1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/types.h>
30 #include <sys/errno.h>
31 #include <sys/mac.h>
32 #include <sys/stat.h>
33
34 #include <stdio.h>
35 #include <string.h>
36 #include <unistd.h>
37 #include <fcntl.h>
38 #include <paths.h>
39
40 #include <security/mac_veriexec/mac_veriexec.h>
41
42 #include "libveriexec.h"
43
44
45 static int
check_fd_mode(int fd,unsigned int mask)46 check_fd_mode(int fd, unsigned int mask)
47 {
48 struct stat st;
49
50 if (fstat(fd, &st) < 0)
51 return errno;
52
53 if ((st.st_mode & mask) == 0)
54 return EAUTH;
55
56 return 0;
57 }
58
59 int
veriexec_check_fd_mode(int fd,unsigned int mask)60 veriexec_check_fd_mode(int fd, unsigned int mask)
61 {
62 int error;
63
64 if (fd < 0) {
65 errno = EINVAL;
66 return -1;
67 }
68
69 error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_FD_SYSCALL,
70 (void *)(intptr_t)fd);
71 if (error == -1) {
72 switch (errno) {
73 case ENOSYS: /* veriexec not loaded */
74 error = 0; /* ignore */
75 break;
76 }
77 }
78 if (mask && error == 0)
79 error = check_fd_mode(fd, mask);
80
81 return (error);
82 }
83
84 int
veriexec_check_path_mode(const char * file,unsigned int mask)85 veriexec_check_path_mode(const char *file, unsigned int mask)
86 {
87 int error;
88
89 if (!file) {
90 errno = EINVAL;
91 return -1;
92 }
93
94 if (mask) {
95 int fd;
96
97 if ((fd = open(file, O_RDONLY)) < 0)
98 return errno;
99
100 error = veriexec_check_fd_mode(fd, mask);
101 close(fd);
102 return error;
103 }
104
105 error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_PATH_SYSCALL,
106 __DECONST(void *, file));
107 if (error == -1) {
108 switch (errno) {
109 case ENOSYS: /* veriexec not loaded */
110 error = 0; /* ignore */
111 break;
112 }
113 }
114 return (error);
115 }
116
117 int
veriexec_check_fd(int fd)118 veriexec_check_fd(int fd)
119 {
120 return veriexec_check_fd_mode(fd, 0);
121 }
122
123 int
veriexec_check_path(const char * file)124 veriexec_check_path(const char *file)
125 {
126 return veriexec_check_path_mode(file, 0);
127 }
128
129 #if defined(MAIN) || defined(UNIT_TEST)
130 int
main(int argc __unused,char * argv[]__unused)131 main(int argc __unused, char *argv[] __unused)
132 {
133 int error;
134 int rc = 0;
135
136 while (*++argv) {
137 error = veriexec_check_path(*argv);
138 if (error == -1) {
139 rc = 1;
140 warn("%s", *argv);
141 }
142 }
143 exit(rc);
144 }
145 #endif
146