source: trunk/include/sh_unix.h@ 320

Last change on this file since 320 was 294, checked in by katerina, 14 years ago

Tikets #213 and #214 (Use auditd to determine who changed a file, Windows registry check).
File size: 10.0 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21
22#ifndef SH_UNIX_H
23#define SH_UNIX_H
24
25/* For PATH_MAX */
26#include <limits.h>
27#if !defined(PATH_MAX)
28#define PATH_MAX 1024
29#endif
30
31#include <unistd.h>
32#include "samhain.h"
33#include "sh_error.h"
34
35
36typedef enum {
37 SH_ISLOG,
38 SH_ISFILE,
39 SH_ISDIR,
40 SH_ISDATA
41} ShOpenType;
42
43typedef enum {
44 SH_DATA_RAW,
45 SH_DATA_LINE
46} ShDataType;
47
48typedef enum {
49 SH_FILE_REGULAR,
50 SH_FILE_SYMLINK,
51 SH_FILE_DIRECTORY,
52 SH_FILE_CDEV,
53 SH_FILE_BDEV,
54 SH_FILE_FIFO,
55 SH_FILE_SOCKET,
56 SH_FILE_DOOR,
57 SH_FILE_PORT,
58 SH_FILE_UNKNOWN
59} ShFileType;
60
61/* -- Attributes to check. --
62 */
63
64/* checksum */
65#define MODI_CHK (1 << 0)
66/* link */
67#define MODI_LNK (1 << 1)
68/* inode */
69#define MODI_INO (1 << 2)
70/* user */
71#define MODI_USR (1 << 3)
72/* group */
73#define MODI_GRP (1 << 4)
74/* mtime */
75#define MODI_MTM (1 << 5)
76/* ctime */
77#define MODI_CTM (1 << 6)
78/* atime */
79#define MODI_ATM (1 << 7)
80/* size */
81#define MODI_SIZ (1 << 8)
82/* file mode */
83#define MODI_MOD (1 << 9)
84/* hardlinks */
85#define MODI_HLN (1 << 10)
86/* device type */
87#define MODI_RDEV (1 << 11)
88/* size may grow */
89#define MODI_SGROW (1 << 12)
90/* use prelink */
91#define MODI_PREL (1 << 13)
92
93/* get content */
94#define MODI_TXT ((1 << 14)|MODI_CHK)
95#define MODI_TXT_ENABLED(a) (((a)&(1 << 14))!=0)
96
97/* get audit record */
98#define MODI_AUDIT (1 << 15)
99#define MODI_AUDIT_ENABLED(a) (((a)&(1 << 15))!=0)
100
101
102#define SH_TXT_MAX 9200
103
104#define MASK_ALLIGNORE_ 0
105extern unsigned long mask_ALLIGNORE;
106#define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
107extern unsigned long mask_ATTRIBUTES;
108#define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
109extern unsigned long mask_LOGFILES;
110#define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
111extern unsigned long mask_LOGGROW;
112#define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
113extern unsigned long mask_READONLY;
114#define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
115extern unsigned long mask_NOIGNORE;
116#define MASK_USER_ (MASK_READONLY_|MODI_ATM)
117extern unsigned long mask_USER0;
118extern unsigned long mask_USER1;
119extern unsigned long mask_USER2;
120extern unsigned long mask_USER3;
121extern unsigned long mask_USER4;
122/* like READONLY, but without MTM,CTM,SIZ,INO, abd with PREL)
123 */
124#define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
125extern unsigned long mask_PRELINK;
126
127typedef struct file_struct {
128 unsigned long check_mask;
129 int file_reported;
130 char fullpath[PATH_MAX];
131 ShFileType type;
132 dev_t dev;
133 ino_t ino;
134 mode_t mode;
135 nlink_t hardlinks;
136#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
137 unsigned long attributes;
138 char c_attributes[ATTRBUF_SIZE];
139#endif
140 char c_mode[CMODE_SIZE];
141 uid_t owner;
142 char c_owner[USER_MAX+2];
143 gid_t group;
144 char c_group[GROUP_MAX+2];
145 dev_t rdev;
146 off_t size;
147 unsigned long blksize;
148 unsigned long blocks;
149 time_t atime;
150 time_t mtime;
151 time_t ctime;
152
153 char * link_path;
154 mode_t linkmode;
155 char link_c_mode[11];
156 int linkisok;
157 char * attr_string;
158} file_type;
159
160extern int sh_unix_check_selinux;
161extern int sh_unix_check_acl;
162
163/* destroy userid cache
164 */
165void sh_userid_destroy ();
166
167/* --- run a command, securely ---
168 */
169int sh_unix_run_command (const char * str);
170
171/* mlock utilities
172 */
173int sh_unix_mlock(const char * file, int line, void * addr, size_t len);
174int sh_unix_munlock(void * addr, size_t len);
175int sh_unix_count_mlock(void);
176/* public for unit tests */
177int sh_unix_pagesize(void);
178unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
179
180/* chroot directory
181 */
182int sh_unix_set_chroot(const char * str);
183
184/* whether to use localtime for file timesatams in logs
185 */
186int sh_unix_uselocaltime (const char * c);
187
188/* whether to perform selinux/acl checks
189 */
190#ifdef USE_XATTR
191int sh_unix_setcheckselinux (const char * c);
192#endif
193#ifdef USE_ACL
194int sh_unix_setcheckacl (const char * c);
195#endif
196
197/* set I/O limit
198 */
199int sh_unix_set_io_limit (const char * c);
200void sh_unix_io_pause (void);
201
202/* get file type
203 */
204int sh_unix_get_ftype(char * fullpath);
205
206/* reset masks for policies
207 */
208int sh_unix_maskreset(void);
209
210/* return true if database is remote
211 */
212int file_is_remote (void);
213
214/* return the path to the configuration/database file
215 */
216char * file_path(char what, char flag);
217
218/* return current time as unsigned long
219 */
220unsigned long sh_unix_longtime (void);
221
222/* close all files >= fd, except possibly one
223 */
224void sh_unix_closeall (int fd, int except, int inchild);
225
226/* Check whether directory for pid file exists
227 */
228int sh_unix_check_piddir (char * pidpath);
229
230/* write lock for filename
231 */
232int sh_unix_write_lock_file(char * filename);
233
234/* rm lock(s) for log file(s)
235 */
236int sh_unix_rm_lock_file(char * filename);
237
238/* write the PID file
239 */
240int sh_unix_write_pid_file(void);
241
242/* rm the PID file
243 */
244int sh_unix_rm_pid_file(void);
245
246
247/* checksum of own binary
248 */
249int sh_unix_self_hash (const char * c);
250
251/* return BAD on failure
252 */
253int sh_unix_self_check (void);
254
255/* add a trusted user to the list
256 */
257int tf_add_trusted_user(const char *);
258
259/* check a file
260 */
261int tf_trust_check (const char * file, int mode);
262
263/* initialize group vector
264 */
265#ifdef HOST_IS_OSF
266int sh_unix_initgroups ( char * in_user, gid_t in_gid);
267#else
268int sh_unix_initgroups (const char * in_user, gid_t in_gid);
269#endif
270int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
271
272/* set the timeserver address
273 */
274int sh_unix_settimeserver (const char * address);
275void reset_count_dev_time(void);
276
277/* lock the key
278 */
279void sh_unix_memlock(void);
280
281/* deamon mode
282 */
283int sh_unix_setdeamon (const char * dummy);
284int sh_unix_setnodeamon(const char * dummy);
285
286/* Test whether file exists
287 */
288int sh_unix_file_exists(char * path);
289
290/* test whether file exists with proper attributes
291 */
292int sh_unix_device_readable(int fd);
293
294/* local host
295 */
296void sh_unix_localhost(void);
297
298/* check whether /proc exists and is a proc filesystem
299 */
300int sh_unix_test_proc(void);
301
302/* check whether a directory is secure
303 * (no symlink in path, not world-writeable)
304 */
305/* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
306
307/* obtain file info
308 */
309int sh_unix_getinfo (int level, char * filename, file_type * theFile,
310 char * fileHash, int flagrel);
311
312/* read file, return length read
313 */
314int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
315
316/* call with goDaemon == 1 to make daemon process
317 */
318int sh_unix_init(int goDaemon);
319
320/* for local time use thetime = 0, returns pointer to buffer
321 */
322char * sh_unix_time (time_t thetime, char * buffer, size_t len);
323
324/* convert to GMT time, returns pointer to buffer
325 */
326char * sh_unix_gmttime (time_t thetime, char * buffer, size_t len);
327
328/* effective user info
329 */
330int sh_unix_getUser (void);
331
332/* get home directory, , returns pointer to out
333 */
334char * sh_unix_getUIDdir (int level, uid_t uid, char * out, size_t len);
335
336
337#ifdef HAVE_GETTIMEOFDAY
338unsigned long sh_unix_notime (void);
339#endif
340
341/* check whether a directory
342 */
343int sh_unix_isdir (char * dirName, int level);
344
345#ifdef SH_STEALTH
346int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
347void sh_unix_xor_code (char * str, int len);
348#endif
349
350#if defined(SCREW_IT_UP)
351/* for raise()
352 */
353#include <signal.h>
354#include <errno.h>
355
356void sh_sigtrap_handler (int signum);
357extern volatile int sh_not_traced;
358
359#ifdef HAVE_GETTIMEOFDAY
360#if TIME_WITH_SYS_TIME
361#include <sys/time.h>
362#include <time.h>
363#else
364#if HAVE_SYS_TIME_H
365#include <sys/time.h>
366#else
367#include <time.h>
368#endif
369#endif
370extern struct timeval save_tv;
371#endif
372
373static inline
374int sh_sigtrap_prepare()
375{
376 struct sigaction act_trap;
377 int val_retry;
378 act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
379 act_trap.sa_flags = 0; /* init sa_flags */
380 sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
381 do {
382 val_retry = sigaction(SIGTRAP, &act_trap, NULL);
383 } while (val_retry < 0 && errno == EINTR);
384 return 0;
385}
386
387/*@unused@*/ static inline
388int sh_derr(void)
389{
390 sh_not_traced = 0;
391
392#ifdef HAVE_GETTIMEOFDAY
393 gettimeofday(&save_tv, NULL);
394#endif
395
396#if defined(__linux__) && defined(__GNUC__) && defined(__i386__)
397 __asm__ __volatile__ (".byte 0xf1");
398#else
399 raise(SIGTRAP);
400#endif
401
402 if (sh_not_traced == 0)
403 _exit(5);
404 sh_not_traced = 0;
405 return (0);
406}
407
408#else
409
410/*@unused@*/ static inline
411int sh_derr(void)
412{
413 return 0;
414}
415/* #if defined(SCREW_IT_UP) */
416#endif
417
418#endif
419
420
Note: See TracBrowser for help on using the repository browser.