source: trunk/include/sh_unix.h@ 38

Last change on this file since 38 was 27, checked in by rainer, 19 years ago

Support for server-to-server relay and more user policies
File size: 8.9 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21
22#ifndef SH_UNIX_H
23#define SH_UNIX_H
24
25#include <limits.h>
26#include <unistd.h>
27#include "samhain.h"
28#include "sh_error.h"
29
30
31typedef enum {
32 SH_ISLOG,
33 SH_ISFILE,
34 SH_ISDIR,
35 SH_ISDATA
36} ShOpenType;
37
38typedef enum {
39 SH_DATA_RAW,
40 SH_DATA_LINE
41} ShDataType;
42
43typedef enum {
44 SH_FILE_REGULAR,
45 SH_FILE_SYMLINK,
46 SH_FILE_DIRECTORY,
47 SH_FILE_CDEV,
48 SH_FILE_BDEV,
49 SH_FILE_FIFO,
50 SH_FILE_SOCKET,
51 SH_FILE_UNKNOWN
52} ShFileType;
53
54/* -- Attributes to check. --
55 */
56
57/* checksum */
58#define MODI_CHK (1 << 0)
59/* link */
60#define MODI_LNK (1 << 1)
61/* inode */
62#define MODI_INO (1 << 2)
63/* user */
64#define MODI_USR (1 << 3)
65/* group */
66#define MODI_GRP (1 << 4)
67/* mtime */
68#define MODI_MTM (1 << 5)
69/* ctime */
70#define MODI_CTM (1 << 6)
71/* atime */
72#define MODI_ATM (1 << 7)
73/* size */
74#define MODI_SIZ (1 << 8)
75/* file mode */
76#define MODI_MOD (1 << 9)
77/* hardlinks */
78#define MODI_HLN (1 << 10)
79/* device num */
80#define MODI_RDEV (1 << 11)
81/* size may grow */
82#define MODI_SGROW (1 << 12)
83/* use prelink */
84#define MODI_PREL (1 << 13)
85
86#define MASK_ALLIGNORE_ 0
87extern unsigned long mask_ALLIGNORE;
88#define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
89extern unsigned long mask_ATTRIBUTES;
90#define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
91extern unsigned long mask_LOGFILES;
92#define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
93extern unsigned long mask_LOGGROW;
94#define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
95extern unsigned long mask_READONLY;
96#define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
97extern unsigned long mask_NOIGNORE;
98#define MASK_USER_ (MASK_READONLY_|MODI_ATM)
99extern unsigned long mask_USER0;
100extern unsigned long mask_USER1;
101extern unsigned long mask_USER2;
102extern unsigned long mask_USER3;
103extern unsigned long mask_USER4;
104/* like READONLY, but without MTM,CTM,SIZ,INO, abd with PREL)
105 */
106#define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
107extern unsigned long mask_PRELINK;
108
109typedef struct file_struct {
110 unsigned long check_mask;
111 int reported;
112 char fullpath[PATH_MAX];
113 ShFileType type;
114 dev_t dev;
115 ino_t ino;
116 mode_t mode;
117 nlink_t hardlinks;
118#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
119 unsigned long attributes;
120 char c_attributes[16];
121#endif
122 char c_mode[11];
123 uid_t owner;
124 char c_owner[USER_MAX+2];
125 gid_t group;
126 char c_group[GROUP_MAX+2];
127 dev_t rdev;
128 off_t size;
129 unsigned long blksize;
130 unsigned long blocks;
131 time_t atime;
132 time_t mtime;
133 time_t ctime;
134
135 char linkpath[PATH_MAX];
136 mode_t linkmode;
137 char link_c_mode[11];
138 int linkisok;
139} file_type;
140
141/* mlock utilities
142 */
143int sh_unix_mlock(char * file, int line, void * addr, size_t len);
144int sh_unix_munlock(void * addr, size_t len);
145int sh_unix_count_mlock();
146/* public for unit tests */
147int sh_unix_pagesize();
148unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
149
150/* chroot directory
151 */
152int sh_unix_set_chroot(const char * str);
153
154/* whether to use localtime for file timesatams in logs
155 */
156int sh_unix_uselocaltime (const char * c);
157
158/* set I/O limit
159 */
160int sh_unix_set_io_limit (const char * c);
161void sh_unix_io_pause ();
162
163/* get file type
164 */
165int sh_unix_get_ftype(char * fullpath);
166
167/* reset masks for policies
168 */
169int sh_unix_maskreset();
170
171/* return true if database is remote
172 */
173int file_is_remote ();
174
175/* return the path to the configuration/database file
176 */
177char * file_path(char what, char flag);
178
179/* return current time as unsigned long
180 */
181unsigned long sh_unix_longtime (void);
182
183/* close all files >= fd, except possibly one
184 */
185void sh_unix_closeall (int fd, int except);
186
187
188/* write lock for filename
189 */
190int sh_unix_write_lock_file(char * filename);
191
192/* rm lock(s) for log file(s)
193 */
194int sh_unix_rm_lock_file(char * filename);
195
196/* write the PID file
197 */
198int sh_unix_write_pid_file();
199
200/* rm the PID file
201 */
202int sh_unix_rm_pid_file();
203
204
205/* checksum of own binary
206 */
207int sh_unix_self_hash (const char * c);
208
209/* return BAD on failure
210 */
211int sh_unix_self_check (void);
212
213/* add a trusted user to the list
214 */
215int tf_add_trusted_user(const char *);
216
217/* check a file
218 */
219int tf_trust_check (char * file, int mode);
220
221/* initialize group vector
222 */
223#ifdef HOST_IS_OSF
224int sh_unix_initgroups ( char * in_user, gid_t in_gid);
225#else
226int sh_unix_initgroups (const char * in_user, gid_t in_gid);
227#endif
228int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
229
230/* set the timeserver address
231 */
232int sh_unix_settimeserver (const char * address);
233void reset_count_dev_time(void);
234
235/* lock the key
236 */
237void sh_unix_memlock(void);
238
239/* deamon mode
240 */
241int sh_unix_setdeamon (const char * dummy);
242int sh_unix_setnodeamon(const char * dummy);
243
244/* Test whether file exists
245 */
246int sh_unix_file_stat(char * path);
247
248/* test whether file exists with proper attributes
249 */
250int sh_unix_file_exists(int fd);
251
252/* local host
253 */
254void sh_unix_localhost(void);
255
256/* check whether /proc exists and is a proc filesystem
257 */
258int sh_unix_test_proc(void);
259
260/* check whether a directory is secure
261 * (no symlink in path, not world-writeable)
262 */
263/* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
264
265/* obtain file info
266 */
267int sh_unix_getinfo (int level, char * filename, file_type * theFile,
268 char * fileHash, int flagrel);
269
270/* read file, return length read
271 */
272int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
273
274/* call with goDaemon == 1 to make daemon process
275 */
276int sh_unix_init(int goDaemon);
277
278/* for local time use thetime = 0
279 */
280/*@owned@*/ char * sh_unix_time (time_t thetime);
281
282/* convert to GMT time
283 */
284char * sh_unix_gmttime (time_t thetime);
285
286/* effective user info
287 */
288int sh_unix_getUser (void);
289
290/* get home directory
291 */
292char * sh_unix_getUIDdir (int level, uid_t uid);
293
294
295#ifdef HAVE_GETTIMEOFDAY
296unsigned long sh_unix_notime (void);
297#endif
298
299/* check whether a directory
300 */
301int sh_unix_isdir (char * dirName, int level);
302
303#ifdef SH_STEALTH
304int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
305void sh_unix_xor_code (char * str, int len);
306#endif
307
308#if defined(SCREW_IT_UP)
309/* for raise()
310 */
311#include <signal.h>
312#include <errno.h>
313
314void sh_sigtrap_handler (int signum);
315extern volatile int sh_not_traced;
316
317#ifdef HAVE_GETTIMEOFDAY
318#if TIME_WITH_SYS_TIME
319#include <sys/time.h>
320#include <time.h>
321#else
322#if HAVE_SYS_TIME_H
323#include <sys/time.h>
324#else
325#include <time.h>
326#endif
327#endif
328extern struct timeval save_tv;
329#endif
330
331static inline
332int sh_sigtrap_prepare()
333{
334 struct sigaction act_trap;
335 int val_retry;
336 act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
337 act_trap.sa_flags = 0; /* init sa_flags */
338 sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
339 do {
340 val_retry = sigaction(SIGTRAP, &act_trap, NULL);
341 } while (val_retry < 0 && errno == EINTR);
342 return 0;
343}
344
345/*@unused@*/ static inline
346int sh_derr(void)
347{
348 sh_not_traced = 0;
349
350#ifdef HAVE_GETTIMEOFDAY
351 gettimeofday(&save_tv, NULL);
352#endif
353
354#if defined(__linux__) && defined(__GNUC__) && defined(__i386__)
355 __asm__ __volatile__ ("int $0x03");
356#else
357 raise(SIGTRAP);
358#endif
359
360 if (sh_not_traced == 0)
361 _exit(5);
362 sh_not_traced = 0;
363 return (0);
364}
365
366#else
367
368/*@unused@*/ static inline
369int sh_derr(void)
370{
371 return 0;
372}
373/* #if defined(SCREW_IT_UP) */
374#endif
375
376#endif
377
378
Note: See TracBrowser for help on using the repository browser.