1 | /* SAMHAIN file system integrity testing */
|
---|
2 | /* Copyright (C) 1999 Rainer Wichmann */
|
---|
3 | /* */
|
---|
4 | /* This program is free software; you can redistribute it */
|
---|
5 | /* and/or modify */
|
---|
6 | /* it under the terms of the GNU General Public License as */
|
---|
7 | /* published by */
|
---|
8 | /* the Free Software Foundation; either version 2 of the License, or */
|
---|
9 | /* (at your option) any later version. */
|
---|
10 | /* */
|
---|
11 | /* This program is distributed in the hope that it will be useful, */
|
---|
12 | /* but WITHOUT ANY WARRANTY; without even the implied warranty of */
|
---|
13 | /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
|
---|
14 | /* GNU General Public License for more details. */
|
---|
15 | /* */
|
---|
16 | /* You should have received a copy of the GNU General Public License */
|
---|
17 | /* along with this program; if not, write to the Free Software */
|
---|
18 | /* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
|
---|
19 |
|
---|
20 |
|
---|
21 |
|
---|
22 | #ifndef SH_UNIX_H
|
---|
23 | #define SH_UNIX_H
|
---|
24 |
|
---|
25 | /* For PATH_MAX */
|
---|
26 | #include <limits.h>
|
---|
27 | #if !defined(PATH_MAX)
|
---|
28 | #define PATH_MAX 1024
|
---|
29 | #endif
|
---|
30 |
|
---|
31 | #include <unistd.h>
|
---|
32 | #include "samhain.h"
|
---|
33 | #include "sh_error.h"
|
---|
34 |
|
---|
35 |
|
---|
36 | typedef enum {
|
---|
37 | SH_ISLOG,
|
---|
38 | SH_ISFILE,
|
---|
39 | SH_ISDIR,
|
---|
40 | SH_ISDATA
|
---|
41 | } ShOpenType;
|
---|
42 |
|
---|
43 | typedef enum {
|
---|
44 | SH_DATA_RAW,
|
---|
45 | SH_DATA_LINE
|
---|
46 | } ShDataType;
|
---|
47 |
|
---|
48 | typedef enum {
|
---|
49 | SH_FILE_REGULAR,
|
---|
50 | SH_FILE_SYMLINK,
|
---|
51 | SH_FILE_DIRECTORY,
|
---|
52 | SH_FILE_CDEV,
|
---|
53 | SH_FILE_BDEV,
|
---|
54 | SH_FILE_FIFO,
|
---|
55 | SH_FILE_SOCKET,
|
---|
56 | SH_FILE_DOOR,
|
---|
57 | SH_FILE_PORT,
|
---|
58 | SH_FILE_UNKNOWN
|
---|
59 | } ShFileType;
|
---|
60 |
|
---|
61 | /* -- Attributes to check. --
|
---|
62 | */
|
---|
63 |
|
---|
64 | /* checksum */
|
---|
65 | #define MODI_CHK (1 << 0)
|
---|
66 | /* link */
|
---|
67 | #define MODI_LNK (1 << 1)
|
---|
68 | /* inode */
|
---|
69 | #define MODI_INO (1 << 2)
|
---|
70 |
|
---|
71 | /* user */
|
---|
72 | #define MODI_USR (1 << 3)
|
---|
73 | /* group */
|
---|
74 | #define MODI_GRP (1 << 4)
|
---|
75 | /* mtime */
|
---|
76 | #define MODI_MTM (1 << 5)
|
---|
77 |
|
---|
78 | /* ctime */
|
---|
79 | #define MODI_CTM (1 << 6)
|
---|
80 | /* atime */
|
---|
81 | #define MODI_ATM (1 << 7)
|
---|
82 | /* size */
|
---|
83 | #define MODI_SIZ (1 << 8)
|
---|
84 |
|
---|
85 | /* file mode */
|
---|
86 | #define MODI_MOD (1 << 9)
|
---|
87 | /* hardlinks */
|
---|
88 | #define MODI_HLN (1 << 10)
|
---|
89 | /* device type */
|
---|
90 | #define MODI_RDEV (1 << 11)
|
---|
91 |
|
---|
92 | /* size may grow */
|
---|
93 | #define MODI_SGROW (1 << 12)
|
---|
94 | /* use prelink */
|
---|
95 | #define MODI_PREL (1 << 13)
|
---|
96 | /* get content */
|
---|
97 | #define MODI_TXT ((1 << 14)|MODI_CHK)
|
---|
98 | #define MODI_TXT_ENABLED(a) (((a)&(1 << 14))!=0)
|
---|
99 |
|
---|
100 | /* get audit record */
|
---|
101 | #define MODI_AUDIT (1 << 15)
|
---|
102 | #define MODI_AUDIT_ENABLED(a) (((a)&(1 << 15))!=0)
|
---|
103 | /* do not check */
|
---|
104 | #define MODI_NOCHECK (1 << 16)
|
---|
105 | /* do not check */
|
---|
106 | #define MODI_ALLIGNORE (1 << 17)
|
---|
107 |
|
---|
108 | #define MODI_TIGER192 0x01000000UL
|
---|
109 | #define MODI_SHA1 0x02000000UL
|
---|
110 | #define MODI_MD5 0x03000000UL
|
---|
111 | #define MODI_SHA256 0x04000000UL
|
---|
112 | #define MODI_HASHTYPE 0x0F000000UL
|
---|
113 |
|
---|
114 | #define MODI_INIT 0xD0000000UL
|
---|
115 | #define MODI_INITIALIZED(a) (((a) & 0xF0000000UL) == MODI_INIT)
|
---|
116 |
|
---|
117 | #define MODI_SET(a, b) ((a) |= (b))
|
---|
118 | #define MODI_CLEAR(a, b) ((a) &= ~(b))
|
---|
119 | #define MODI_ISSET(a, b) (((a) & (b)) != 0)
|
---|
120 |
|
---|
121 | #define SH_TXT_MAX 9200
|
---|
122 |
|
---|
123 | #define MASK_ALLIGNORE_ 0
|
---|
124 | extern unsigned long mask_ALLIGNORE;
|
---|
125 | #define MASK_ATTRIBUTES_ (MODI_MOD|MODI_USR|MODI_GRP|MODI_RDEV)
|
---|
126 | extern unsigned long mask_ATTRIBUTES;
|
---|
127 | #define MASK_LOGFILES_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_INO)
|
---|
128 | extern unsigned long mask_LOGFILES;
|
---|
129 | #define MASK_LOGGROW_ (MASK_LOGFILES_|MODI_SIZ|MODI_SGROW|MODI_CHK)
|
---|
130 | extern unsigned long mask_LOGGROW;
|
---|
131 | #define MASK_READONLY_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_MTM|MODI_CTM)
|
---|
132 | extern unsigned long mask_READONLY;
|
---|
133 | #define MASK_NOIGNORE_ (MASK_LOGFILES_|MODI_CHK|MODI_SIZ|MODI_ATM|MODI_MTM)
|
---|
134 | extern unsigned long mask_NOIGNORE;
|
---|
135 | #define MASK_USER_ (MASK_READONLY_|MODI_ATM)
|
---|
136 | extern unsigned long mask_USER0;
|
---|
137 | extern unsigned long mask_USER1;
|
---|
138 | extern unsigned long mask_USER2;
|
---|
139 | extern unsigned long mask_USER3;
|
---|
140 | extern unsigned long mask_USER4;
|
---|
141 | /* like READONLY, but without MTM,CTM,SIZ,INO, and with PREL)
|
---|
142 | */
|
---|
143 | #define MASK_PRELINK_ (MASK_ATTRIBUTES_|MODI_HLN|MODI_LNK|MODI_CHK|MODI_PREL)
|
---|
144 | extern unsigned long mask_PRELINK;
|
---|
145 |
|
---|
146 | typedef struct file_struct {
|
---|
147 | unsigned long check_flags;
|
---|
148 | int file_reported;
|
---|
149 | char fullpath[PATH_MAX];
|
---|
150 | ShFileType type;
|
---|
151 | dev_t dev;
|
---|
152 | ino_t ino;
|
---|
153 | mode_t mode;
|
---|
154 | nlink_t hardlinks;
|
---|
155 | #if defined(__linux__) || defined(HAVE_STAT_FLAGS)
|
---|
156 | unsigned long attributes;
|
---|
157 | char c_attributes[ATTRBUF_SIZE];
|
---|
158 | #endif
|
---|
159 | char c_mode[CMODE_SIZE];
|
---|
160 | uid_t owner;
|
---|
161 | char c_owner[USER_MAX+2];
|
---|
162 | gid_t group;
|
---|
163 | char c_group[GROUP_MAX+2];
|
---|
164 | dev_t rdev;
|
---|
165 | off_t size;
|
---|
166 | unsigned long blksize;
|
---|
167 | unsigned long blocks;
|
---|
168 | time_t atime;
|
---|
169 | time_t mtime;
|
---|
170 | time_t ctime;
|
---|
171 |
|
---|
172 | char * link_path;
|
---|
173 | mode_t linkmode;
|
---|
174 | char link_c_mode[11];
|
---|
175 | int linkisok;
|
---|
176 | char * attr_string;
|
---|
177 | } file_type;
|
---|
178 |
|
---|
179 | extern int sh_unix_check_selinux;
|
---|
180 | extern int sh_unix_check_acl;
|
---|
181 |
|
---|
182 | /* destroy userid cache
|
---|
183 | */
|
---|
184 | void sh_userid_destroy ();
|
---|
185 |
|
---|
186 | /* --- run a command, securely ---
|
---|
187 | */
|
---|
188 | int sh_unix_run_command (const char * str);
|
---|
189 |
|
---|
190 | /* Ignore SIGPIPE
|
---|
191 | */
|
---|
192 | void sh_unix_ign_sigpipe();
|
---|
193 |
|
---|
194 | /* mlock utilities
|
---|
195 | */
|
---|
196 | int sh_unix_mlock(const char * file, int line, void * addr, size_t len);
|
---|
197 | int sh_unix_munlock(void * addr, size_t len);
|
---|
198 | int sh_unix_count_mlock(void);
|
---|
199 | /* public for unit tests */
|
---|
200 | int sh_unix_pagesize(void);
|
---|
201 | unsigned long sh_unix_lookup_page(void * in_addr, size_t len, int * num_pages);
|
---|
202 |
|
---|
203 | /* chroot directory
|
---|
204 | */
|
---|
205 | int sh_unix_set_chroot(const char * str);
|
---|
206 |
|
---|
207 | /* whether to use localtime for file timesatams in logs
|
---|
208 | */
|
---|
209 | int sh_unix_uselocaltime (const char * c);
|
---|
210 |
|
---|
211 | /* whether to perform selinux/acl checks
|
---|
212 | */
|
---|
213 | #ifdef USE_XATTR
|
---|
214 | int sh_unix_setcheckselinux (const char * c);
|
---|
215 | #endif
|
---|
216 | #ifdef USE_ACL
|
---|
217 | int sh_unix_setcheckacl (const char * c);
|
---|
218 | #endif
|
---|
219 | #if defined(__linux__) || defined(HAVE_STAT_FLAGS)
|
---|
220 | int sh_unix_setcheckattributes (const char * c);
|
---|
221 | #endif
|
---|
222 |
|
---|
223 | /* set I/O limit
|
---|
224 | */
|
---|
225 | int sh_unix_set_io_limit (const char * c);
|
---|
226 | void sh_unix_io_pause (void);
|
---|
227 |
|
---|
228 | /* get file type
|
---|
229 | */
|
---|
230 | int sh_unix_get_ftype(char * fullpath);
|
---|
231 |
|
---|
232 | /* reset masks for policies
|
---|
233 | */
|
---|
234 | int sh_unix_maskreset(void);
|
---|
235 |
|
---|
236 | /* return true if database is remote
|
---|
237 | */
|
---|
238 | int file_is_remote (void);
|
---|
239 |
|
---|
240 | /* return the path to the configuration/database file
|
---|
241 | */
|
---|
242 | char * file_path(char what, char flag);
|
---|
243 |
|
---|
244 | /* return current time as unsigned long
|
---|
245 | */
|
---|
246 | unsigned long sh_unix_longtime (void);
|
---|
247 |
|
---|
248 | /* close all files >= fd, except possibly one
|
---|
249 | */
|
---|
250 | void sh_unix_closeall (int fd, int except, int inchild);
|
---|
251 |
|
---|
252 | /* Check whether directory for pid file exists
|
---|
253 | */
|
---|
254 | int sh_unix_check_piddir (char * pidpath);
|
---|
255 |
|
---|
256 | /* write lock for filename
|
---|
257 | */
|
---|
258 | int sh_unix_write_lock_file(char * filename);
|
---|
259 |
|
---|
260 | /* rm lock(s) for log file(s)
|
---|
261 | */
|
---|
262 | int sh_unix_rm_lock_file(char * filename);
|
---|
263 |
|
---|
264 | /* write the PID file
|
---|
265 | */
|
---|
266 | int sh_unix_write_pid_file(void);
|
---|
267 |
|
---|
268 | /* rm the PID file
|
---|
269 | */
|
---|
270 | int sh_unix_rm_pid_file(void);
|
---|
271 |
|
---|
272 |
|
---|
273 | /* checksum of own binary
|
---|
274 | */
|
---|
275 | int sh_unix_self_hash (const char * c);
|
---|
276 |
|
---|
277 | /* return BAD on failure
|
---|
278 | */
|
---|
279 | int sh_unix_self_check (void);
|
---|
280 |
|
---|
281 | /* add a trusted user to the list
|
---|
282 | */
|
---|
283 | int tf_add_trusted_user(const char *);
|
---|
284 |
|
---|
285 | /* check a file
|
---|
286 | */
|
---|
287 | int tf_trust_check (const char * file, int mode);
|
---|
288 |
|
---|
289 | /* initialize group vector
|
---|
290 | */
|
---|
291 | #ifdef HOST_IS_OSF
|
---|
292 | int sh_unix_initgroups ( char * in_user, gid_t in_gid);
|
---|
293 | #else
|
---|
294 | int sh_unix_initgroups (const char * in_user, gid_t in_gid);
|
---|
295 | #endif
|
---|
296 | int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid);
|
---|
297 |
|
---|
298 | /* set the timeserver address
|
---|
299 | */
|
---|
300 | int sh_unix_settimeserver (const char * address);
|
---|
301 | void reset_count_dev_time(void);
|
---|
302 |
|
---|
303 | /* lock the key
|
---|
304 | */
|
---|
305 | void sh_unix_memlock(void);
|
---|
306 |
|
---|
307 | /* deamon mode
|
---|
308 | */
|
---|
309 | int sh_unix_setdeamon (const char * dummy);
|
---|
310 | int sh_unix_setnodeamon(const char * dummy);
|
---|
311 |
|
---|
312 | /* Test whether file exists
|
---|
313 | */
|
---|
314 | int sh_unix_file_exists(char * path);
|
---|
315 |
|
---|
316 | /* test whether file exists with proper attributes
|
---|
317 | */
|
---|
318 | int sh_unix_device_readable(int fd);
|
---|
319 |
|
---|
320 | /* local host
|
---|
321 | */
|
---|
322 | void sh_unix_localhost(void);
|
---|
323 |
|
---|
324 | /* check whether /proc exists and is a proc filesystem
|
---|
325 | */
|
---|
326 | int sh_unix_test_proc(void);
|
---|
327 |
|
---|
328 | /* check whether a directory is secure
|
---|
329 | * (no symlink in path, not world-writeable)
|
---|
330 | */
|
---|
331 | /* int sh_unix_is_secure_dir (ShErrLevel level, char * tmp); */
|
---|
332 |
|
---|
333 | /* check whether there's a rotated log with the correct inode and checksum
|
---|
334 | */
|
---|
335 | int sh_check_rotated_log (const char * path,
|
---|
336 | UINT64 old_size, UINT64 old_inode, const char * old_hash, unsigned long mask);
|
---|
337 |
|
---|
338 | /* obtain file info
|
---|
339 | */
|
---|
340 | int sh_unix_getinfo (int level, const char * filename, file_type * theFile,
|
---|
341 | char * fileHash, int flagrel);
|
---|
342 |
|
---|
343 | /* read file, return length read
|
---|
344 | */
|
---|
345 | int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline);
|
---|
346 |
|
---|
347 | /* call with goDaemon == 1 to make daemon process
|
---|
348 | */
|
---|
349 | int sh_unix_init(int goDaemon);
|
---|
350 |
|
---|
351 | /* for local time use thetime = 0, returns pointer to buffer
|
---|
352 | */
|
---|
353 | char * sh_unix_time (time_t thetime, char * buffer, size_t len);
|
---|
354 |
|
---|
355 | /* convert to GMT time, returns pointer to buffer
|
---|
356 | */
|
---|
357 | char * sh_unix_gmttime (time_t thetime, char * buffer, size_t len);
|
---|
358 |
|
---|
359 | /* effective user info
|
---|
360 | */
|
---|
361 | int sh_unix_getUser (void);
|
---|
362 |
|
---|
363 | /* get home directory, , returns pointer to out
|
---|
364 | */
|
---|
365 | char * sh_unix_getUIDdir (int level, uid_t uid, char * out, size_t len);
|
---|
366 |
|
---|
367 | /* get a group GID
|
---|
368 | */
|
---|
369 | long sh_group_to_gid (const char * g, int * fail);
|
---|
370 |
|
---|
371 | #ifdef HAVE_GETTIMEOFDAY
|
---|
372 | unsigned long sh_unix_notime (void);
|
---|
373 | #endif
|
---|
374 |
|
---|
375 | /* check whether a directory
|
---|
376 | */
|
---|
377 | int sh_unix_isdir (char * dirName, int level);
|
---|
378 |
|
---|
379 | #ifdef SH_STEALTH
|
---|
380 | int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len);
|
---|
381 | void sh_unix_xor_code (char * str, int len);
|
---|
382 | #endif
|
---|
383 |
|
---|
384 | #if defined(SCREW_IT_UP)
|
---|
385 | /* for raise()
|
---|
386 | */
|
---|
387 | #include <signal.h>
|
---|
388 | #include <errno.h>
|
---|
389 |
|
---|
390 | void sh_sigtrap_handler (int signum);
|
---|
391 |
|
---|
392 | #ifdef HAVE_GETTIMEOFDAY
|
---|
393 | #if HAVE_SYS_TIME_H
|
---|
394 | #include <sys/time.h>
|
---|
395 | #endif
|
---|
396 | #include <time.h>
|
---|
397 | #endif
|
---|
398 |
|
---|
399 | struct sh_sigtrap_variables {
|
---|
400 | int not_traced;
|
---|
401 | #ifdef HAVE_GETTIMEOFDAY
|
---|
402 | struct timeval save_tv;
|
---|
403 | #endif
|
---|
404 | };
|
---|
405 |
|
---|
406 | struct sh_sigtrap_variables * sh_sigtrap_variables_get();
|
---|
407 |
|
---|
408 | int sh_sigtrap_max_duration_set (const char * str);
|
---|
409 |
|
---|
410 | static inline
|
---|
411 | int sh_sigtrap_prepare()
|
---|
412 | {
|
---|
413 | struct sigaction act_trap;
|
---|
414 | int val_retry;
|
---|
415 | act_trap.sa_handler = &sh_sigtrap_handler; /* signal action */
|
---|
416 | act_trap.sa_flags = 0; /* init sa_flags */
|
---|
417 | sigemptyset ( &act_trap.sa_mask ); /* set an empty mask */
|
---|
418 | do {
|
---|
419 | val_retry = sigaction(SIGTRAP, &act_trap, NULL);
|
---|
420 | } while (val_retry < 0 && errno == EINTR);
|
---|
421 | return 0;
|
---|
422 | }
|
---|
423 |
|
---|
424 | /*@unused@*/ static inline
|
---|
425 | int sh_derr(void)
|
---|
426 | {
|
---|
427 | struct sh_sigtrap_variables * sigtrap_variables;
|
---|
428 | sigtrap_variables = sh_sigtrap_variables_get();
|
---|
429 | if (sigtrap_variables == NULL) {
|
---|
430 | /* Perhaps, its better to not die, and to continue using Samhain,
|
---|
431 | even if this part does not work. */
|
---|
432 | return (0);
|
---|
433 | }
|
---|
434 |
|
---|
435 | sigtrap_variables->not_traced = 0;
|
---|
436 |
|
---|
437 | #ifdef HAVE_GETTIMEOFDAY
|
---|
438 | gettimeofday(&sigtrap_variables->save_tv, NULL);
|
---|
439 | #endif
|
---|
440 |
|
---|
441 | /* raise() sends to same thread, like pthread_kill(pthread_self(), sig);
|
---|
442 | */
|
---|
443 | raise(SIGTRAP);
|
---|
444 |
|
---|
445 | if (sigtrap_variables->not_traced == 0)
|
---|
446 | _exit(5);
|
---|
447 |
|
---|
448 | sigtrap_variables->not_traced = 0;
|
---|
449 | return (0);
|
---|
450 | }
|
---|
451 |
|
---|
452 | #else
|
---|
453 |
|
---|
454 | /*@unused@*/ static inline
|
---|
455 | int sh_derr(void)
|
---|
456 | {
|
---|
457 | return 0;
|
---|
458 | }
|
---|
459 | /* #if defined(SCREW_IT_UP) */
|
---|
460 | #endif
|
---|
461 |
|
---|
462 | #endif
|
---|
463 |
|
---|
464 |
|
---|