source: trunk/include/sh_unix.h@ 167

Last change on this file since 167 was 167, checked in by katerina, 17 years ago

First parts of changes for MODI_TXT
File size: 9.5 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21
22#ifndef SH_UNIX_H
23#define SH_UNIX_H
24
25/* For PATH_MAX */
26#include <limits.h>
27#if !defined(PATH_MAX)
28#define PATH_MAX 1024
29#endif
30
31#include <unistd.h>
32#include "samhain.h"
33#include "sh_error.h"
34
35
36typedef enum {
37 SH_ISLOG,
38 SH_ISFILE,
39 SH_ISDIR,
40 SH_ISDATA
41} ShOpenType;
42
43typedef enum {
44 SH_DATA_RAW,
45 SH_DATA_LINE
46} ShDataType;
47
48typedef enum {
49 SH_FILE_REGULAR,
50 SH_FILE_SYMLINK,
51 SH_FILE_DIRECTORY,
52 SH_FILE_CDEV,
53 SH_FILE_BDEV,
54 SH_FILE_FIFO,
55 SH_FILE_SOCKET,
56 SH_FILE_DOOR,
57 SH_FILE_PORT,
58 SH_FILE_UNKNOWN
59} ShFileType;
60
61/* -- Attributes to check. --
62 */
63
64/* checksum */
65#define MODI_CHK (1 << 0)
66/* link */
67#define MODI_LNK (1 << 1)
68/* inode */
69#define MODI_INO (1 << 2)
70/* user */
71#define MODI_USR (1 << 3)
72/* group */
73#define MODI_GRP (1 << 4)
74/* mtime */
75#define MODI_MTM (1 << 5)
76/* ctime */
77#define MODI_CTM (1 << 6)
78/* atime */
79#define MODI_ATM (1 << 7)
80/* size */
81#define MODI_SIZ (1 << 8)
82/* file mode */
83#define MODI_MOD (1 << 9)
84/* hardlinks */
85#define MODI_HLN (1 << 10)
86/* device type */
87#define MODI_RDEV (1 << 11)
88/* size may grow */
89#define MODI_SGROW (1 << 12)
90/* use prelink */
91#define MODI_PREL (1 << 13)
92/* get content */
93#define MODI_TXT (1 << 14)
94
95#define SH_TXT_MAX 9200
96
97#define MASK_ALLIGNORE_ 0
98extern unsigned long mask_ALLIGNORE;
99#define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
100extern unsigned long mask_ATTRIBUTES;
101#define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
102extern unsigned long mask_LOGFILES;
103#define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
104extern unsigned long mask_LOGGROW;
105#define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
106extern unsigned long mask_READONLY;
107#define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
108extern unsigned long mask_NOIGNORE;
109#define MASK_USER_ (MASK_READONLY_|MODI_ATM)
110extern unsigned long mask_USER0;
111extern unsigned long mask_USER1;
112extern unsigned long mask_USER2;
113extern unsigned long mask_USER3;
114extern unsigned long mask_USER4;
115/* like READONLY, but without MTM,CTM,SIZ,INO, abd with PREL)
116 */
117#define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
118extern unsigned long mask_PRELINK;
119
120typedef struct file_struct {
121 unsigned long check_mask;
122 int file_reported;
123 char fullpath[PATH_MAX];
124 ShFileType type;
125 dev_t dev;
126 ino_t ino;
127 mode_t mode;
128 nlink_t hardlinks;
129#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
130 unsigned long attributes;
131 char c_attributes[ATTRBUF_SIZE];
132#endif
133 char c_mode[CMODE_SIZE];
134 uid_t owner;
135 char c_owner[USER_MAX+2];
136 gid_t group;
137 char c_group[GROUP_MAX+2];
138 dev_t rdev;
139 off_t size;
140 unsigned long blksize;
141 unsigned long blocks;
142 time_t atime;
143 time_t mtime;
144 time_t ctime;
145
146 char * link_path;
147 mode_t linkmode;
148 char link_c_mode[11];
149 int linkisok;
150 char * attr_string;
151} file_type;
152
153extern int sh_unix_check_selinux;
154extern int sh_unix_check_acl;
155
156/* mlock utilities
157 */
158int sh_unix_mlock(char * file, int line, void * addr, size_t len);
159int sh_unix_munlock(void * addr, size_t len);
160int sh_unix_count_mlock();
161/* public for unit tests */
162int sh_unix_pagesize();
163unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
164
165/* chroot directory
166 */
167int sh_unix_set_chroot(const char * str);
168
169/* whether to use localtime for file timesatams in logs
170 */
171int sh_unix_uselocaltime (const char * c);
172
173/* whether to perform selinux/acl checks
174 */
175#ifdef USE_XATTR
176int sh_unix_setcheckselinux (const char * c);
177#endif
178#ifdef USE_ACL
179int sh_unix_setcheckacl (const char * c);
180#endif
181
182/* set I/O limit
183 */
184int sh_unix_set_io_limit (const char * c);
185void sh_unix_io_pause ();
186
187/* get file type
188 */
189int sh_unix_get_ftype(char * fullpath);
190
191/* reset masks for policies
192 */
193int sh_unix_maskreset();
194
195/* return true if database is remote
196 */
197int file_is_remote ();
198
199/* return the path to the configuration/database file
200 */
201char * file_path(char what, char flag);
202
203/* return current time as unsigned long
204 */
205unsigned long sh_unix_longtime (void);
206
207/* close all files >= fd, except possibly one
208 */
209void sh_unix_closeall (int fd, int except);
210
211
212/* write lock for filename
213 */
214int sh_unix_write_lock_file(char * filename);
215
216/* rm lock(s) for log file(s)
217 */
218int sh_unix_rm_lock_file(char * filename);
219
220/* write the PID file
221 */
222int sh_unix_write_pid_file();
223
224/* rm the PID file
225 */
226int sh_unix_rm_pid_file();
227
228
229/* checksum of own binary
230 */
231int sh_unix_self_hash (const char * c);
232
233/* return BAD on failure
234 */
235int sh_unix_self_check (void);
236
237/* add a trusted user to the list
238 */
239int tf_add_trusted_user(const char *);
240
241/* check a file
242 */
243int tf_trust_check (char * file, int mode);
244
245/* initialize group vector
246 */
247#ifdef HOST_IS_OSF
248int sh_unix_initgroups ( char * in_user, gid_t in_gid);
249#else
250int sh_unix_initgroups (const char * in_user, gid_t in_gid);
251#endif
252int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
253
254/* set the timeserver address
255 */
256int sh_unix_settimeserver (const char * address);
257void reset_count_dev_time(void);
258
259/* lock the key
260 */
261void sh_unix_memlock(void);
262
263/* deamon mode
264 */
265int sh_unix_setdeamon (const char * dummy);
266int sh_unix_setnodeamon(const char * dummy);
267
268/* Test whether file exists
269 */
270int sh_unix_file_exists(char * path);
271
272/* test whether file exists with proper attributes
273 */
274int sh_unix_device_readable(int fd);
275
276/* local host
277 */
278void sh_unix_localhost(void);
279
280/* check whether /proc exists and is a proc filesystem
281 */
282int sh_unix_test_proc(void);
283
284/* check whether a directory is secure
285 * (no symlink in path, not world-writeable)
286 */
287/* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
288
289/* obtain file info
290 */
291int sh_unix_getinfo (int level, char * filename, file_type * theFile,
292 char * fileHash, int flagrel);
293
294/* read file, return length read
295 */
296int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
297
298/* call with goDaemon == 1 to make daemon process
299 */
300int sh_unix_init(int goDaemon);
301
302/* for local time use thetime = 0, returns pointer to buffer
303 */
304char * sh_unix_time (time_t thetime, char * buffer, size_t len);
305
306/* convert to GMT time, returns pointer to buffer
307 */
308char * sh_unix_gmttime (time_t thetime, char * buffer, size_t len);
309
310/* effective user info
311 */
312int sh_unix_getUser (void);
313
314/* get home directory, , returns pointer to out
315 */
316char * sh_unix_getUIDdir (int level, uid_t uid, char * out, size_t len);
317
318
319#ifdef HAVE_GETTIMEOFDAY
320unsigned long sh_unix_notime (void);
321#endif
322
323/* check whether a directory
324 */
325int sh_unix_isdir (char * dirName, int level);
326
327#ifdef SH_STEALTH
328int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
329void sh_unix_xor_code (char * str, int len);
330#endif
331
332#if defined(SCREW_IT_UP)
333/* for raise()
334 */
335#include <signal.h>
336#include <errno.h>
337
338void sh_sigtrap_handler (int signum);
339extern volatile int sh_not_traced;
340
341#ifdef HAVE_GETTIMEOFDAY
342#if TIME_WITH_SYS_TIME
343#include <sys/time.h>
344#include <time.h>
345#else
346#if HAVE_SYS_TIME_H
347#include <sys/time.h>
348#else
349#include <time.h>
350#endif
351#endif
352extern struct timeval save_tv;
353#endif
354
355static inline
356int sh_sigtrap_prepare()
357{
358 struct sigaction act_trap;
359 int val_retry;
360 act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
361 act_trap.sa_flags = 0; /* init sa_flags */
362 sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
363 do {
364 val_retry = sigaction(SIGTRAP, &act_trap, NULL);
365 } while (val_retry < 0 && errno == EINTR);
366 return 0;
367}
368
369/*@unused@*/ static inline
370int sh_derr(void)
371{
372 sh_not_traced = 0;
373
374#ifdef HAVE_GETTIMEOFDAY
375 gettimeofday(&save_tv, NULL);
376#endif
377
378#if defined(__linux__) && defined(__GNUC__) && defined(__i386__)
379 __asm__ __volatile__ (".byte 0xf1");
380#else
381 raise(SIGTRAP);
382#endif
383
384 if (sh_not_traced == 0)
385 _exit(5);
386 sh_not_traced = 0;
387 return (0);
388}
389
390#else
391
392/*@unused@*/ static inline
393int sh_derr(void)
394{
395 return 0;
396}
397/* #if defined(SCREW_IT_UP) */
398#endif
399
400#endif
401
402
Note: See TracBrowser for help on using the repository browser.