1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
|
/* $NetBSD: verified_exec.c,v 1.4 2003/07/14 15:47:04 lukem Exp $ */
/*-
* Copyright (c) 1998-1999 Brett Lymn
* (blymn@baea.com.au, brett_lymn@yahoo.com.au)
* All rights reserved.
*
* This code has been donated to The NetBSD Foundation by the Author.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. The name of the author may not be used to endorse or promote products
* derived from this software withough specific prior written permission
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.4 2003/07/14 15:47:04 lukem Exp $");
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/proc.h>
#include <sys/errno.h>
#include <sys/verified_exec.h>
#include <sys/buf.h>
#include <sys/malloc.h>
#include <sys/ioctl.h>
#include <sys/device.h>
#include <sys/conf.h>
#include <sys/lock.h>
#include <sys/queue.h>
#include <sys/vnode.h>
#include <sys/fcntl.h>
#include <sys/namei.h>
struct verified_exec_softc {
struct device veriexec_dev;
};
const struct cdevsw verifiedexec_cdevsw = {
verifiedexecopen, verifiedexecclose, noread, nowrite,
verifiedexecioctl, nostop, notty, nopoll, nommap, nokqfilter,
};
/* internal structures */
LIST_HEAD(veriexec_devhead, veriexec_dev_list) veriexec_dev_head;
/*LIST_HEAD(veriexec_file_devhead, veriexec_dev_list) veriexec_file_dev_head;*/
struct veriexec_devhead veriexec_file_dev_head;
/* Autoconfiguration glue */
void verifiedexecattach(struct device *parent, struct device *self,
void *aux);
int verifiedexecopen(dev_t dev, int flags, int fmt, struct proc *p);
int verifiedexecclose(dev_t dev, int flags, int fmt, struct proc *p);
int verifiedexecioctl(dev_t dev, u_long cmd, caddr_t data, int flags,
struct proc *p);
void add_veriexec_inode(struct veriexec_dev_list *list, unsigned long inode,
unsigned char fingerprint[MAXFINGERPRINTLEN],
unsigned char type, unsigned char fp_type);
struct veriexec_dev_list *find_veriexec_dev(unsigned long dev,
struct veriexec_devhead *head);
/*
* Attach for autoconfig to find. Initialise the lists and return...
*/
void
verifiedexecattach(struct device *parent, struct device *self, void *aux)
{
LIST_INIT(&veriexec_dev_head);
LIST_INIT(&veriexec_file_dev_head);
}
int
verifiedexecopen(dev_t dev, int flags, int fmt, struct proc *p)
{
return 0;
}
int
verifiedexecclose(dev_t dev, int flags, int fmt, struct proc *p)
{
#ifdef VERIFIED_EXEC_DEBUG_VERBOSE
struct veriexec_dev_list *lp;
struct veriexec_inode_list *ip;
printf("Loaded exec fingerprint list is:\n");
for (lp = LIST_FIRST(&veriexec_dev_head); lp != NULL;
lp = LIST_NEXT(lp, entries)) {
for (ip = LIST_FIRST(&(lp->inode_head)); ip != NULL;
ip = LIST_NEXT(ip, entries)) {
printf("Got loaded fingerprint for dev %lu, inode %lu\n",
lp->id, ip->inode);
}
}
printf("\n\nLoaded file fingerprint list is:\n");
for (lp = LIST_FIRST(&veriexec_file_dev_head); lp != NULL;
lp = LIST_NEXT(lp, entries)) {
for (ip = LIST_FIRST(&(lp->inode_head)); ip != NULL;
ip = LIST_NEXT(ip, entries)) {
printf("Got loaded fingerprint for dev %lu, inode %lu\n",
lp->id, ip->inode);
}
}
#endif
return 0;
}
/*
* Search the list of devices looking for the one given. If it is not
* in the list then add it.
*/
struct veriexec_dev_list *
find_veriexec_dev(unsigned long dev, struct veriexec_devhead *head)
{
struct veriexec_dev_list *lp;
for (lp = LIST_FIRST(head); lp != NULL;
lp = LIST_NEXT(lp, entries))
if (lp->id == dev) break;
if (lp == NULL) {
/* if pointer is null then entry not there, add a new one */
MALLOC(lp, struct veriexec_dev_list *,
sizeof(struct veriexec_dev_list), M_TEMP, M_WAITOK);
LIST_INIT(&(lp->inode_head));
lp->id = dev;
LIST_INSERT_HEAD(head, lp, entries);
}
return lp;
}
/*
* Add a file's inode and fingerprint to the list of inodes attached
* to the device id. Only add the entry if it is not already on the
* list.
*/
void
add_veriexec_inode(struct veriexec_dev_list *list, unsigned long inode,
unsigned char fingerprint[MAXFINGERPRINTLEN],
unsigned char type, unsigned char fp_type)
{
struct veriexec_inode_list *ip;
for (ip = LIST_FIRST(&(list->inode_head)); ip != NULL;
ip = LIST_NEXT(ip, entries))
/* check for a dupe inode in the list, skip if an entry
* exists for this inode except for when the type is
* VERIEXEC_INDIRECT, always set the type when it is so
* we don't get a hole caused by conflicting types on
* hardlinked files. XXX maybe we should validate
* fingerprint is same and complain if it is not...
*/
if (ip->inode == inode) {
if (type == VERIEXEC_INDIRECT)
ip->type = type;
return;
}
MALLOC(ip, struct veriexec_inode_list *, sizeof(struct veriexec_inode_list),
M_TEMP, M_WAITOK);
ip->type = type;
ip->fp_type = fp_type;
ip->inode = inode;
memcpy(ip->fingerprint, fingerprint, sizeof(ip->fingerprint));
LIST_INSERT_HEAD(&(list->inode_head), ip, entries);
}
/*
* Handle the ioctl for the device
*/
int
verifiedexecioctl(dev_t dev, u_long cmd, caddr_t data, int flags,
struct proc *p)
{
int error = 0;
struct verified_exec_params *params = (struct verified_exec_params *)data;
struct nameidata nid;
struct vattr vattr;
struct veriexec_dev_list *dlp;
#ifdef VERIFIED_EXEC_DEBUG
printf("veriexec_ioctl: got cmd 0x%lx for file %s\n", cmd, params->file);
#endif
switch (cmd) {
case VERIEXECLOAD:
if (securelevel > 0) {
/* don't allow updates when secure */
error = EPERM;
} else {
/*
* Get the attributes for the file name passed
* stash the file's device id and inode number
* along with it's fingerprint in a list for
* exec to use later.
*/
NDINIT(&nid, LOOKUP, FOLLOW, UIO_USERSPACE,
params->file, p);
if ((error = vn_open(&nid, FREAD, 0)) != 0) {
return(error);
}
error = VOP_GETATTR(nid.ni_vp, &vattr, p->p_ucred, p);
if (error) {
nid.ni_vp->fp_status = FINGERPRINT_INVALID;
VOP_UNLOCK(nid.ni_vp, 0);
(void) vn_close(nid.ni_vp, FREAD,
p->p_ucred, p);
return(error);
}
/* invalidate the node fingerprint status
* which will have been set in the vn_open
* and would always be FINGERPRINT_NOTFOUND
*/
nid.ni_vp->fp_status = FINGERPRINT_INVALID;
VOP_UNLOCK(nid.ni_vp, 0);
(void) vn_close(nid.ni_vp, FREAD, p->p_ucred, p);
/* vattr.va_fsid = dev, vattr.va_fileid = inode */
if (params->type == VERIEXEC_FILE) {
dlp = find_veriexec_dev(vattr.va_fsid,
&veriexec_file_dev_head);
} else {
dlp = find_veriexec_dev(vattr.va_fsid,
&veriexec_dev_head);
}
add_veriexec_inode(dlp, vattr.va_fileid,
params->fingerprint, params->type,
params->fp_type);
}
break;
default:
error = ENODEV;
}
return (error);
}
|