1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/types.h> 30 #include <sys/errno.h> 31 #include <sys/mac.h> 32 #include <sys/stat.h> 33 34 #include <stdio.h> 35 #include <string.h> 36 #include <unistd.h> 37 #include <fcntl.h> 38 #include <paths.h> 39 40 #include <security/mac_veriexec/mac_veriexec.h> 41 42 #include "libveriexec.h" 43 44 45 static int 46 check_fd_mode(int fd, unsigned int mask) 47 { 48 struct stat st; 49 50 if (fstat(fd, &st) < 0) 51 return errno; 52 53 if ((st.st_mode & mask) == 0) 54 return EAUTH; 55 56 return 0; 57 } 58 59 int 60 veriexec_check_fd_mode(int fd, unsigned int mask) 61 { 62 int error; 63 64 if (fd < 0) { 65 errno = EINVAL; 66 return -1; 67 } 68 69 error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_FD_SYSCALL, 70 (void *)(intptr_t)fd); 71 if (error == -1) { 72 switch (errno) { 73 case ENOSYS: /* veriexec not loaded */ 74 error = 0; /* ignore */ 75 break; 76 } 77 } 78 if (mask && error == 0) 79 error = check_fd_mode(fd, mask); 80 81 return (error); 82 } 83 84 int 85 veriexec_check_path_mode(const char *file, unsigned int mask) 86 { 87 int error; 88 89 if (!file) { 90 errno = EINVAL; 91 return -1; 92 } 93 94 if (mask) { 95 int fd; 96 97 if ((fd = open(file, O_RDONLY)) < 0) 98 return errno; 99 100 error = veriexec_check_fd_mode(fd, mask); 101 close(fd); 102 return error; 103 } 104 105 error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_PATH_SYSCALL, 106 __DECONST(void *, file)); 107 if (error == -1) { 108 switch (errno) { 109 case ENOSYS: /* veriexec not loaded */ 110 error = 0; /* ignore */ 111 break; 112 } 113 } 114 return (error); 115 } 116 117 int 118 veriexec_check_fd(int fd) 119 { 120 return veriexec_check_fd_mode(fd, 0); 121 } 122 123 int 124 veriexec_check_path(const char *file) 125 { 126 return veriexec_check_path_mode(file, 0); 127 } 128 129 #if defined(MAIN) || defined(UNIT_TEST) 130 int 131 main(int argc __unused, char *argv[] __unused) 132 { 133 int error; 134 int rc = 0; 135 136 while (*++argv) { 137 error = veriexec_check_path(*argv); 138 if (error == -1) { 139 rc = 1; 140 warn("%s", *argv); 141 } 142 } 143 exit(rc); 144 } 145 #endif 146