diff options
| author | elad <elad@NetBSD.org> | 2005-12-12 21:47:58 +0000 |
|---|---|---|
| committer | elad <elad@NetBSD.org> | 2005-12-12 21:47:58 +0000 |
| commit | a9505be892fdbe2d21143031e9635f3549e7eebf (patch) | |
| tree | ce4b95912d4c1436e46a45c3ff5f50ce00832d88 /sys | |
| parent | aa2ac86c1fe7c95cd71d63f50be60867d595867c (diff) | |
Add and document a "query" keyword to veriexecctl. Usage:
/sbin/veriexecctl query /path/to/file
will print out filename, device, inode, evaluation status, entry flags,
fingerprint, and fingerprinting algorithm.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/verified_exec.c | 38 | ||||
| -rw-r--r-- | sys/sys/verified_exec.h | 36 |
2 files changed, 60 insertions, 14 deletions
diff --git a/sys/dev/verified_exec.c b/sys/dev/verified_exec.c index b39a783d15c..bdbc405053e 100644 --- a/sys/dev/verified_exec.c +++ b/sys/dev/verified_exec.c @@ -1,4 +1,4 @@ -/* $NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $ */ +/* $NetBSD: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $ */ /*- * Copyright 2005 Elad Efrat <elad@bsd.org.il> @@ -31,9 +31,9 @@ #include <sys/cdefs.h> #if defined(__NetBSD__) -__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $"); +__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $"); #else -__RCSID("$Id: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $\n$NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $"); +__RCSID("$Id: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $\n$NetBSD: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $"); #endif #include <sys/param.h> @@ -179,6 +179,10 @@ veriexecioctl(dev_t dev __unused, u_long cmd, caddr_t data, error = veriexec_delete((struct veriexec_delete_params *)data); break; + case VERIEXEC_QUERY: + error = veriexec_query((struct veriexec_query_params *)data); + break; + default: /* Invalid operation. */ error = ENODEV; @@ -397,3 +401,31 @@ veriexec_delete(struct veriexec_delete_params *params) return (0); } + +int +veriexec_query(struct veriexec_query_params *params) +{ + struct veriexec_hash_entry *vhe; + int error; + + vhe = veriexec_lookup(params->dev, params->ino); + if (vhe == NULL) + return (ENOENT); + + params->type = vhe->type; + params->status = vhe->status; + params->hash_len = vhe->ops->hash_len; + strlcpy(params->fp_type, vhe->ops->type, sizeof(params->fp_type)); + memcpy(params->fp_type, vhe->ops->type, sizeof(params->fp_type)); + error = copyout(params, params->uaddr, sizeof(*params)); + if (error) + return (error); + if (params->fp_bufsize >= vhe->ops->hash_len) { + error = copyout(vhe->fp, params->fp, vhe->ops->hash_len); + if (error) + return (error); + } else + error = ENOMEM; + + return (error); +} diff --git a/sys/sys/verified_exec.h b/sys/sys/verified_exec.h index beca34a0e52..50cff558cc3 100644 --- a/sys/sys/verified_exec.h +++ b/sys/sys/verified_exec.h @@ -1,4 +1,4 @@ -/* $NetBSD: verified_exec.h,v 1.27 2005/12/12 16:26:34 elad Exp $ */ +/* $NetBSD: verified_exec.h,v 1.28 2005/12/12 21:47:58 elad Exp $ */ /*- * Copyright 2005 Elad Efrat <elad@bsd.org.il> @@ -60,6 +60,18 @@ struct veriexec_delete_params { ino_t ino; }; +struct veriexec_query_params { + unsigned char fp_type[VERIEXEC_TYPE_MAXLEN]; + dev_t dev; + ino_t ino; + unsigned char type; + unsigned char status; + unsigned char *fp; + size_t fp_bufsize; + size_t hash_len; + void *uaddr; +}; + /* Flags for a Veriexec entry. These can be OR'd together. */ #define VERIEXEC_DIRECT 0x01 /* Direct execution (exec) */ #define VERIEXEC_INDIRECT 0x02 /* Indirect execution (#!) */ @@ -70,6 +82,7 @@ struct veriexec_delete_params { #define VERIEXEC_LOAD _IOW('S', 0x1, struct veriexec_params) #define VERIEXEC_TABLESIZE _IOW('S', 0x2, struct veriexec_sizing_params) #define VERIEXEC_DELETE _IOW('S', 0x3, struct veriexec_delete_params) +#define VERIEXEC_QUERY _IOW('S', 0x4, struct veriexec_query_params) /* Verified exec sysctl objects. */ #define VERIEXEC_VERBOSE 1 /* Verbosity level. */ @@ -77,6 +90,16 @@ struct veriexec_delete_params { #define VERIEXEC_ALGORITHMS 3 /* Supported hashing algorithms. */ #define VERIEXEC_COUNT 4 /* # of fingerprinted files on device. */ +/* Valid status field values. */ +#define FINGERPRINT_NOTEVAL 0 /* fingerprint has not been evaluated */ +#define FINGERPRINT_VALID 1 /* fingerprint evaluated and matches list */ +#define FINGERPRINT_NOMATCH 2 /* fingerprint evaluated but does not match */ + +/* Per-page fingerprint status. */ +#define PAGE_FP_NONE 0 /* no per-page fingerprints. */ +#define PAGE_FP_READY 1 /* per-page fingerprints ready for use. */ +#define PAGE_FP_FAIL 2 /* mismatch in per-page fingerprints. */ + #ifdef _KERNEL void veriexecattach(struct device *, struct device *, void *); int veriexecopen(dev_t, int, int, struct lwp *); @@ -125,16 +148,6 @@ struct veriexec_hash_entry { LIST_ENTRY(veriexec_hash_entry) entries; /* List pointer. */ }; -/* Valid status field values. */ -#define FINGERPRINT_NOTEVAL 0 /* fingerprint has not been evaluated */ -#define FINGERPRINT_VALID 1 /* fingerprint evaluated and matches list */ -#define FINGERPRINT_NOMATCH 2 /* fingerprint evaluated but does not match */ - -/* Per-page fingerprint status. */ -#define PAGE_FP_NONE 0 /* no per-page fingerprints. */ -#define PAGE_FP_READY 1 /* per-page fingerprints ready for use. */ -#define PAGE_FP_FAIL 2 /* mismatch in per-page fingerprints. */ - LIST_HEAD(veriexec_hashhead, veriexec_hash_entry); /* Veriexec hash table information. */ @@ -203,6 +216,7 @@ void veriexec_report(const u_char *, const u_char *, struct vattr *, int veriexec_newtable(struct veriexec_sizing_params *); int veriexec_load(struct veriexec_params *, struct lwp *); int veriexec_delete(struct veriexec_delete_params *); +int veriexec_query(struct veriexec_query_params *); #endif /* _KERNEL */ |
