summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2005-12-12 21:47:58 +0000
committerelad <elad@NetBSD.org>2005-12-12 21:47:58 +0000
commita9505be892fdbe2d21143031e9635f3549e7eebf (patch)
treece4b95912d4c1436e46a45c3ff5f50ce00832d88 /sys
parentaa2ac86c1fe7c95cd71d63f50be60867d595867c (diff)
Add and document a "query" keyword to veriexecctl. Usage:
/sbin/veriexecctl query /path/to/file will print out filename, device, inode, evaluation status, entry flags, fingerprint, and fingerprinting algorithm.
Diffstat (limited to 'sys')
-rw-r--r--sys/dev/verified_exec.c38
-rw-r--r--sys/sys/verified_exec.h36
2 files changed, 60 insertions, 14 deletions
diff --git a/sys/dev/verified_exec.c b/sys/dev/verified_exec.c
index b39a783d15c..bdbc405053e 100644
--- a/sys/dev/verified_exec.c
+++ b/sys/dev/verified_exec.c
@@ -1,4 +1,4 @@
-/* $NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $ */
+/* $NetBSD: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $ */
/*-
* Copyright 2005 Elad Efrat <elad@bsd.org.il>
@@ -31,9 +31,9 @@
#include <sys/cdefs.h>
#if defined(__NetBSD__)
-__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $");
#else
-__RCSID("$Id: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $\n$NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $");
+__RCSID("$Id: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $\n$NetBSD: verified_exec.c,v 1.31 2005/12/12 21:47:58 elad Exp $");
#endif
#include <sys/param.h>
@@ -179,6 +179,10 @@ veriexecioctl(dev_t dev __unused, u_long cmd, caddr_t data,
error = veriexec_delete((struct veriexec_delete_params *)data);
break;
+ case VERIEXEC_QUERY:
+ error = veriexec_query((struct veriexec_query_params *)data);
+ break;
+
default:
/* Invalid operation. */
error = ENODEV;
@@ -397,3 +401,31 @@ veriexec_delete(struct veriexec_delete_params *params)
return (0);
}
+
+int
+veriexec_query(struct veriexec_query_params *params)
+{
+ struct veriexec_hash_entry *vhe;
+ int error;
+
+ vhe = veriexec_lookup(params->dev, params->ino);
+ if (vhe == NULL)
+ return (ENOENT);
+
+ params->type = vhe->type;
+ params->status = vhe->status;
+ params->hash_len = vhe->ops->hash_len;
+ strlcpy(params->fp_type, vhe->ops->type, sizeof(params->fp_type));
+ memcpy(params->fp_type, vhe->ops->type, sizeof(params->fp_type));
+ error = copyout(params, params->uaddr, sizeof(*params));
+ if (error)
+ return (error);
+ if (params->fp_bufsize >= vhe->ops->hash_len) {
+ error = copyout(vhe->fp, params->fp, vhe->ops->hash_len);
+ if (error)
+ return (error);
+ } else
+ error = ENOMEM;
+
+ return (error);
+}
diff --git a/sys/sys/verified_exec.h b/sys/sys/verified_exec.h
index beca34a0e52..50cff558cc3 100644
--- a/sys/sys/verified_exec.h
+++ b/sys/sys/verified_exec.h
@@ -1,4 +1,4 @@
-/* $NetBSD: verified_exec.h,v 1.27 2005/12/12 16:26:34 elad Exp $ */
+/* $NetBSD: verified_exec.h,v 1.28 2005/12/12 21:47:58 elad Exp $ */
/*-
* Copyright 2005 Elad Efrat <elad@bsd.org.il>
@@ -60,6 +60,18 @@ struct veriexec_delete_params {
ino_t ino;
};
+struct veriexec_query_params {
+ unsigned char fp_type[VERIEXEC_TYPE_MAXLEN];
+ dev_t dev;
+ ino_t ino;
+ unsigned char type;
+ unsigned char status;
+ unsigned char *fp;
+ size_t fp_bufsize;
+ size_t hash_len;
+ void *uaddr;
+};
+
/* Flags for a Veriexec entry. These can be OR'd together. */
#define VERIEXEC_DIRECT 0x01 /* Direct execution (exec) */
#define VERIEXEC_INDIRECT 0x02 /* Indirect execution (#!) */
@@ -70,6 +82,7 @@ struct veriexec_delete_params {
#define VERIEXEC_LOAD _IOW('S', 0x1, struct veriexec_params)
#define VERIEXEC_TABLESIZE _IOW('S', 0x2, struct veriexec_sizing_params)
#define VERIEXEC_DELETE _IOW('S', 0x3, struct veriexec_delete_params)
+#define VERIEXEC_QUERY _IOW('S', 0x4, struct veriexec_query_params)
/* Verified exec sysctl objects. */
#define VERIEXEC_VERBOSE 1 /* Verbosity level. */
@@ -77,6 +90,16 @@ struct veriexec_delete_params {
#define VERIEXEC_ALGORITHMS 3 /* Supported hashing algorithms. */
#define VERIEXEC_COUNT 4 /* # of fingerprinted files on device. */
+/* Valid status field values. */
+#define FINGERPRINT_NOTEVAL 0 /* fingerprint has not been evaluated */
+#define FINGERPRINT_VALID 1 /* fingerprint evaluated and matches list */
+#define FINGERPRINT_NOMATCH 2 /* fingerprint evaluated but does not match */
+
+/* Per-page fingerprint status. */
+#define PAGE_FP_NONE 0 /* no per-page fingerprints. */
+#define PAGE_FP_READY 1 /* per-page fingerprints ready for use. */
+#define PAGE_FP_FAIL 2 /* mismatch in per-page fingerprints. */
+
#ifdef _KERNEL
void veriexecattach(struct device *, struct device *, void *);
int veriexecopen(dev_t, int, int, struct lwp *);
@@ -125,16 +148,6 @@ struct veriexec_hash_entry {
LIST_ENTRY(veriexec_hash_entry) entries; /* List pointer. */
};
-/* Valid status field values. */
-#define FINGERPRINT_NOTEVAL 0 /* fingerprint has not been evaluated */
-#define FINGERPRINT_VALID 1 /* fingerprint evaluated and matches list */
-#define FINGERPRINT_NOMATCH 2 /* fingerprint evaluated but does not match */
-
-/* Per-page fingerprint status. */
-#define PAGE_FP_NONE 0 /* no per-page fingerprints. */
-#define PAGE_FP_READY 1 /* per-page fingerprints ready for use. */
-#define PAGE_FP_FAIL 2 /* mismatch in per-page fingerprints. */
-
LIST_HEAD(veriexec_hashhead, veriexec_hash_entry);
/* Veriexec hash table information. */
@@ -203,6 +216,7 @@ void veriexec_report(const u_char *, const u_char *, struct vattr *,
int veriexec_newtable(struct veriexec_sizing_params *);
int veriexec_load(struct veriexec_params *, struct lwp *);
int veriexec_delete(struct veriexec_delete_params *);
+int veriexec_query(struct veriexec_query_params *);
#endif /* _KERNEL */