Context Navigation

source: trunk/src/sh_gpg.c@ 107

Last change on this file since 107 was 102, checked in by rainer, 18 years ago
Flush before fork (fix for ticket #60), and fix for kcheck on 2.6.21 (ticket #63).
File size: 29.9 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 1999, 2000 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24
25
26	#if defined(WITH_GPG) \|\| defined(WITH_PGP)
27
28	#include <unistd.h>
29	#include <fcntl.h>
30	#include <signal.h>
31	#if defined(SH_WITH_SERVER)
32	#include <pwd.h>
33	#endif
34	#include <sys/stat.h>
35	#include <sys/types.h>
36	#include <errno.h>
37	#include <sys/wait.h>
38
39	#include <string.h>
40	#ifdef HAVE_MEMORY_H
41	#include <memory.h>
42	#endif
43
44
45	#if !defined(O_NONBLOCK)
46	#if defined(O_NDELAY)
47	#define O_NONBLOCK O_NDELAY
48	#else
49	#define O_NONBLOCK 0
50	#endif
51	#endif
52
53
54	#include "samhain.h"
55	#include "sh_utils.h"
56	#include "sh_error.h"
57	#include "sh_tiger.h"
58	#if defined(SH_WITH_SERVER)
59	#define SH_NEED_PWD_GRP 1
60	#include "sh_static.h"
61	#endif
62
63	static struct {
64	char conf_id[SH_MINIBUF+1];
65	char conf_fp[SH_MINIBUF+1];
66	char data_id[SH_MINIBUF+1];
67	char data_fp[SH_MINIBUF+1];
68	} gp;
69
70	typedef struct {
71	pid_t pid;
72	FILE * pipe;
73	} sh_gpg_popen_t;
74
75	#define SH_GPG_OK 0
76	#define SH_GPG_BAD 1
77	#define SH_GPG_BADSIGN 2
78
79	/* replace #if 0 by #if 1 and set an appropriate path in front of '/pdbg.'
80	* for debugging
81	*/
82	#if 0
83	#define PDGBFILE "/pdbg."
84	#endif
85
86	#if defined(PDGBFILE)
87	FILE * pdbg;
88	FILE * pdbgc;
89	#define PDBG_OPEN pdbg = fopen(PDGBFILE"main", "a")
90	#define PDBG_CLOSE fclose (pdbg)
91	#define PDBG(arg) fprintf(pdbg, "PDBG: step %d\n", arg); fflush(pdbg)
92	#define PDBG_D(arg) fprintf(pdbg, "PDBG: %d\n", arg); fflush(pdbg)
93	#define PDBG_S(arg) fprintf(pdbg, "PDBG: %s\n", arg); fflush(pdbg)
94
95	#define PDBGC_OPEN pdbgc = fopen(PDGBFILE"child", "a")
96	#define PDBGC_CLOSE fclose (pdbgc)
97	#define PDBGC(arg) fprintf(pdbgc, "PDBG: step %d\n", arg); fflush(pdbgc)
98	#define PDBGC_D(arg) fprintf(pdbgc, "PDBG: %d\n", arg); fflush(pdbgc)
99	#define PDBGC_S(arg) fprintf(pdbgc, "PDBG: %s\n", arg); fflush(pdbgc)
100	#else
101	#define PDBG_OPEN
102	#define PDBG_CLOSE
103	#define PDBG(arg)
104	#define PDBG_D(arg)
105	#define PDBG_S(arg)
106	#define PDBGC_OPEN
107	#define PDBGC_CLOSE
108	#define PDBGC(arg)
109	#define PDBGC_D(arg)
110	#define PDBGC_S(arg)
111	#endif
112
113	#undef FIL__
114	#define FIL__ _("sh_gpg.c")
115
116	#ifdef GPG_HASH
117
118	static int sh_gpg_checksum (SL_TICKET checkfd, int flag)
119	{
120	char * test_gpg;
121	char * test_ptr1 = NULL;
122	char * test_ptr2 = NULL;
123	char wstrip1[128];
124	char wstrip2[128];
125	int i, k;
126	#include "sh_gpg_chksum.h"
127
128	SL_ENTER(_("sh_gpg_checksum"));
129
130	tiger_fd = checkfd;
131	#if defined(WITH_PGP)
132	test_gpg = sh_tiger_hash_gpg (DEFAULT_PGP_PATH, TIGER_FD, 0);
133	#else
134	test_gpg = sh_tiger_hash_gpg (DEFAULT_GPG_PATH, TIGER_FD, 0);
135	#endif
136
137	test_ptr1 = strchr(GPG_HASH, ':');
138	if (test_gpg != NULL)
139	test_ptr2 = strchr(test_gpg, ':');
140
141	if (test_ptr2 != NULL)
142	test_ptr2 += 2;
143	else
144	test_ptr2 = test_gpg;
145	if (test_ptr1 != NULL)
146	test_ptr1 += 2;
147	else
148	test_ptr1 = GPG_HASH;
149
150	/* Tue Jun 24 23:11:54 CEST 2003 (1.7.9) -- strip whitespace
151	*/
152	k = 0;
153	for (i = 0; i < 127; ++i)
154	{
155	if (test_ptr1[i] == '\0')
156	break;
157	if (test_ptr1[i] != ' ')
158	{
159	wstrip1[k] = test_ptr1[i];
160	++k;
161	}
162	}
163	wstrip1[k] = '\0';
164
165	for(i = 0; i < KEY_LEN; ++i)
166	{
167	if (gpgchk[i] != wstrip1[i])
168	{
169	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0, MSG_E_GPG_CHK,
170	gpgchk, wstrip1);
171	break;
172	}
173	}
174
175	k = 0;
176	for (i = 0; i < 127; ++i)
177	{
178	if (test_ptr2[i] == '\0')
179	break;
180	if (test_ptr2[i] != ' ')
181	{
182	wstrip2[k] = test_ptr2[i];
183	++k;
184	}
185	}
186	wstrip2[k] = '\0';
187
188	if (0 != sl_strncmp(wstrip1, wstrip2, 127))
189	{
190	TPT(((0), FIL__, __LINE__, _("msg=<pgp checksum: %s>\n"), test_gpg));
191	TPT(((0), FIL__, __LINE__, _("msg=<Compiled-in : %s>\n"), GPG_HASH));
192	TPT(((0), FIL__, __LINE__, _("msg=<wstrip1 : %s>\n"), wstrip1));
193	TPT(((0), FIL__, __LINE__, _("msg=<wstrip2 : %s>\n"), wstrip2));
194	if (flag == 1)
195	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_GPG,
196	GPG_HASH, test_gpg);
197	dlog(1, FIL__, __LINE__, _("The compiled-in checksum of the gpg binary\n(%s)\ndoes not match the actual checksum\n(%s).\nYou need to recompile with the correct checksum."), wstrip1, wstrip2);
198	SH_FREE(test_gpg);
199	SL_RETURN((-1), _("sh_gpg_checksum"));
200	}
201	SH_FREE(test_gpg);
202	SL_RETURN( (0), _("sh_gpg_checksum"));
203	}
204	#endif
205
206	struct startup_info {
207	long line;
208	char * program;
209	long uid;
210	char * path;
211	char * key_uid;
212	char * key_id;
213	};
214
215	static struct startup_info startInfo = { 0, NULL, 0, NULL, NULL, NULL };
216
217	void sh_gpg_log_startup ()
218	{
219	if (startInfo.program != NULL)
220	{
221	sh_error_handle ((-1), FIL__, startInfo.line, 0, MSG_START_GH,
222	startInfo.program, startInfo.uid,
223	startInfo.path,
224	startInfo.key_uid, startInfo.key_id);
225	}
226	return;
227	}
228
229	static void sh_gpg_fill_startup (long line, char * program, long uid, char * path,
230	char * key_uid, char * key_id)
231	{
232	startInfo.line = line;
233	startInfo.program = sh_util_strdup(program);
234	startInfo.uid = uid;
235	startInfo.path = sh_util_strdup(path);
236	startInfo.key_uid = sh_util_strdup(key_uid);
237	startInfo.key_id = sh_util_strdup(key_id);
238	return;
239	}
240
241	static FILE * sh_gpg_popen (sh_gpg_popen_t *source, int fd,
242	int mode, char * id, char * homedir)
243	{
244	int pipedes[2];
245	FILE * outf = NULL;
246	char * envp[2];
247	size_t len;
248	char path[256];
249	char cc1[32];
250	char cc2[32];
251	#if defined(WITH_PGP)
252	char cc3[32];
253	char cc0[3] = "-f";
254	#endif
255	#if defined(WITH_GPG)
256	char cc0[2] = "-";
257	char cc3[32];
258	char cc4[SH_PATHBUF+32];
259	char cc5[32] = "--no-tty";
260	#endif
261
262	char * arg[9];
263
264	#if defined(HAVE_GPG_CHECKSUM)
265	SL_TICKET checkfd;
266	int myrand;
267	int i;
268	#if defined(__linux__)
269	int get_the_fd(SL_TICKET);
270	char pname[128];
271	int pfd;
272	#endif
273	#endif
274
275	SL_ENTER(_("sh_gpg_popen"));
276
277	#if defined(WITH_GPG)
278	/* -- GnuPG -- */
279	sl_strlcpy (path, DEFAULT_GPG_PATH, 256);
280	sl_strlcpy (cc1, _("--status-fd"), 32);
281	sl_strlcpy (cc2, _("--verify"), 32);
282	sl_strlcpy (cc3, _("--homedir"), 32);
283	/* sl_strlcpy (cc4, sh.effective.home, SH_PATHBUF+32); */
284	sl_strlcpy (cc4, homedir, SH_PATHBUF+32);
285	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
286
287	/* fprintf(stderr, "YULE: homedir=%s\n", homedir); */
288
289	#if defined(SH_WITH_SERVER)
290	if (0 == sl_ret_euid()) /* privileges not dropped yet */
291	{
292	struct stat lbuf;
293	int status_stat = 0;
294	struct passwd * tempres = getpwnam(DEFAULT_IDENT);
295	if (!tempres)
296	tempres = sh_getpwnam(DEFAULT_IDENT);
297	if (!tempres)
298	{
299	dlog(1, FIL__, __LINE__,
300	_("User %s does not exist. Please add the user to your system.\n"),
301	DEFAULT_IDENT);
302	status_stat = -1;
303	}
304	if (!tempres->pw_dir \|\| tempres->pw_dir[0] == '\0')
305	{
306	dlog(1, FIL__, __LINE__,
307	_("User %s does not have a home directory.\nPlease add the home directory for this user to your system.\n"),
308	DEFAULT_IDENT);
309	status_stat = -2;
310	}
311	if (status_stat == 0)
312	{
313	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
314	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
315	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
316	if (status_stat == -1)
317	{
318	dlog(1, FIL__, __LINE__,
319	_("Gnupg directory %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
320	cc4, DEFAULT_IDENT);
321	status_stat = -3;
322	}
323	}
324	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
325	{
326	dlog(1, FIL__, __LINE__,
327	_("Gnupg directory %s\nis not owned by user %s.\n"),
328	cc4, DEFAULT_IDENT);
329	status_stat = -4;
330	}
331	if (status_stat == 0)
332	{
333	sl_strlcat (cc4, _("/pubring.gpg"), SH_PATHBUF+32);
334	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
335	if (status_stat == -1)
336	{
337	dlog(1, FIL__, __LINE__,
338	_("Gnupg public keyring %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
339	cc4, DEFAULT_IDENT);
340	status_stat = -5;
341	}
342	}
343	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
344	{
345	dlog(1, FIL__, __LINE__,
346	_("Gnupg public keyring %s\nis not owned by user %s.\n"),
347	cc4, DEFAULT_IDENT);
348	status_stat = -6;
349	}
350	if (status_stat != 0)
351	{
352	sh_error_handle((-1), FIL__, __LINE__, status_stat, MSG_EXIT_ABORT1,
353	sh.prg_name);
354	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
355	}
356	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
357	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
358	}
359	#endif
360
361	arg[0] = path;
362	arg[1] = cc1;
363	arg[2] = "1";
364	arg[3] = cc2;
365	arg[4] = cc3;
366	arg[5] = cc4;
367	arg[6] = cc5;
368	arg[7] = cc0;
369	arg[8] = NULL;
370
371	/* catch 'unused parameter' compiler warning
372	*/
373	(void) mode;
374	(void) id;
375	#elif defined(WITH_PGP)
376	/* -- PGP -- */
377	sl_strlcpy (path, DEFAULT_PGP_PATH, 256);
378	if (mode == 0)
379	{
380	sl_strlcpy (cc1, _("+language=en"), 32);
381	sl_strlcpy (cc2, _("-o"), 32);
382	sl_strlcpy (cc3, _("/dev/null"), 32);
383
384	arg[0] = path;
385	arg[1] = cc1;
386	arg[2] = cc2;
387	arg[3] = cc3;
388	arg[4] = cc0;
389	arg[5] = NULL;
390	}
391	else
392	{
393	sl_strlcpy (cc1, _("+language=en"), 32);
394	sl_strlcpy (cc2, _("-kvc"), 32);
395
396	arg[0] = path;
397	arg[1] = cc1;
398	arg[2] = cc2;
399	arg[3] = id;
400	arg[4] = NULL;
401	arg[5] = NULL;
402	}
403	#endif
404
405	/* use homedir of effective user
406	*/
407	if (sh.effective.home != NULL)
408	{
409	len = sl_strlen(sh.effective.home) + 6;
410	envp[0] = malloc (len); /* free() ok */
411	if (envp[0] != NULL)
412	sl_snprintf (envp[0], len, "HOME=%s", sh.effective.home);
413	envp[1] = NULL;
414	}
415	else
416	{
417	envp[0] = NULL;
418	}
419
420	/* Create the pipe
421	*/
422	if (aud_pipe(FIL__, __LINE__, pipedes) < 0)
423	{
424	if (envp[0] != NULL)
425	free(envp[0]);
426	SL_RETURN( (NULL), _("sh_gpg_popen"));
427	}
428
429	fflush (NULL);
430
431	source->pid = aud_fork(FIL__, __LINE__);
432
433	/* Failure
434	*/
435	if (source->pid == (pid_t) - 1)
436	{
437	close(pipedes[0]);
438	close(pipedes[1]);
439	if (envp[0] != NULL)
440	free(envp[0]);
441	SL_RETURN( (NULL), _("sh_gpg_popen"));
442	}
443
444	if (source->pid == (pid_t) 0)
445	{
446
447	/* child - make read side of the pipe stdout
448	*/
449	if (retry_aud_dup2(FIL__, __LINE__,
450	pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
451	{
452	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on pipe failed>\n")));
453	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
454	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
455	}
456
457	/* close the pipe descriptors
458	*/
459	close (pipedes[STDIN_FILENO]);
460	close (pipedes[STDOUT_FILENO]);
461
462
463	#if defined(WITH_PGP)
464	if (mode == 0)
465	{
466	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
467	{
468	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
469	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
470	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
471	}
472	}
473	#else
474	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
475	{
476	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
477	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
478	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
479	}
480	#endif
481
482	/* don't leak file descriptors
483	*/
484	sh_unix_closeall (3, -1); /* in child process */
485
486	freopen(_("/dev/null"), "r+", stderr);
487
488	/* We should become privileged if SUID,
489	* to be able to read the keyring.
490	* We have checked that gpg is OK,
491	* AND that only a trusted user could overwrite
492	* gpg.
493	*/
494	memset (skey, '\0', sizeof(sh_key_t));
495	aud_setuid(FIL__, __LINE__, geteuid());
496
497	PDBGC_OPEN;
498	PDBGC_D((int)getuid());
499	PDBGC_D((int)geteuid());
500
501	{
502	int i = 0;
503	while (arg[i] != NULL)
504	{
505	PDBGC_S(arg[i]);
506	++i;
507	}
508	}
509	PDBGC_CLOSE;
510
511	/* exec the program */
512
513	#if defined(__linux__) && defined(HAVE_GPG_CHECKSUM)
514	/*
515	* -- emulate an fexecve with checksum testing
516	*/
517	#if defined(WITH_PGP)
518	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_NOPRIV);
519	#else
520	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_NOPRIV);
521	#endif
522
523	if (0 != sh_gpg_checksum(checkfd, 0))
524	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
525
526	pfd = get_the_fd(checkfd);
527	sl_snprintf(pname, sizeof(pname), _("/proc/self/fd/%d"), pfd);
528	if (0 == access(pname, R_OK\|X_OK)) /* flawfinder: ignore */
529
530	{
531	fcntl (pfd, F_SETFD, FD_CLOEXEC);
532	retry_aud_execve (FIL__, __LINE__, pname, arg, envp);
533
534	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
535	pname);
536	/* failed
537	*/
538	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
539	}
540
541	/* procfs not working, go ahead
542	*/
543	sl_close(checkfd);
544	#endif
545
546	#if defined(HAVE_GPG_CHECKSUM)
547	/* This is an incredibly ugly kludge to prevent an attacker
548	* from knowing when it is safe to slip in a fake executable
549	* between the integrity check and the execve
550	*/
551	myrand = (int) taus_get (&(skey->rng0[0]), &(skey->rng1[0]),
552	&(skey->rng2[0]));
553	myrand = (myrand < 0) ? (-myrand) : myrand;
554	myrand = (myrand % 32) + 2;
555
556	for (i = 0; i < myrand; ++i)
557	{
558	#if defined(WITH_PGP)
559	checkfd = sl_open_fastread(DEFAULT_PGP_PATH, SL_NOPRIV);
560	#else
561	checkfd = sl_open_fastread(DEFAULT_GPG_PATH, SL_NOPRIV);
562	#endif
563	if (0 != sh_gpg_checksum(checkfd, 0)) {
564	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
565	}
566	sl_close(checkfd);
567	}
568	#endif
569
570
571	#if defined(WITH_GPG)
572	retry_aud_execve (FIL__, __LINE__, DEFAULT_GPG_PATH, arg, envp);
573	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
574	DEFAULT_GPG_PATH);
575	#elif defined(WITH_PGP)
576	retry_aud_execve (FIL__, __LINE__, DEFAULT_PGP_PATH, arg, envp);
577	#endif
578
579	/* failed
580	*/
581	TPT(((0), FIL__, __LINE__, _("msg=<execve failed>\n")));
582	dlog(1, FIL__, __LINE__, _("Unexpected error: execve failed\n"));
583	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
584	}
585
586	/* parent
587	*/
588
589	if (envp[0] != NULL)
590	free(envp[0]);
591
592	close (pipedes[STDOUT_FILENO]);
593	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
594	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFL, O_NONBLOCK);
595
596	outf = fdopen (pipedes[STDIN_FILENO], "r");
597
598	if (outf == NULL)
599	{
600	aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
601	close (pipedes[STDOUT_FILENO]);
602	waitpid (source->pid, NULL, 0);
603	source->pid = 0;
604	SL_RETURN( (NULL), _("sh_gpg_popen"));
605	}
606
607	SL_RETURN( (outf), _("sh_gpg_popen"));
608	}
609
610
611	static int sh_gpg_pclose (sh_gpg_popen_t *source)
612	{
613	int status = 0;
614
615	SL_ENTER(_("sh_gpg_pclose"));
616
617	status = fclose(source->pipe);
618	if (status)
619	SL_RETURN( (-1), _("sh_gpg_pclose"));
620
621	if (waitpid(source->pid, NULL, 0) != source->pid)
622	status = -1;
623
624	source->pipe = NULL;
625	source->pid = 0;
626	SL_RETURN( (status), _("sh_gpg_pclose"));
627	}
628
629	static
630	int sh_gpg_check_file_sign(int fd, char * sign_id, char * sign_fp,
631	char * homedir, int whichfile)
632	{
633	struct stat buf;
634	char line[256];
635	sh_gpg_popen_t source;
636	int have_id = BAD, have_fp = BAD, status = 0;
637	#ifdef WITH_PGP
638	char *ptr;
639	#endif
640
641	#ifdef HAVE_GPG_CHECKSUM
642	SL_TICKET checkfd;
643	#endif
644
645	SL_ENTER(_("sh_gpg_check_file_sign"));
646
647	/* check whether GnuPG exists and has the correct checksum
648	*/
649	#if defined(WITH_GPG)
650
651	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
652	TPT(((0), FIL__, __LINE__, _("msg=<gpg is %s>\n"), DEFAULT_GPG_PATH));
653
654	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_GPG_PATH, &buf))
655	{
656	status = errno;
657	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
658	sh_error_message(status), DEFAULT_GPG_PATH);
659	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
660	}
661
662	if (0 != tf_trust_check (DEFAULT_GPG_PATH, SL_YESPRIV))
663	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
664
665	#ifdef HAVE_GPG_CHECKSUM
666	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_YESPRIV);
667
668	if (0 != sh_gpg_checksum(checkfd, 1))
669	{
670	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
671	_("Checksum mismatch"),
672	_("gpg_check_file_sign"));
673	sl_close(checkfd);
674	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
675	}
676	sl_close(checkfd);
677	#endif
678
679	#elif defined(WITH_PGP)
680
681	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
682	TPT(((0), FIL__, __LINE__, _("msg=<pgp is %s>\n"), DEFAULT_PGP_PATH));
683
684	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_PGP_PATH, &buf))
685	{
686	status = errno;
687	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
688	sh_error_message(status), DEFAULT_PGP_PATH);
689	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
690	}
691	if (0 != tf_trust_check (DEFAULT_PGP_PATH, SL_YESPRIV))
692	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
693
694	#ifdef HAVE_GPG_CHECKSUM
695	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_YESPRIV);
696
697	if (0 != sh_gpg_checksum(checkfd, 1))
698	{
699	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
700	_("Checksum mismatch"),
701	_("gpg_check_file_sign"));
702	sl_close(checkfd);
703	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
704	}
705	sl_close(checkfd);
706	#endif
707
708	#endif
709
710	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe to check signature>\n")));
711
712	fflush(NULL);
713
714	source.pipe = sh_gpg_popen ( &source, fd, 0, NULL, homedir );
715
716	if (NULL == source.pipe)
717	{
718	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
719	_("Could not open pipe"),
720	_("gpg_check_file_sign"));
721	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
722	}
723
724	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
725
726	xagain:
727
728	errno = 0;
729
730	while (NULL != fgets(line, sizeof(line), source.pipe))
731	{
732
733	TPT(((0), FIL__, __LINE__, _("msg=<gpg out: %s>\n"), line));
734	if (line[strlen(line)-1] == '\n')
735	line[strlen(line)-1] = ' ';
736	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
737	line,
738	_("gpg_check_file_sign"));
739
740	if (sl_strlen(line) < 18)
741	continue;
742	#if defined(WITH_GPG)
743	/* Sun May 27 18:40:05 CEST 2001
744	*/
745	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6) \|\|
746	0 == sl_strncmp(_("ERRSIG"), &line[9], 6) \|\|
747	0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6) \|\|
748	0 == sl_strncmp(_("NODATA"), &line[9], 6) \|\|
749	0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6))
750	{
751	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6)) {
752	dlog(1, FIL__, __LINE__,
753	_("%s file is signed, but the signature is invalid."),
754	((whichfile == 1) ? _("Configuration") : _("Database")));
755	}
756	else if (0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6)) {
757	dlog(1, FIL__, __LINE__,
758	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
759	((whichfile == 1) ? _("Configuration") : _("Database")),
760	homedir);
761	}
762	else if (0 == sl_strncmp(_("ERRSIG"), &line[9], 6)) {
763	dlog(1, FIL__, __LINE__,
764	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
765	((whichfile == 1) ? _("Configuration") : _("Database")),
766	homedir);
767	}
768	else if (0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6)) {
769	dlog(1, FIL__, __LINE__,
770	_("%s file is signed, but the public key to verify the signature has expired."),
771	((whichfile == 1) ? _("Configuration") : _("Database")));
772	}
773	else if (0 == sl_strncmp(_("NODATA"), &line[9], 6)) {
774	dlog(1, FIL__, __LINE__,
775	_("%s file is not signed."),
776	((whichfile == 1) ? _("Configuration") : _("Database")));
777	}
778
779	have_fp = BAD; have_id = BAD;
780	break;
781	}
782	if (0 == sl_strncmp(_("GOODSIG"), &line[9], 7))
783	{
784	sl_strlcpy (sign_id, &line[25], SH_MINIBUF+1);
785	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing '"' */
786	have_id = GOOD;
787	}
788	if (0 == sl_strncmp(_("VALIDSIG"), &line[9], 8))
789	{
790	strncpy (sign_fp, &line[18], 40);
791	sign_fp[40] = '\0';
792	have_fp = GOOD;
793	}
794	#elif defined(WITH_PGP)
795	if (0 == sl_strncmp(_("Bad signature"), line, 13) \|\|
796	0 == sl_strncmp(_("Error"), line, 5) \|\|
797	0 == sl_strncmp(_("Malformed"), line, 9) \|\|
798	0 == sl_strncmp(_("WARNING"), line, 7) \|\|
799	0 == sl_strncmp(_("ERROR"), line, 5)
800	)
801	{
802	have_fp = BAD; have_id = BAD;
803	break;
804	}
805	if (0 == sl_strncmp(_("Good signature"), line, 14))
806	{
807	ptr = strchr ( line, '"');
808	++ptr;
809	sl_strlcpy (sign_id, ptr, SH_MINIBUF+1);
810	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing dot */
811	sign_id[sl_strlen(sign_id)-2] = '\0'; /* remove trailing '"' */
812	have_id = GOOD;
813	}
814	#endif
815	}
816
817	if (ferror(source.pipe) && errno == EAGAIN)
818	{
819	clearerr(source.pipe);
820	goto xagain;
821	}
822
823	sh_gpg_pclose (&source);
824
825	TPT(((0), FIL__, __LINE__, _("msg=<Close pipe>\n")));
826
827	#ifdef WITH_PGP
828	/* get the fingerprint */
829
830	source.pipe = sh_gpg_popen ( &source, fd, 1, sign_id, homedir);
831	if (NULL == source.pipe)
832	{
833	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
834	_("Could not open pipe for fp"),
835	_("gpg_check_file_sign"));
836	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
837	}
838
839	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
840
841	yagain:
842
843	errno = 0;
844
845	while (NULL != fgets(line, sizeof(line), source.pipe))
846	{
847	if (line[strlen(line)-1] == '\n')
848	line[strlen(line)-1] = ' ';
849	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
850	line,
851	_("gpg_check_file_sign"));
852
853	if (sl_strlen(line) < 18)
854	continue;
855	ptr = strtok (line, " ");
856	while (ptr)
857	{
858	ptr = strtok (NULL, " ");
859	if (ptr && 0 == sl_strncmp (ptr, _("fingerprint"), 11))
860	{
861	ptr = strtok (NULL, " "); /* to '=' */
862	sign_fp[0] = '\0';
863	while (ptr)
864	{
865	ptr = strtok (NULL, " "); /* part of fingerprint */
866	sl_strlcat (sign_fp, ptr, SH_MINIBUF+1);
867	}
868	/* sign_fp[sl_strlen(sign_fp)-1] = '\0'; remove trailing '\n' */
869	if (sl_strlen(sign_fp) > 0)
870	have_fp = GOOD;
871	break;
872	}
873	}
874	}
875
876	if (ferror(source.pipe) && errno == EAGAIN)
877	{
878	clearerr(source.pipe);
879	goto yagain;
880	}
881
882	sh_gpg_pclose (&source);
883	#endif
884
885	if (have_id == GOOD)
886	{
887	TPT(((0), FIL__, __LINE__, _("msg=<Got signator ID>\n")));
888	;
889	}
890	if (have_fp == GOOD)
891	{
892	TPT(((0), FIL__, __LINE__, _("msg=<Got fingerprint>\n")));
893	;
894	}
895
896	if (have_id == GOOD && have_fp == GOOD)
897	SL_RETURN( SH_GPG_OK, _("sh_gpg_check_file_sign"));
898	else
899	{
900	if (have_id == BAD)
901	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
902	_("No good signature"),
903	_("gpg_check_file_sign"));
904	else
905	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
906	_("No fingerprint for key"),
907	_("gpg_check_file_sign"));
908	SL_RETURN( SH_GPG_BADSIGN, _("sh_gpg_check_file_sign"));
909	}
910	}
911
912	int get_the_fd(SL_TICKET file_1);
913
914	int sh_gpg_check_sign (long file_1, long file_2, int what)
915	{
916	int status = SH_GPG_BAD;
917	int fd1 = 0;
918	int fd2 = 0;
919	static int smsg = S_FALSE;
920	char * tmp;
921	char * tmp2;
922
923	char * homedir = sh.effective.home;
924	#if defined(SH_WITH_SERVER)
925	struct passwd * tempres;
926	#endif
927	#ifdef USE_FINGERPRINT
928	#include "sh_gpg_fp.h"
929	#endif
930
931	SL_ENTER(_("sh_gpg_check_sign"));
932
933
934	if (what == 0 \|\| what == 1)
935	fd1 = get_the_fd(file_1);
936	if (what == 0 \|\| what == 2)
937	fd2 = get_the_fd(file_2);
938
939
940	if (fd1 < 0 \|\| fd2 < 0)
941	{
942	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
943	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
944	dlog(1, FIL__, __LINE__,
945	_("This looks like an unexpected internal error.\n"));
946	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1, sh.prg_name);
947	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
948	SL_RETURN( (-1), _("sh_gpg_check_sign"));
949	}
950
951	if (what == 0 \|\| what == 1)
952	{
953	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
954	#if defined(SH_WITH_SERVER)
955	tempres = getpwnam(DEFAULT_IDENT);
956	if (!tempres)
957	tempres = sh_getpwnam(DEFAULT_IDENT);
958	if ((tempres != NULL) && (0 == sl_ret_euid()))
959	{
960	/* privileges not dropped yet*/
961	homedir = tempres->pw_dir;
962	}
963	#endif
964	status = sh_gpg_check_file_sign(fd1, gp.conf_id, gp.conf_fp, homedir, 1);
965	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGUSR: \|%s\|>\n"), gp.conf_id));
966	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGFP: \|%s\|>\n"), gp.conf_fp));
967	}
968
969	if ((what == 0 && SH_GPG_OK == status) \|\| what == 2)
970	{
971	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
972	#if defined(SH_WITH_SERVER)
973	tempres = getpwnam(DEFAULT_IDENT);
974	if (!tempres)
975	tempres = sh_getpwnam(DEFAULT_IDENT);
976	if ((tempres != NULL) && (0 == sl_ret_euid()))
977	{
978	/* privileges not dropped yet*/
979	homedir = tempres->pw_dir;
980	}
981	#endif
982	status = sh_gpg_check_file_sign(fd2, gp.data_id, gp.data_fp, homedir, 2);
983	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGUSR: \|%s\|>\n"), gp.data_id));
984	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGFP: \|%s\|>\n"), gp.data_fp));
985	}
986
987	if (SH_GPG_OK == status && what == 1)
988	{
989	#ifdef USE_FINGERPRINT
990	if ((sl_strcmp(SH_GPG_FP, gp.conf_fp) == 0))
991	{
992	int i;
993
994	for(i = 0; i < (int) sl_strlen(gp.conf_fp); ++i)
995	{
996	if (gpgfp[i] != gp.conf_fp[i])
997	{
998	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0,
999	MSG_E_GPG_FP,
1000	gpgfp, gp.conf_fp);
1001	break;
1002	}
1003	}
1004
1005	if (smsg == S_FALSE)
1006	{
1007	tmp = sh_util_safe_name(gp.conf_id);
1008	sh_gpg_fill_startup (__LINE__,
1009	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1010	sh.prg_name, sh.real.uid,
1011	(sh.flag.hidefile == S_TRUE) ?
1012	_("(hidden)") : file_path('C', 'R'),
1013	tmp,
1014	gp.conf_fp);
1015	SH_FREE(tmp);
1016	}
1017	smsg = S_TRUE;
1018	SL_RETURN(0, _("sh_gpg_check_sign"));
1019	}
1020	else
1021	{
1022	/* fp mismatch
1023	*/
1024	dlog(1, FIL__, __LINE__,
1025	_("The fingerprint of the signing key: %s\ndoes not match the compiled-in fingerprint: %s.\nTherefore the signature could not be verified.\n"),
1026	gp.conf_fp, SH_GPG_FP);
1027	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
1028	_("Fingerprint mismatch"),
1029	_("gpg_check_sign"));
1030	status = SH_GPG_BADSIGN;
1031	}
1032	#else
1033	if (smsg == S_FALSE)
1034	{
1035	tmp = sh_util_safe_name(gp.conf_id);
1036	sh_gpg_fill_startup (__LINE__,
1037	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1038	sh.prg_name, sh.real.uid,
1039	(sh.flag.hidefile == S_TRUE) ?
1040	_("(hidden)") : file_path('C', 'R'),
1041	tmp,
1042	gp.conf_fp);
1043	SH_FREE(tmp);
1044	}
1045	smsg = S_TRUE;
1046	SL_RETURN(0, _("sh_gpg_check_sign"));
1047	#endif
1048	}
1049
1050	else if (SH_GPG_OK == status && (what == 2 \|\| what == 0))
1051	{
1052	if ((sl_strcmp(gp.data_id, gp.conf_id) == 0) &&
1053	(sl_strcmp(gp.data_fp, gp.conf_fp) == 0))
1054	{
1055	SL_RETURN(0, _("sh_gpg_check_sign"));
1056	}
1057	else
1058	{
1059	/* ID or fp not equal
1060	*/
1061	dlog(1, FIL__, __LINE__,
1062	_("The fingerprint or ID of the signing key is not the same for the\nconfiguration file and the file signature database.\nTherefore the signature could not be verified.\n"));
1063	tmp = sh_util_safe_name (gp.conf_id);
1064	tmp2 = sh_util_safe_name (gp.data_id);
1065	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH2,
1066	sh.prg_name, sh.real.uid,
1067	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('C', 'R'),
1068	tmp, gp.conf_fp,
1069	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('D', 'R'),
1070	tmp2, gp.data_fp);
1071	SH_FREE(tmp);
1072	SH_FREE(tmp2);
1073	}
1074	}
1075
1076	if (status != SH_GPG_OK)
1077	{
1078	uid_t e_uid = sl_ret_euid();
1079	char * e_home = sh.effective.home;
1080
1081	#if defined(SH_WITH_SERVER)
1082	struct passwd * e_tempres = getpwnam(DEFAULT_IDENT);
1083	if (!e_tempres)
1084	e_tempres = sh_getpwnam(DEFAULT_IDENT);
1085	if ((e_tempres != NULL) && (0 == sl_ret_euid()))
1086	{
1087	/* privileges not dropped yet */
1088	e_uid = e_tempres->pw_uid;
1089	e_home = e_tempres->pw_dir;
1090	}
1091	#endif
1092	dlog(1, FIL__, __LINE__,
1093	_("The signature of the configuration file or the file signature database\ncould not be verified. Possible reasons are:\n - gpg binary (%s) not found\n - invalid signature\n - the signature key is not in the private keyring of UID %d,\n - there is no keyring in %s/.gnupg, or\n - the file is not signed - did you move /filename.asc to /filename ?\nTo create a signed file, use (remove old signatures before):\n gpg -a --clearsign --not-dash-escaped FILE\n mv FILE.asc FILE\n"),
1094	#if defined(WITH_GPG)
1095	DEFAULT_GPG_PATH,
1096	#else
1097	DEFAULT_PGP_PATH,
1098	#endif
1099	(int) e_uid, e_home);
1100	}
1101
1102	TPT(((0), FIL__, __LINE__, _("msg=<Status = %d>\n"), status));
1103
1104	sh_error_handle((-1), FIL__, __LINE__, status, MSG_EXIT_ABORT1, sh.prg_name);
1105	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1106
1107	return (-1); /* make compiler happy */
1108	}
1109
1110	/* #ifdef WITH_GPG */
1111	#endif
1112
1113
1114
1115
1116
1117
1118
1119

Note: See TracBrowser for help on using the repository browser.

Download in other formats: