source: trunk/include/sh_unix.h@ 108

Last change on this file since 108 was 103, checked in by rainer, 18 years ago

Fix for ticket #59 (process check malfunction).
File size: 9.2 KB
RevLine 
[1]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21
22#ifndef SH_UNIX_H
23#define SH_UNIX_H
24
25#include <limits.h>
26#include <unistd.h>
27#include "samhain.h"
28#include "sh_error.h"
29
30
31typedef enum {
32 SH_ISLOG,
33 SH_ISFILE,
34 SH_ISDIR,
35 SH_ISDATA
36} ShOpenType;
37
38typedef enum {
39 SH_DATA_RAW,
40 SH_DATA_LINE
41} ShDataType;
42
43typedef enum {
44 SH_FILE_REGULAR,
45 SH_FILE_SYMLINK,
46 SH_FILE_DIRECTORY,
47 SH_FILE_CDEV,
48 SH_FILE_BDEV,
49 SH_FILE_FIFO,
50 SH_FILE_SOCKET,
[40]51 SH_FILE_DOOR,
52 SH_FILE_PORT,
[1]53 SH_FILE_UNKNOWN
54} ShFileType;
55
56/* -- Attributes to check. --
57 */
58
59/* checksum */
60#define MODI_CHK (1 << 0)
61/* link */
62#define MODI_LNK (1 << 1)
63/* inode */
64#define MODI_INO (1 << 2)
65/* user */
66#define MODI_USR (1 << 3)
67/* group */
68#define MODI_GRP (1 << 4)
69/* mtime */
70#define MODI_MTM (1 << 5)
71/* ctime */
72#define MODI_CTM (1 << 6)
73/* atime */
74#define MODI_ATM (1 << 7)
75/* size */
76#define MODI_SIZ (1 << 8)
77/* file mode */
78#define MODI_MOD (1 << 9)
79/* hardlinks */
80#define MODI_HLN (1 << 10)
[40]81/* device type */
[1]82#define MODI_RDEV (1 << 11)
[19]83/* size may grow */
84#define MODI_SGROW (1 << 12)
85/* use prelink */
86#define MODI_PREL (1 << 13)
[1]87
88#define MASK_ALLIGNORE_ 0
89extern unsigned long mask_ALLIGNORE;
90#define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
91extern unsigned long mask_ATTRIBUTES;
92#define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
93extern unsigned long mask_LOGFILES;
[19]94#define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
[1]95extern unsigned long mask_LOGGROW;
96#define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
97extern unsigned long mask_READONLY;
98#define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
99extern unsigned long mask_NOIGNORE;
100#define MASK_USER_ (MASK_READONLY_|MODI_ATM)
101extern unsigned long mask_USER0;
102extern unsigned long mask_USER1;
[27]103extern unsigned long mask_USER2;
104extern unsigned long mask_USER3;
105extern unsigned long mask_USER4;
[19]106/* like READONLY, but without MTM,CTM,SIZ,INO, abd with PREL)
[1]107 */
[19]108#define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
[1]109extern unsigned long mask_PRELINK;
110
111typedef struct file_struct {
112 unsigned long check_mask;
113 int reported;
114 char fullpath[PATH_MAX];
115 ShFileType type;
116 dev_t dev;
117 ino_t ino;
118 mode_t mode;
119 nlink_t hardlinks;
[10]120#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
[1]121 unsigned long attributes;
122 char c_attributes[16];
123#endif
124 char c_mode[11];
125 uid_t owner;
126 char c_owner[USER_MAX+2];
127 gid_t group;
128 char c_group[GROUP_MAX+2];
129 dev_t rdev;
130 off_t size;
131 unsigned long blksize;
132 unsigned long blocks;
133 time_t atime;
134 time_t mtime;
135 time_t ctime;
136
137 char linkpath[PATH_MAX];
138 mode_t linkmode;
139 char link_c_mode[11];
140 int linkisok;
[68]141 char * attr_string;
[1]142} file_type;
143
[68]144extern int sh_unix_check_selinux;
145extern int sh_unix_check_acl;
146
[1]147/* mlock utilities
148 */
[19]149int sh_unix_mlock(char * file, int line, void * addr, size_t len);
[1]150int sh_unix_munlock(void * addr, size_t len);
151int sh_unix_count_mlock();
[25]152/* public for unit tests */
153int sh_unix_pagesize();
154unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
[1]155
156/* chroot directory
157 */
[20]158int sh_unix_set_chroot(const char * str);
[1]159
160/* whether to use localtime for file timesatams in logs
161 */
[22]162int sh_unix_uselocaltime (const char * c);
[1]163
[68]164/* whether to perform selinux/acl checks
165 */
166#ifdef USE_XATTR
167int sh_unix_setcheckselinux (const char * c);
168#endif
169#ifdef USE_ACL
170int sh_unix_setcheckacl (const char * c);
171#endif
172
[1]173/* set I/O limit
174 */
[22]175int sh_unix_set_io_limit (const char * c);
[1]176void sh_unix_io_pause ();
177
178/* get file type
179 */
180int sh_unix_get_ftype(char * fullpath);
181
182/* reset masks for policies
183 */
184int sh_unix_maskreset();
185
186/* return true if database is remote
187 */
188int file_is_remote ();
189
190/* return the path to the configuration/database file
191 */
192char * file_path(char what, char flag);
193
194/* return current time as unsigned long
195 */
196unsigned long sh_unix_longtime (void);
197
198/* close all files >= fd, except possibly one
199 */
200void sh_unix_closeall (int fd, int except);
201
202
203/* write lock for filename
204 */
205int sh_unix_write_lock_file(char * filename);
206
207/* rm lock(s) for log file(s)
208 */
209int sh_unix_rm_lock_file(char * filename);
210
211/* write the PID file
212 */
213int sh_unix_write_pid_file();
214
215/* rm the PID file
216 */
217int sh_unix_rm_pid_file();
218
219
220/* checksum of own binary
221 */
[22]222int sh_unix_self_hash (const char * c);
[1]223
224/* return BAD on failure
225 */
226int sh_unix_self_check (void);
227
228/* add a trusted user to the list
229 */
[22]230int tf_add_trusted_user(const char *);
[1]231
232/* check a file
233 */
234int tf_trust_check (char * file, int mode);
235
236/* initialize group vector
237 */
238#ifdef HOST_IS_OSF
239int sh_unix_initgroups ( char * in_user, gid_t in_gid);
240#else
241int sh_unix_initgroups (const char * in_user, gid_t in_gid);
242#endif
243int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
244
245/* set the timeserver address
246 */
[22]247int sh_unix_settimeserver (const char * address);
[1]248void reset_count_dev_time(void);
249
250/* lock the key
251 */
252void sh_unix_memlock(void);
253
254/* deamon mode
255 */
[20]256int sh_unix_setdeamon (const char * dummy);
257int sh_unix_setnodeamon(const char * dummy);
[1]258
259/* Test whether file exists
260 */
[78]261int sh_unix_file_exists(char * path);
[1]262
263/* test whether file exists with proper attributes
264 */
[78]265int sh_unix_device_readable(int fd);
[1]266
267/* local host
268 */
269void sh_unix_localhost(void);
270
271/* check whether /proc exists and is a proc filesystem
272 */
273int sh_unix_test_proc(void);
274
275/* check whether a directory is secure
276 * (no symlink in path, not world-writeable)
277 */
278/* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
279
280/* obtain file info
281 */
282int sh_unix_getinfo (int level, char * filename, file_type * theFile,
283 char * fileHash, int flagrel);
284
285/* read file, return length read
286 */
287int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
288
289/* call with goDaemon == 1 to make daemon process
290 */
291int sh_unix_init(int goDaemon);
292
293/* for local time use thetime = 0
294 */
295/*@owned@*/ char * sh_unix_time (time_t thetime);
296
297/* convert to GMT time
298 */
299char * sh_unix_gmttime (time_t thetime);
300
301/* effective user info
302 */
303int sh_unix_getUser (void);
304
305/* get home directory
306 */
307char * sh_unix_getUIDdir (int level, uid_t uid);
308
309
310#ifdef HAVE_GETTIMEOFDAY
311unsigned long sh_unix_notime (void);
312#endif
313
314/* check whether a directory
315 */
316int sh_unix_isdir (char * dirName, int level);
317
318#ifdef SH_STEALTH
319int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
320void sh_unix_xor_code (char * str, int len);
321#endif
322
323#if defined(SCREW_IT_UP)
324/* for raise()
325 */
326#include <signal.h>
327#include <errno.h>
328
329void sh_sigtrap_handler (int signum);
330extern volatile int sh_not_traced;
331
332#ifdef HAVE_GETTIMEOFDAY
333#if TIME_WITH_SYS_TIME
334#include <sys/time.h>
335#include <time.h>
336#else
337#if HAVE_SYS_TIME_H
338#include <sys/time.h>
339#else
340#include <time.h>
341#endif
342#endif
343extern struct timeval save_tv;
344#endif
345
346static inline
347int sh_sigtrap_prepare()
348{
349 struct sigaction act_trap;
350 int val_retry;
351 act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
352 act_trap.sa_flags = 0; /* init sa_flags */
353 sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
354 do {
355 val_retry = sigaction(SIGTRAP, &act_trap, NULL);
356 } while (val_retry < 0 && errno == EINTR);
357 return 0;
358}
359
360/*@unused@*/ static inline
361int sh_derr(void)
362{
363 sh_not_traced = 0;
364
365#ifdef HAVE_GETTIMEOFDAY
366 gettimeofday(&save_tv, NULL);
367#endif
368
369#if defined(__linux__) && defined(__GNUC__) && defined(__i386__)
[103]370 __asm__ __volatile__ (".byte 0xf1");
[1]371#else
372 raise(SIGTRAP);
373#endif
374
375 if (sh_not_traced == 0)
376 _exit(5);
377 sh_not_traced = 0;
378 return (0);
379}
380
381#else
382
383/*@unused@*/ static inline
384int sh_derr(void)
385{
386 return 0;
387}
388/* #if defined(SCREW_IT_UP) */
389#endif
390
391#endif
392
393
Note: See TracBrowser for help on using the repository browser.