1 /*
2  * $FreeBSD$
3  *
4  * Copyright (c) 2011, 2012, 2013, 2015, 2016, Juniper Networks, Inc.
5  * All rights reserved.
6  *
7  * Originally derived from:
8  *	$NetBSD: kern_verifiedexec.c,v 1.7 2003/11/18 13:13:03 martin Exp $
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
26  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 #include <sys/cdefs.h>
33 
34 #include "opt_mac.h"
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/imgact.h>
39 #include <sys/jail.h>
40 #include <sys/kernel.h>
41 #include <sys/lock.h>
42 #include <sys/malloc.h>
43 #include <sys/mount.h>
44 #include <sys/mutex.h>
45 #include <sys/proc.h>
46 #include <sys/sbuf.h>
47 #include <sys/syslog.h>
48 #include <sys/vnode.h>
49 
50 #include "mac_veriexec.h"
51 #include "mac_veriexec_internal.h"
52 
53 /**
54  * @var fpops_list
55  * @internal
56  * @brief Fingerprint operations list
57  *
58  * This is essentially the list of fingerprint modules currently loaded
59  */
60 static LIST_HEAD(fpopshead, mac_veriexec_fpops) fpops_list;
61 
62 static int mac_veriexec_late;
63 
64 static int sysctl_mac_veriexec_algorithms(SYSCTL_HANDLER_ARGS);
65 
66 SYSCTL_PROC(_security_mac_veriexec, OID_AUTO, algorithms,
67     CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
68     0, 0, sysctl_mac_veriexec_algorithms, "A",
69     "Verified execution supported hashing algorithms");
70 
71 static int
72 sysctl_mac_veriexec_algorithms(SYSCTL_HANDLER_ARGS)
73 {
74 	struct sbuf sb;
75 	struct mac_veriexec_fpops *fpops;
76 	int algorithms, error;
77 
78 	algorithms = 0;
79 	sbuf_new(&sb, NULL, 128, SBUF_AUTOEXTEND);
80 	LIST_FOREACH(fpops, &fpops_list, entries) {
81 		if (algorithms++)
82 			sbuf_printf(&sb, " ");
83 		sbuf_printf(&sb, "%s", fpops->type);
84 	}
85 	sbuf_finish(&sb);
86 	error = SYSCTL_OUT(req, sbuf_data(&sb), sbuf_len(&sb));
87 	sbuf_delete(&sb);
88 	return (error);
89 }
90 
91 /**
92  * @internal
93  * @brief Consistently identify file encountering errors
94  *
95  * @param imgp		image params to display
96  * @param td		calling thread
97  * @param msg		message to display
98  *
99  * @return String form of the information stored in @p imgp
100  */
101 static void
102 identify_error (struct image_params *imgp, struct thread *td, const char *msg)
103 {
104 	struct proc *parent;
105 	pid_t ppid, gppid;
106 
107 	parent = imgp->proc->p_pptr;
108 	ppid = (parent != NULL) ? parent->p_pid : 0;
109 	gppid = (parent != NULL && parent->p_pptr != NULL) ?
110 	    parent->p_pptr->p_pid : 0;
111 
112 	log(LOG_ERR, MAC_VERIEXEC_FULLNAME ": %s (file=%s fsid=%ju fileid=%ju "
113 	    "gen=%lu uid=%u pid=%u ppid=%u gppid=%u)", msg,
114 	    (imgp->args != NULL) ? imgp->args->fname : "",
115 	    (uintmax_t)imgp->attr->va_fsid, (uintmax_t)imgp->attr->va_fileid,
116 	    imgp->attr->va_gen, td->td_ucred->cr_ruid, imgp->proc->p_pid,
117 	    ppid, gppid);
118 }
119 
120 /**
121  * @internal
122  * @brief Check the fingerprint type for the given file and evaluate the
123  * fingerprint for that file.
124  *
125  * It is assumed that @p fingerprint has sufficient storage to hold the
126  * resulting fingerprint string.
127  *
128  * @param vp		vnode to check
129  * @param ip		file info from the meta-data store
130  * @param td		calling thread
131  * @param file_size	size of the file to read
132  * @param fingerprint	resulting fingerprint
133  *
134  * @return 0 on success, otherwise an error code.
135  */
136 static int
137 evaluate_fingerprint(struct vnode *vp, struct mac_veriexec_file_info *ip,
138     struct thread *td, off_t file_size, unsigned char *fingerprint)
139 {
140 	uint8_t *filebuf;
141 	void *ctx;
142 	off_t offset;
143 	size_t count, nread, resid;
144 	int error = EINVAL;
145 
146 	filebuf = malloc(PAGE_SIZE, M_VERIEXEC, M_WAITOK);
147 	ctx = malloc(ip->ops->context_size, M_VERIEXEC, M_WAITOK);
148 
149 	(ip->ops->init)(ctx);
150 	for (offset = 0; offset < file_size; offset += nread) {
151 		if ((offset + PAGE_SIZE) > file_size)
152 			count = file_size - offset;
153 		else
154 			count = PAGE_SIZE;
155 
156 		error = vn_rdwr_inchunks(UIO_READ, vp, filebuf, count, offset,
157 		    UIO_SYSSPACE, IO_NODELOCKED, td->td_ucred, NOCRED, &resid,
158 		    td);
159 		if (error)
160 			goto failed;
161 
162 		nread = count - resid;
163 		(ip->ops->update)(ctx, filebuf, nread);
164 	}
165 	(ip->ops->final)(fingerprint, ctx);
166 
167 #ifdef DEBUG_VERIEXEC_FINGERPRINT
168 	for (offset = 0; offset < ip->ops->digest_len; offset++)
169 		printf("%02x", fingerprint[offset]);
170 	printf("\n");
171 #endif
172 
173 failed:
174 	free(ctx, M_VERIEXEC);
175 	free(filebuf, M_VERIEXEC);
176 	return (error);
177 }
178 
179 /**
180  * @internal
181  * @brief Compare the two given fingerprints to see if they are the same.
182  *
183  * Differing fingerprint methods may have differing lengths which
184  * is handled by this routine.
185  *
186  * @param ip		file info from the meta-data store
187  * @param digest	digest to compare
188  *
189  * @return 0 if the fingerprints match and non-zero if they do not.
190  */
191 static int
192 fingerprintcmp(struct mac_veriexec_file_info *ip, unsigned char *digest)
193 {
194 
195 	return memcmp(ip->fingerprint, digest, ip->ops->digest_len);
196 }
197 
198 /**
199  * @brief Check if @p fingerprint matches the one associated with the vnode
200  *     @p vp
201  *
202  * @param vp		vnode to check
203  * @param ip		file info from the meta-data store
204  * @param td		calling thread
205  * @param file_size	size of the file to read
206  * @param fingerprint	fingerprint to compare
207  *
208  * @return 0 if they match, otherwise an error code.
209  */
210 int
211 mac_veriexec_fingerprint_check_vnode(struct vnode *vp,
212     struct mac_veriexec_file_info *ip, struct thread *td, off_t file_size,
213     unsigned char *fingerprint)
214 {
215 	int error;
216 
217 	/* reject fingerprint if writers are active */
218 	if (vp->v_writecount)
219 		return (ETXTBSY);
220 
221 	if ((vp->v_mount->mnt_flag & MNT_VERIFIED) != 0) {
222 		VERIEXEC_DEBUG(2, ("file %ju.%lu on verified %s mount\n",
223 		    (uintmax_t)ip->fileid, ip->gen,
224 		    vp->v_mount->mnt_vfc->vfc_name));
225 
226 		/*
227 		 * The VFS is backed by a file which has been verified.
228 		 * No need to waste time here.
229 		 */
230 		return (0);
231 	}
232 
233 	error = evaluate_fingerprint(vp, ip, td, file_size, fingerprint);
234 	if (error)
235 		return (error);
236 
237 	if (fingerprintcmp(ip, fingerprint) != 0)
238 		return (EAUTH);
239 
240 	return (0);
241 }
242 
243 /**
244  * @brief Check a file signature and validate it.
245  *
246  * @param imgp		parameters for the image to check
247  * @param check_files	if 1, check the files list first, otherwise check the
248  * 			exectuables list first
249  * @param td		calling thread
250  *
251  * @note Called with imgp->vp locked.
252  *
253  * @return 0 if the signature is valid, otherwise an error code.
254  */
255 int
256 mac_veriexec_fingerprint_check_image(struct image_params *imgp,
257     int check_files, struct thread *td)
258 {
259 	struct vnode *vp = imgp->vp;
260 	int error;
261 	fingerprint_status_t status;
262 
263 	if (!mac_veriexec_in_state(VERIEXEC_STATE_ACTIVE))
264 		return 0;
265 
266 	error = mac_veriexec_metadata_fetch_fingerprint_status(vp, imgp->attr,
267 	    td, check_files);
268 	if (error && error != EAUTH)
269 		return (error);
270 
271 	/*
272 	 * By now status is set.
273 	 */
274 	status = mac_veriexec_get_fingerprint_status(vp);
275 	switch (status) {
276 	case FINGERPRINT_INVALID: /* should not happen */
277 		identify_error(imgp, td, "got unexpected FINGERPRINT_INVALID");
278 		error = EPERM;
279 		break;
280 
281 	case FINGERPRINT_FILE:
282 		if (!check_files) {
283 			if (prison0.pr_securelevel > 1 ||
284 			    mac_veriexec_in_state(VERIEXEC_STATE_ENFORCE))
285 				error = EPERM;
286 		}
287 		break;
288 
289 	case FINGERPRINT_VALID: /* is ok - report so if debug is on */
290 		VERIEXEC_DEBUG(4, ("Fingerprint matches\n"));
291 		break;
292 
293 	case FINGERPRINT_INDIRECT: /* fingerprint ok but need to check
294 				      for direct execution */
295 		if (!imgp->interpreted) {
296 			identify_error(imgp, td, "attempted direct execution");
297 			if (prison0.pr_securelevel > 1 ||
298 			    mac_veriexec_in_state(VERIEXEC_STATE_ENFORCE))
299 				error = EPERM;
300 		}
301 		break;
302 
303 	case FINGERPRINT_NOMATCH: /* does not match - whine about it */
304 		identify_error(imgp, td,
305 		    "fingerprint does not match loaded value");
306 		if (prison0.pr_securelevel > 1 ||
307 		    mac_veriexec_in_state(VERIEXEC_STATE_ENFORCE))
308 			error = EAUTH;
309 		break;
310 
311 	case FINGERPRINT_NOENTRY: /* no entry in the list, complain */
312 		identify_error(imgp, td, "no fingerprint");
313 		if (prison0.pr_securelevel > 1 ||
314 		    mac_veriexec_in_state(VERIEXEC_STATE_ENFORCE))
315 			error = EAUTH;
316 		break;
317 
318 	case FINGERPRINT_NODEV: /* no signatures for the device, complain */
319 		identify_error(imgp, td, "no signatures for device");
320 		if (prison0.pr_securelevel > 1 ||
321 		    mac_veriexec_in_state(VERIEXEC_STATE_ENFORCE))
322 			error = EAUTH;
323 		break;
324 
325 	default: /* this should never happen. */
326 		identify_error(imgp, td, "invalid status field for vnode");
327 		error = EPERM;
328 	}
329 	return error;
330 }
331 
332 /**
333  * @brief Look up the fingerprint operations for a specific digest type
334  *
335  * @return A pointer to fingerprint operations, if found, or else @c NULL.
336  */
337 struct mac_veriexec_fpops *
338 mac_veriexec_fingerprint_lookup_ops(const char *type)
339 {
340 	struct mac_veriexec_fpops *fpops;
341 
342 	if (type == NULL)
343 		return (NULL);
344 
345 	LIST_FOREACH(fpops, &fpops_list, entries) {
346 		if (!strcasecmp(type, fpops->type))
347 			break;
348 	}
349 	return (fpops);
350 }
351 
352 /**
353  * @brief Add fingerprint operations for a specific digest type
354  *
355  * Any attempts to add a duplicate digest type results in an error.
356  *
357  * @return 0 if the ops were added successfully, otherwise an error code.
358  */
359 int
360 mac_veriexec_fingerprint_add_ops(struct mac_veriexec_fpops *fpops)
361 {
362 
363 	/* Sanity check the ops */
364 	if (fpops->type == NULL || fpops->digest_len == 0 ||
365 	    fpops->context_size == 0 || fpops->init == NULL ||
366 	    fpops->update == NULL || fpops->final == NULL)
367 		return (EINVAL);
368 
369 	/* Make sure we do not already have ops for this digest type */
370 	if (mac_veriexec_fingerprint_lookup_ops(fpops->type))
371 		return (EEXIST);
372 
373 	/* Add the ops to the list */
374 	LIST_INSERT_HEAD(&fpops_list, fpops, entries);
375 
376 	printf("MAC/veriexec fingerprint module loaded: %s\n", fpops->type);
377 
378 	return (0);
379 }
380 
381 /**
382  * @brief Initialize the fingerprint operations list
383  */
384 void
385 mac_veriexec_fingerprint_init(void)
386 {
387 
388 	LIST_INIT(&fpops_list);
389 }
390 
391 /**
392  * @brief Handle fingerprint module events
393  *
394  * This function is called by the @c MAC_VERIEXEC_FPMOD macro.
395  *
396  * @param mod		module information
397  * @param type		event type
398  * @param data		event-specific data
399  *
400  * @return On @c MOD_LOAD, 0 if the fingerprint ops were added successfully,
401  *     otherwise an error code. All other event types result in an error code.
402  */
403 int
404 mac_veriexec_fingerprint_modevent(module_t mod, int type, void *data)
405 {
406 	struct mac_veriexec_fpops *fpops;
407 	int error;
408 
409 	error = 0;
410 	fpops = (struct mac_veriexec_fpops *) data;
411 
412 	switch (type) {
413 	case MOD_LOAD:
414 		/* We do not allow late loading of fingerprint modules */
415 		if (mac_veriexec_late) {
416 			printf("%s: can't load %s fingerprint module after "
417 			    "booting\n", __func__, fpops->type);
418 			error = EBUSY;
419 			break;
420 		}
421 		error = mac_veriexec_fingerprint_add_ops(fpops);
422 		break;
423 	case MOD_UNLOAD:
424 		error = EBUSY;
425 		break;
426 	default:
427 		error = EOPNOTSUPP;
428 		break;
429 	}
430 
431 	return (error);
432 }
433 
434 /**
435  * @internal
436  * @brief Mark veriexec late initialization flag
437  */
438 static void
439 mac_veriexec_late_init(void)
440 {
441 
442 	mac_veriexec_late = 1;
443 }
444 
445 SYSINIT(mac_veriexec_late, SI_SUB_MAC_LATE, SI_ORDER_ANY,
446     mac_veriexec_late_init, NULL);
447