); + if (error) + return (error); + + error = veriexec_convert(nid.ni_vp, rdict); + + vrele(nid.ni_vp); + + return (error); +} + int -veriexecioctl(dev_t dev, u_long cmd, void *data, int flags, - struct lwp *l) +veriexecioctl(dev_t dev, u_long cmd, void *data, int flags, struct lwp *l) { + extern int veriexec_strict; struct plistref *plistref; prop_dictionary_t dict; int error = 0; - if (veriexec_strict > VERIEXEC_LEARNING) { - log(LOG_WARNING, "Veriexec: Strict mode, modifying tables not " - "permitted.\n"); + /* XXX This should be replaced with a kauth(9) request. */ + switch (cmd) { + case VERIEXEC_TABLESIZE: + case VERIEXEC_LOAD: + case VERIEXEC_DELETE: + case VERIEXEC_FLUSH: + if (veriexec_strict > VERIEXEC_LEARNING) { + log(LOG_WARNING, "Veriexec: Strict mode, modifying " + "tables not permitted.\n"); + + return (EPERM); + } - return (EPERM); + break; + + case VERIEXEC_QUERY: + case VERIEXEC_DUMP: + break; + + default: + /* Invalid operation. */ + return (ENODEV); } plistref = (struct plistref *)data; switch (cmd) { case VERIEXEC_TABLESIZE: - error = prop_dictionary_copyin_ioctl(plistref, cmd, &dict); - if (error) - break; - - error = veriexec_table_add(l, dict); - prop_object_release(dict); + /* Do nothing. Kept for binary compatibility. */ break; case VERIEXEC_LOAD: @@ -207,6 +252,30 @@ veriexecioctl(dev_t dev, u_long cmd, void *data, int flags, break; } + case VERIEXEC_DUMP: { + prop_array_t rarray; + + rarray = prop_array_create(); + if (rarray == NULL) { + error = ENOMEM; + break; + } + + error = veriexec_dump(l, rarray); + if (error == 0) { + error = prop_array_copyout_ioctl(plistref, cmd, + rarray); + } + + prop_object_release(rarray); + + break; + } + + case VERIEXEC_FLUSH: + error = veriexec_flush(l); + break; + default: /* Invalid operation. */ error = ENODEV; @@ -227,45 +296,3 @@ veriexec_drvinit(void *unused) SYSINIT(veriexec, SI_SUB_PSEUDO, SI_ORDER_ANY, veriexec_drvinit, NULL); #endif - -static int -veriexec_delete(prop_dictionary_t dict, struct lwp *l) -{ - struct nameidata nid; - int error; - - NDINIT(&nid, LOOKUP, FOLLOW, UIO_SYSSPACE, - prop_string_cstring_nocopy(prop_dictionary_get(dict, "file")), l); - error = namei(&nid); - if (error) - return (error); - - /* XXX this should be done differently... */ - if (nid.ni_vp->v_type == VREG) - error = veriexec_file_delete(l, nid.ni_vp); - else if (nid.ni_vp->v_type == VDIR) - error = veriexec_table_delete(l, nid.ni_vp->v_mount); - - vrele(nid.ni_vp); - - return (error); -} - -static int -veriexec_query(prop_dictionary_t dict, prop_dictionary_t rdict, struct lwp *l) -{ - struct nameidata nid; - int error; - - NDINIT(&nid, LOOKUP, FOLLOW, UIO_SYSSPACE, - prop_string_cstring_nocopy(prop_dictionary_get(dict, "file")), l); - error = namei(&nid); - if (error) - return (error); - - error = veriexec_convert(nid.ni_vp, rdict); - - vrele(nid.ni_vp); - - return (error); -} |
