| 1 | /* SAMHAIN file system integrity testing */
|
|---|
| 2 | /* Copyright (C) 1999 Rainer Wichmann */
|
|---|
| 3 | /* */
|
|---|
| 4 | /* This program is free software; you can redistribute it */
|
|---|
| 5 | /* and/or modify */
|
|---|
| 6 | /* it under the terms of the GNU General Public License as */
|
|---|
| 7 | /* published by */
|
|---|
| 8 | /* the Free Software Foundation; either version 2 of the License, or */
|
|---|
| 9 | /* (at your option) any later version. */
|
|---|
| 10 | /* */
|
|---|
| 11 | /* This program is distributed in the hope that it will be useful, */
|
|---|
| 12 | /* but WITHOUT ANY WARRANTY; without even the implied warranty of */
|
|---|
| 13 | /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
|
|---|
| 14 | /* GNU General Public License for more details. */
|
|---|
| 15 | /* */
|
|---|
| 16 | /* You should have received a copy of the GNU General Public License */
|
|---|
| 17 | /* along with this program; if not, write to the Free Software */
|
|---|
| 18 | /* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
|
|---|
| 19 |
|
|---|
| 20 |
|
|---|
| 21 |
|
|---|
| 22 | #ifndef SH_UNIX_H
|
|---|
| 23 | #define SH_UNIX_H
|
|---|
| 24 |
|
|---|
| 25 | /* For PATH_MAX */
|
|---|
| 26 | #include <limits.h>
|
|---|
| 27 | #if !defined(PATH_MAX)
|
|---|
| 28 | #define PATH_MAX 1024
|
|---|
| 29 | #endif
|
|---|
| 30 |
|
|---|
| 31 | #include <unistd.h>
|
|---|
| 32 | #include "samhain.h"
|
|---|
| 33 | #include "sh_error.h"
|
|---|
| 34 |
|
|---|
| 35 |
|
|---|
| 36 | typedef enum {
|
|---|
| 37 | SH_ISLOG,
|
|---|
| 38 | SH_ISFILE,
|
|---|
| 39 | SH_ISDIR,
|
|---|
| 40 | SH_ISDATA
|
|---|
| 41 | } ShOpenType;
|
|---|
| 42 |
|
|---|
| 43 | typedef enum {
|
|---|
| 44 | SH_DATA_RAW,
|
|---|
| 45 | SH_DATA_LINE
|
|---|
| 46 | } ShDataType;
|
|---|
| 47 |
|
|---|
| 48 | typedef enum {
|
|---|
| 49 | SH_FILE_REGULAR,
|
|---|
| 50 | SH_FILE_SYMLINK,
|
|---|
| 51 | SH_FILE_DIRECTORY,
|
|---|
| 52 | SH_FILE_CDEV,
|
|---|
| 53 | SH_FILE_BDEV,
|
|---|
| 54 | SH_FILE_FIFO,
|
|---|
| 55 | SH_FILE_SOCKET,
|
|---|
| 56 | SH_FILE_DOOR,
|
|---|
| 57 | SH_FILE_PORT,
|
|---|
| 58 | SH_FILE_UNKNOWN
|
|---|
| 59 | } ShFileType;
|
|---|
| 60 |
|
|---|
| 61 | /* -- Attributes to check. --
|
|---|
| 62 | */
|
|---|
| 63 |
|
|---|
| 64 | /* checksum */
|
|---|
| 65 | #define MODI_CHK (1 << 0)
|
|---|
| 66 | /* link */
|
|---|
| 67 | #define MODI_LNK (1 << 1)
|
|---|
| 68 | /* inode */
|
|---|
| 69 | #define MODI_INO (1 << 2)
|
|---|
| 70 | /* user */
|
|---|
| 71 | #define MODI_USR (1 << 3)
|
|---|
| 72 | /* group */
|
|---|
| 73 | #define MODI_GRP (1 << 4)
|
|---|
| 74 | /* mtime */
|
|---|
| 75 | #define MODI_MTM (1 << 5)
|
|---|
| 76 | /* ctime */
|
|---|
| 77 | #define MODI_CTM (1 << 6)
|
|---|
| 78 | /* atime */
|
|---|
| 79 | #define MODI_ATM (1 << 7)
|
|---|
| 80 | /* size */
|
|---|
| 81 | #define MODI_SIZ (1 << 8)
|
|---|
| 82 | /* file mode */
|
|---|
| 83 | #define MODI_MOD (1 << 9)
|
|---|
| 84 | /* hardlinks */
|
|---|
| 85 | #define MODI_HLN (1 << 10)
|
|---|
| 86 | /* device type */
|
|---|
| 87 | #define MODI_RDEV (1 << 11)
|
|---|
| 88 | /* size may grow */
|
|---|
| 89 | #define MODI_SGROW (1 << 12)
|
|---|
| 90 | /* use prelink */
|
|---|
| 91 | #define MODI_PREL (1 << 13)
|
|---|
| 92 |
|
|---|
| 93 | /* get content */
|
|---|
| 94 | #define MODI_TXT ((1 << 14)|MODI_CHK)
|
|---|
| 95 | #define MODI_TXT_ENABLED(a) (((a)&(1 << 14))!=0)
|
|---|
| 96 |
|
|---|
| 97 | /* get audit record */
|
|---|
| 98 | #define MODI_AUDIT (1 << 15)
|
|---|
| 99 | #define MODI_AUDIT_ENABLED(a) (((a)&(1 << 15))!=0)
|
|---|
| 100 |
|
|---|
| 101 | #define MODI_INIT 0xDA000000UL
|
|---|
| 102 | #define MODI_INITIALIZED(a) (((a) & 0xFF000000UL) == MODI_INIT)
|
|---|
| 103 |
|
|---|
| 104 | #define SH_TXT_MAX 9200
|
|---|
| 105 |
|
|---|
| 106 | #define MASK_ALLIGNORE_ 0
|
|---|
| 107 | extern unsigned long mask_ALLIGNORE;
|
|---|
| 108 | #define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
|
|---|
| 109 | extern unsigned long mask_ATTRIBUTES;
|
|---|
| 110 | #define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
|
|---|
| 111 | extern unsigned long mask_LOGFILES;
|
|---|
| 112 | #define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
|
|---|
| 113 | extern unsigned long mask_LOGGROW;
|
|---|
| 114 | #define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
|
|---|
| 115 | extern unsigned long mask_READONLY;
|
|---|
| 116 | #define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
|
|---|
| 117 | extern unsigned long mask_NOIGNORE;
|
|---|
| 118 | #define MASK_USER_ (MASK_READONLY_|MODI_ATM)
|
|---|
| 119 | extern unsigned long mask_USER0;
|
|---|
| 120 | extern unsigned long mask_USER1;
|
|---|
| 121 | extern unsigned long mask_USER2;
|
|---|
| 122 | extern unsigned long mask_USER3;
|
|---|
| 123 | extern unsigned long mask_USER4;
|
|---|
| 124 | /* like READONLY, but without MTM,CTM,SIZ,INO, and with PREL)
|
|---|
| 125 | */
|
|---|
| 126 | #define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
|
|---|
| 127 | extern unsigned long mask_PRELINK;
|
|---|
| 128 |
|
|---|
| 129 | typedef struct file_struct {
|
|---|
| 130 | unsigned long check_mask;
|
|---|
| 131 | int file_reported;
|
|---|
| 132 | char fullpath[PATH_MAX];
|
|---|
| 133 | ShFileType type;
|
|---|
| 134 | dev_t dev;
|
|---|
| 135 | ino_t ino;
|
|---|
| 136 | mode_t mode;
|
|---|
| 137 | nlink_t hardlinks;
|
|---|
| 138 | #if defined(__linux__) || defined(HAVE_STAT_FLAGS)
|
|---|
| 139 | unsigned long attributes;
|
|---|
| 140 | char c_attributes[ATTRBUF_SIZE];
|
|---|
| 141 | #endif
|
|---|
| 142 | char c_mode[CMODE_SIZE];
|
|---|
| 143 | uid_t owner;
|
|---|
| 144 | char c_owner[USER_MAX+2];
|
|---|
| 145 | gid_t group;
|
|---|
| 146 | char c_group[GROUP_MAX+2];
|
|---|
| 147 | dev_t rdev;
|
|---|
| 148 | off_t size;
|
|---|
| 149 | unsigned long blksize;
|
|---|
| 150 | unsigned long blocks;
|
|---|
| 151 | time_t atime;
|
|---|
| 152 | time_t mtime;
|
|---|
| 153 | time_t ctime;
|
|---|
| 154 |
|
|---|
| 155 | char * link_path;
|
|---|
| 156 | mode_t linkmode;
|
|---|
| 157 | char link_c_mode[11];
|
|---|
| 158 | int linkisok;
|
|---|
| 159 | char * attr_string;
|
|---|
| 160 | } file_type;
|
|---|
| 161 |
|
|---|
| 162 | extern int sh_unix_check_selinux;
|
|---|
| 163 | extern int sh_unix_check_acl;
|
|---|
| 164 |
|
|---|
| 165 | /* destroy userid cache
|
|---|
| 166 | */
|
|---|
| 167 | void sh_userid_destroy ();
|
|---|
| 168 |
|
|---|
| 169 | /* --- run a command, securely ---
|
|---|
| 170 | */
|
|---|
| 171 | int sh_unix_run_command (const char * str);
|
|---|
| 172 |
|
|---|
| 173 | /* Ignore SIGPIPE
|
|---|
| 174 | */
|
|---|
| 175 | void sh_unix_ign_sigpipe();
|
|---|
| 176 |
|
|---|
| 177 | /* mlock utilities
|
|---|
| 178 | */
|
|---|
| 179 | int sh_unix_mlock(const char * file, int line, void * addr, size_t len);
|
|---|
| 180 | int sh_unix_munlock(void * addr, size_t len);
|
|---|
| 181 | int sh_unix_count_mlock(void);
|
|---|
| 182 | /* public for unit tests */
|
|---|
| 183 | int sh_unix_pagesize(void);
|
|---|
| 184 | unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
|
|---|
| 185 |
|
|---|
| 186 | /* chroot directory
|
|---|
| 187 | */
|
|---|
| 188 | int sh_unix_set_chroot(const char * str);
|
|---|
| 189 |
|
|---|
| 190 | /* whether to use localtime for file timesatams in logs
|
|---|
| 191 | */
|
|---|
| 192 | int sh_unix_uselocaltime (const char * c);
|
|---|
| 193 |
|
|---|
| 194 | /* whether to perform selinux/acl checks
|
|---|
| 195 | */
|
|---|
| 196 | #ifdef USE_XATTR
|
|---|
| 197 | int sh_unix_setcheckselinux (const char * c);
|
|---|
| 198 | #endif
|
|---|
| 199 | #ifdef USE_ACL
|
|---|
| 200 | int sh_unix_setcheckacl (const char * c);
|
|---|
| 201 | #endif
|
|---|
| 202 |
|
|---|
| 203 | /* set I/O limit
|
|---|
| 204 | */
|
|---|
| 205 | int sh_unix_set_io_limit (const char * c);
|
|---|
| 206 | void sh_unix_io_pause (void);
|
|---|
| 207 |
|
|---|
| 208 | /* get file type
|
|---|
| 209 | */
|
|---|
| 210 | int sh_unix_get_ftype(char * fullpath);
|
|---|
| 211 |
|
|---|
| 212 | /* reset masks for policies
|
|---|
| 213 | */
|
|---|
| 214 | int sh_unix_maskreset(void);
|
|---|
| 215 |
|
|---|
| 216 | /* return true if database is remote
|
|---|
| 217 | */
|
|---|
| 218 | int file_is_remote (void);
|
|---|
| 219 |
|
|---|
| 220 | /* return the path to the configuration/database file
|
|---|
| 221 | */
|
|---|
| 222 | char * file_path(char what, char flag);
|
|---|
| 223 |
|
|---|
| 224 | /* return current time as unsigned long
|
|---|
| 225 | */
|
|---|
| 226 | unsigned long sh_unix_longtime (void);
|
|---|
| 227 |
|
|---|
| 228 | /* close all files >= fd, except possibly one
|
|---|
| 229 | */
|
|---|
| 230 | void sh_unix_closeall (int fd, int except, int inchild);
|
|---|
| 231 |
|
|---|
| 232 | /* Check whether directory for pid file exists
|
|---|
| 233 | */
|
|---|
| 234 | int sh_unix_check_piddir (char * pidpath);
|
|---|
| 235 |
|
|---|
| 236 | /* write lock for filename
|
|---|
| 237 | */
|
|---|
| 238 | int sh_unix_write_lock_file(char * filename);
|
|---|
| 239 |
|
|---|
| 240 | /* rm lock(s) for log file(s)
|
|---|
| 241 | */
|
|---|
| 242 | int sh_unix_rm_lock_file(char * filename);
|
|---|
| 243 |
|
|---|
| 244 | /* write the PID file
|
|---|
| 245 | */
|
|---|
| 246 | int sh_unix_write_pid_file(void);
|
|---|
| 247 |
|
|---|
| 248 | /* rm the PID file
|
|---|
| 249 | */
|
|---|
| 250 | int sh_unix_rm_pid_file(void);
|
|---|
| 251 |
|
|---|
| 252 |
|
|---|
| 253 | /* checksum of own binary
|
|---|
| 254 | */
|
|---|
| 255 | int sh_unix_self_hash (const char * c);
|
|---|
| 256 |
|
|---|
| 257 | /* return BAD on failure
|
|---|
| 258 | */
|
|---|
| 259 | int sh_unix_self_check (void);
|
|---|
| 260 |
|
|---|
| 261 | /* add a trusted user to the list
|
|---|
| 262 | */
|
|---|
| 263 | int tf_add_trusted_user(const char *);
|
|---|
| 264 |
|
|---|
| 265 | /* check a file
|
|---|
| 266 | */
|
|---|
| 267 | int tf_trust_check (const char * file, int mode);
|
|---|
| 268 |
|
|---|
| 269 | /* initialize group vector
|
|---|
| 270 | */
|
|---|
| 271 | #ifdef HOST_IS_OSF
|
|---|
| 272 | int sh_unix_initgroups ( char * in_user, gid_t in_gid);
|
|---|
| 273 | #else
|
|---|
| 274 | int sh_unix_initgroups (const char * in_user, gid_t in_gid);
|
|---|
| 275 | #endif
|
|---|
| 276 | int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
|
|---|
| 277 |
|
|---|
| 278 | /* set the timeserver address
|
|---|
| 279 | */
|
|---|
| 280 | int sh_unix_settimeserver (const char * address);
|
|---|
| 281 | void reset_count_dev_time(void);
|
|---|
| 282 |
|
|---|
| 283 | /* lock the key
|
|---|
| 284 | */
|
|---|
| 285 | void sh_unix_memlock(void);
|
|---|
| 286 |
|
|---|
| 287 | /* deamon mode
|
|---|
| 288 | */
|
|---|
| 289 | int sh_unix_setdeamon (const char * dummy);
|
|---|
| 290 | int sh_unix_setnodeamon(const char * dummy);
|
|---|
| 291 |
|
|---|
| 292 | /* Test whether file exists
|
|---|
| 293 | */
|
|---|
| 294 | int sh_unix_file_exists(char * path);
|
|---|
| 295 |
|
|---|
| 296 | /* test whether file exists with proper attributes
|
|---|
| 297 | */
|
|---|
| 298 | int sh_unix_device_readable(int fd);
|
|---|
| 299 |
|
|---|
| 300 | /* local host
|
|---|
| 301 | */
|
|---|
| 302 | void sh_unix_localhost(void);
|
|---|
| 303 |
|
|---|
| 304 | /* check whether /proc exists and is a proc filesystem
|
|---|
| 305 | */
|
|---|
| 306 | int sh_unix_test_proc(void);
|
|---|
| 307 |
|
|---|
| 308 | /* check whether a directory is secure
|
|---|
| 309 | * (no symlink in path, not world-writeable)
|
|---|
| 310 | */
|
|---|
| 311 | /* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
|
|---|
| 312 |
|
|---|
| 313 | /* check whether there's a rotated log with the correct inode and checksum
|
|---|
| 314 | */
|
|---|
| 315 | int sh_check_rotated_log (const char * path,
|
|---|
| 316 | UINT64 old_size, UINT64 old_inode, const char * old_hash);
|
|---|
| 317 |
|
|---|
| 318 | /* obtain file info
|
|---|
| 319 | */
|
|---|
| 320 | int sh_unix_getinfo (int level, const char * filename, file_type * theFile,
|
|---|
| 321 | char * fileHash, int flagrel);
|
|---|
| 322 |
|
|---|
| 323 | /* read file, return length read
|
|---|
| 324 | */
|
|---|
| 325 | int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
|
|---|
| 326 |
|
|---|
| 327 | /* call with goDaemon == 1 to make daemon process
|
|---|
| 328 | */
|
|---|
| 329 | int sh_unix_init(int goDaemon);
|
|---|
| 330 |
|
|---|
| 331 | /* for local time use thetime = 0, returns pointer to buffer
|
|---|
| 332 | */
|
|---|
| 333 | char * sh_unix_time (time_t thetime, char * buffer, size_t len);
|
|---|
| 334 |
|
|---|
| 335 | /* convert to GMT time, returns pointer to buffer
|
|---|
| 336 | */
|
|---|
| 337 | char * sh_unix_gmttime (time_t thetime, char * buffer, size_t len);
|
|---|
| 338 |
|
|---|
| 339 | /* effective user info
|
|---|
| 340 | */
|
|---|
| 341 | int sh_unix_getUser (void);
|
|---|
| 342 |
|
|---|
| 343 | /* get home directory, , returns pointer to out
|
|---|
| 344 | */
|
|---|
| 345 | char * sh_unix_getUIDdir (int level, uid_t uid, char * out, size_t len);
|
|---|
| 346 |
|
|---|
| 347 | /* get a group GID
|
|---|
| 348 | */
|
|---|
| 349 | long sh_group_to_gid (const char * g, int * fail);
|
|---|
| 350 |
|
|---|
| 351 | #ifdef HAVE_GETTIMEOFDAY
|
|---|
| 352 | unsigned long sh_unix_notime (void);
|
|---|
| 353 | #endif
|
|---|
| 354 |
|
|---|
| 355 | /* check whether a directory
|
|---|
| 356 | */
|
|---|
| 357 | int sh_unix_isdir (char * dirName, int level);
|
|---|
| 358 |
|
|---|
| 359 | #ifdef SH_STEALTH
|
|---|
| 360 | int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
|
|---|
| 361 | void sh_unix_xor_code (char * str, int len);
|
|---|
| 362 | #endif
|
|---|
| 363 |
|
|---|
| 364 | #if defined(SCREW_IT_UP)
|
|---|
| 365 | /* for raise()
|
|---|
| 366 | */
|
|---|
| 367 | #include <signal.h>
|
|---|
| 368 | #include <errno.h>
|
|---|
| 369 |
|
|---|
| 370 | void sh_sigtrap_handler (int signum);
|
|---|
| 371 |
|
|---|
| 372 | #ifdef HAVE_GETTIMEOFDAY
|
|---|
| 373 | #if TIME_WITH_SYS_TIME
|
|---|
| 374 | #include <sys/time.h>
|
|---|
| 375 | #include <time.h>
|
|---|
| 376 | #else
|
|---|
| 377 | #if HAVE_SYS_TIME_H
|
|---|
| 378 | #include <sys/time.h>
|
|---|
| 379 | #else
|
|---|
| 380 | #include <time.h>
|
|---|
| 381 | #endif
|
|---|
| 382 | #endif
|
|---|
| 383 | #endif
|
|---|
| 384 |
|
|---|
| 385 | struct sh_sigtrap_variables {
|
|---|
| 386 | int not_traced;
|
|---|
| 387 | #ifdef HAVE_GETTIMEOFDAY
|
|---|
| 388 | struct timeval save_tv;
|
|---|
| 389 | #endif
|
|---|
| 390 | };
|
|---|
| 391 |
|
|---|
| 392 | struct sh_sigtrap_variables * sh_sigtrap_variables_get();
|
|---|
| 393 |
|
|---|
| 394 | int sh_sigtrap_max_duration_set (const char * str);
|
|---|
| 395 |
|
|---|
| 396 | static inline
|
|---|
| 397 | int sh_sigtrap_prepare()
|
|---|
| 398 | {
|
|---|
| 399 | struct sigaction act_trap;
|
|---|
| 400 | int val_retry;
|
|---|
| 401 | act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
|
|---|
| 402 | act_trap.sa_flags = 0; /* init sa_flags */
|
|---|
| 403 | sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
|
|---|
| 404 | do {
|
|---|
| 405 | val_retry = sigaction(SIGTRAP, &act_trap, NULL);
|
|---|
| 406 | } while (val_retry < 0 && errno == EINTR);
|
|---|
| 407 | return 0;
|
|---|
| 408 | }
|
|---|
| 409 |
|
|---|
| 410 | /*@unused@*/ static inline
|
|---|
| 411 | int sh_derr(void)
|
|---|
| 412 | {
|
|---|
| 413 | struct sh_sigtrap_variables * sigtrap_variables;
|
|---|
| 414 | sigtrap_variables = sh_sigtrap_variables_get();
|
|---|
| 415 | if (sigtrap_variables == NULL) {
|
|---|
| 416 | /* Perhaps, its better to not die, and to continue using Samhain,
|
|---|
| 417 | even if this part does not work. */
|
|---|
| 418 | return (0);
|
|---|
| 419 | }
|
|---|
| 420 |
|
|---|
| 421 | sigtrap_variables->not_traced = 0;
|
|---|
| 422 |
|
|---|
| 423 | #ifdef HAVE_GETTIMEOFDAY
|
|---|
| 424 | gettimeofday(&sigtrap_variables->save_tv, NULL);
|
|---|
| 425 | #endif
|
|---|
| 426 |
|
|---|
| 427 | /* raise() sends to same thread, like pthread_kill(pthread_self(), sig);
|
|---|
| 428 | */
|
|---|
| 429 | raise(SIGTRAP);
|
|---|
| 430 |
|
|---|
| 431 | if (sigtrap_variables->not_traced == 0)
|
|---|
| 432 | _exit(5);
|
|---|
| 433 |
|
|---|
| 434 | sigtrap_variables->not_traced = 0;
|
|---|
| 435 | return (0);
|
|---|
| 436 | }
|
|---|
| 437 |
|
|---|
| 438 | #else
|
|---|
| 439 |
|
|---|
| 440 | /*@unused@*/ static inline
|
|---|
| 441 | int sh_derr(void)
|
|---|
| 442 | {
|
|---|
| 443 | return 0;
|
|---|
| 444 | }
|
|---|
| 445 | /* #if defined(SCREW_IT_UP) */
|
|---|
| 446 | #endif
|
|---|
| 447 |
|
|---|
| 448 | #endif
|
|---|
| 449 |
|
|---|
| 450 |
|
|---|
