Page MenuHomeFreeBSD
Files F150525611

D8562.diff
No OneTemporary
Actions

D8562.diff
View Options

Index: head/lib/libveriexec/Makefile
===================================================================
--- head/lib/libveriexec/Makefile
+++ head/lib/libveriexec/Makefile
@@ -0,0 +1,14 @@
+# $FreeBSD$
+
+.include <bsd.own.mk>
+
+LIB= veriexec
+MAN= veriexec.3
+INCS= libveriexec.h
+
+WARNS?= 2
+
+SRCS= veriexec_check.c
+
+.include <bsd.lib.mk>
+
Index: head/lib/libveriexec/libveriexec.h
===================================================================
--- head/lib/libveriexec/libveriexec.h
+++ head/lib/libveriexec/libveriexec.h
@@ -0,0 +1,37 @@
+/*
+ * $FreeBSD$
+ *
+ * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef __LIBVERIEXEC_H__
+#define __LIBVERIEXEC_H__
+
+int veriexec_check_fd_mode(int, unsigned int);
+int veriexec_check_path_mode(const char *, unsigned int);
+int veriexec_check_fd(int);
+int veriexec_check_path(const char *);
+
+#endif /* __LIBVERIEXEC_H__ */
Index: head/lib/libveriexec/veriexec.3
===================================================================
--- head/lib/libveriexec/veriexec.3
+++ head/lib/libveriexec/veriexec.3
@@ -0,0 +1,65 @@
+.\" Copyright (c) 2018, Juniper Networks, Inc.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd June 19, 2018
+.Dt VERIEXEC 3
+.Os
+.Sh NAME
+.Nm veriexec_check_fd ,
+.Nm veriexec_check_path
+.Nd Verified execution routines
+.Sh LIBRARY
+.Lb libveriexec
+.Sh SYNOPSIS
+.In libveriexec.h
+.Ft int
+.Fn veriexec_check_fd "int fd"
+.Ft int
+.Fn veriexec_check_path "const char *file"
+.Sh DESCRIPTION
+The
+.Fn veriexec_check_fd
+function checks the signature of the file represented by the
+.Fa fd
+file descriptor.
+.Pp
+The
+.Fn veriexec_check_path
+function checks the signature of the file path
+.Fa file .
+.Pp
+The
+.Fn veriexec_check_fd
+and
+.Fn veriexec_check_path
+functions return zero on a successful signature match or if veriexec is not
+enabled.
+If the signature does not match,
+.Va errno
+is set to the reason for the mismatch.
+.Sh SEE ALSO
+.Xr mac_veriexec 4
+.Xr veriexec 4
Index: head/lib/libveriexec/veriexec_check.c
===================================================================
--- head/lib/libveriexec/veriexec_check.c
+++ head/lib/libveriexec/veriexec_check.c
@@ -0,0 +1,146 @@
+/*
+ * $FreeBSD$
+ *
+ * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/mac.h>
+#include <sys/stat.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <paths.h>
+
+#include <security/mac_veriexec/mac_veriexec.h>
+
+#include "libveriexec.h"
+
+
+static int
+check_fd_mode(int fd, unsigned int mask)
+{
+ struct stat st;
+
+ if (fstat(fd, &st) < 0)
+ return errno;
+
+ if ((st.st_mode & mask) == 0)
+ return EAUTH;
+
+ return 0;
+}
+
+int
+veriexec_check_fd_mode(int fd, unsigned int mask)
+{
+ int error;
+
+ if (fd < 0) {
+ errno = EINVAL;
+ return -1;
+ }
+
+ error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_FD_SYSCALL,
+ (void *)(intptr_t)fd);
+ if (error == -1) {
+ switch (errno) {
+ case ENOSYS: /* veriexec not loaded */
+ error = 0; /* ignore */
+ break;
+ }
+ }
+ if (mask && error == 0)
+ error = check_fd_mode(fd, mask);
+
+ return (error);
+}
+
+int
+veriexec_check_path_mode(const char *file, unsigned int mask)
+{
+ int error;
+
+ if (!file) {
+ errno = EINVAL;
+ return -1;
+ }
+
+ if (mask) {
+ int fd;
+
+ if ((fd = open(file, O_RDONLY)) < 0)
+ return errno;
+
+ error = veriexec_check_fd_mode(fd, mask);
+ close(fd);
+ return error;
+ }
+
+ error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_PATH_SYSCALL,
+ __DECONST(void *, file));
+ if (error == -1) {
+ switch (errno) {
+ case ENOSYS: /* veriexec not loaded */
+ error = 0; /* ignore */
+ break;
+ }
+ }
+ return (error);
+}
+
+int
+veriexec_check_fd(int fd)
+{
+ return veriexec_check_fd_mode(fd, 0);
+}
+
+int
+veriexec_check_path(const char *file)
+{
+ return veriexec_check_path_mode(file, 0);
+}
+
+#if defined(MAIN) || defined(UNIT_TEST)
+int
+main(int argc __unused, char *argv[] __unused)
+{
+ int error;
+ int rc = 0;
+
+ while (*++argv) {
+ error = veriexec_check_path(*argv);
+ if (error == -1) {
+ rc = 1;
+ warn("%s", *argv);
+ }
+ }
+ exit(rc);
+}
+#endif

File Metadata

Mime Type
text/plain
Expires
Fri, Apr 3, 12:56 AM (20 h, 13 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
30740023
Default Alt Text
D8562.diff (8 KB)

Event Timeline