1 /* 2 * $FreeBSD$ 3 * 4 * Copyright (c) 2011, 2012, 2013, 2015, 2016, 2019, Juniper Networks, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #ifndef _SECURITY_MAC_VERIEXEC_H 30 #define _SECURITY_MAC_VERIEXEC_H 31 32 #ifdef _KERNEL 33 #include <sys/types.h> 34 #include <sys/kernel.h> 35 #include <sys/queue.h> 36 #include <sys/module.h> 37 #endif 38 39 /** 40 * Name of the MAC module 41 */ 42 #define MAC_VERIEXEC_NAME "mac_veriexec" 43 44 /* MAC/veriexec syscalls */ 45 #define MAC_VERIEXEC_CHECK_FD_SYSCALL 1 46 #define MAC_VERIEXEC_CHECK_PATH_SYSCALL 2 47 48 /** 49 * Enough room for the largest signature... 50 */ 51 #define MAXFINGERPRINTLEN 64 /* enough room for largest signature */ 52 #define MAXLABELLEN 128 53 54 /* 55 * Types of veriexec inodes we can have 56 */ 57 #define VERIEXEC_INDIRECT (1<<0) /* Only allow indirect execution */ 58 #define VERIEXEC_FILE (1<<1) /* Fingerprint of a plain file */ 59 #define VERIEXEC_NOTRACE (1<<2) /**< PTRACE not allowed */ 60 #define VERIEXEC_TRUSTED (1<<3) /**< Safe to write /dev/mem */ 61 #define VERIEXEC_NOFIPS (1<<4) /**< Not allowed in FIPS mode */ 62 #define VERIEXEC_LABEL (1<<5) /**< We have a label */ 63 64 #define VERIEXEC_STATE_INACTIVE 0 /**< Ignore */ 65 #define VERIEXEC_STATE_LOADED (1<<0) /**< Sigs have been loaded */ 66 #define VERIEXEC_STATE_ACTIVE (1<<1) /**< Pay attention to it */ 67 #define VERIEXEC_STATE_ENFORCE (1<<2) /**< Fail execs for files that do not 68 match signature */ 69 #define VERIEXEC_STATE_LOCKED (1<<3) /**< Do not allow further changes */ 70 71 #ifdef _KERNEL 72 /** 73 * Version of the MAC/veriexec module 74 */ 75 #define MAC_VERIEXEC_VERSION 2 76 77 /* Valid states for the fingerprint flag - if signed exec is being used */ 78 typedef enum fingerprint_status { 79 FINGERPRINT_INVALID, /**< Fingerprint has not been evaluated */ 80 FINGERPRINT_VALID, /**< Fingerprint evaluated and matches list */ 81 FINGERPRINT_INDIRECT, /**< Fingerprint eval'd/matched but only 82 indirect execs allowed */ 83 FINGERPRINT_FILE, /**< Fingerprint evaluated/matched but 84 not executable */ 85 FINGERPRINT_NOMATCH, /**< Fingerprint evaluated but does not match */ 86 FINGERPRINT_NOENTRY, /**< Fingerprint evaluated but no list entry */ 87 FINGERPRINT_NODEV, /**< Fingerprint evaluated but no dev list */ 88 } fingerprint_status_t; 89 90 typedef void (*mac_veriexec_fpop_init_t)(void *); 91 typedef void (*mac_veriexec_fpop_update_t)(void *, const uint8_t *, size_t); 92 typedef void (*mac_veriexec_fpop_final_t)(uint8_t *, void *); 93 94 struct mac_veriexec_fpops { 95 const char *type; 96 size_t digest_len; 97 size_t context_size; 98 mac_veriexec_fpop_init_t init; 99 mac_veriexec_fpop_update_t update; 100 mac_veriexec_fpop_final_t final; 101 LIST_ENTRY(mac_veriexec_fpops) entries; 102 }; 103 104 /** 105 * Verified execution subsystem debugging level 106 */ 107 extern int mac_veriexec_debug; 108 109 /** 110 * @brief Define a fingerprint module. 111 * 112 * @param _name Name of the fingerprint module 113 * @param _digest_len Length of the digest string, in number of characters 114 * @param _context_size Size of the context structure, in bytes 115 * @param _init Initialization function of type 116 * mac_veriexec_fpop_init_t 117 * @param _update Update function of type mac_veriexec_fpop_update_t 118 * @param _final Finalize function of type mac_veriexec_fpop_final_t 119 * @param _vers Module version 120 */ 121 #define MAC_VERIEXEC_FPMOD(_name, _digest_len, _context_size, _init, \ 122 _update, _final, _vers) \ 123 static struct mac_veriexec_fpops \ 124 mac_veriexec_##_name##_fpops = { \ 125 .type = #_name, \ 126 .digest_len = _digest_len, \ 127 .context_size = _context_size, \ 128 .init = _init, \ 129 .update = _update, \ 130 .final = _final, \ 131 }; \ 132 static moduledata_t mac_veriexec_##_name##_mod = { \ 133 "mac_veriexec/" #_name, \ 134 mac_veriexec_fingerprint_modevent, \ 135 &(mac_veriexec_##_name##_fpops) \ 136 }; \ 137 MODULE_VERSION(mac_veriexec_##_name, _vers); \ 138 DECLARE_MODULE(mac_veriexec_##_name, \ 139 mac_veriexec_##_name##_mod, SI_SUB_MAC_POLICY, \ 140 SI_ORDER_ANY); \ 141 MODULE_DEPEND(mac_veriexec_##_name, mac_veriexec, \ 142 MAC_VERIEXEC_VERSION, MAC_VERIEXEC_VERSION, \ 143 MAC_VERIEXEC_VERSION) 144 145 /* 146 * The following function should not be called directly. The prototype is 147 * included here to satisfy the compiler when using the macro above. 148 */ 149 int mac_veriexec_fingerprint_modevent(module_t mod, int type, void *data); 150 151 /* 152 * Public functions 153 */ 154 int mac_veriexec_metadata_add_file(int file_dev, dev_t fsid, long fileid, 155 unsigned long gen, unsigned char fingerprint[MAXFINGERPRINTLEN], 156 char *label, size_t labellen, int flags, const char *fp_type, 157 int override); 158 int mac_veriexec_metadata_has_file(dev_t fsid, long fileid, 159 unsigned long gen); 160 int mac_veriexec_proc_is_trusted(struct ucred *cred, struct proc *p); 161 #endif 162 163 #endif /* _SECURITY_MAC_VERIEXEC_H */ 164