source: trunk/src/sh_kern.c@ 183

Last change on this file since 183 was 167, checked in by katerina, 17 years ago

First parts of changes for MODI_TXT
File size: 48.6 KB
RevLine 
[1]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 2001 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21#include "config_xor.h"
22
23#define SH_SYSCALL_CODE
24
25
26#include <stdio.h>
27#include <stdlib.h>
28#include <string.h>
29#include <sys/types.h>
30#include <sys/stat.h>
31#include <fcntl.h>
32#include <unistd.h>
33#include <errno.h>
34#include <limits.h>
35#include <sys/wait.h>
36#include <signal.h>
[41]37#include <sys/mman.h>
[1]38
39
40#ifdef SH_USE_KERN
41
42#undef FIL__
43#define FIL__ _("sh_kern.c")
44
45#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
46
47#if TIME_WITH_SYS_TIME
48#include <sys/time.h>
49#include <time.h>
50#else
51#if HAVE_SYS_TIME_H
52#include <sys/time.h>
53#else
54#include <time.h>
55#endif
56#endif
57
58
59#include "samhain.h"
[131]60#include "sh_pthread.h"
[1]61#include "sh_utils.h"
62#include "sh_error.h"
63#include "sh_modules.h"
64#include "sh_kern.h"
65#include "sh_ks_xor.h"
66
67#include "sh_unix.h"
68#include "sh_hash.h"
69
70
71
72sh_rconf sh_kern_table[] = {
73 {
74 N_("severitykernel"),
75 sh_kern_set_severity
76 },
77 {
78 N_("kernelcheckactive"),
79 sh_kern_set_activate
80 },
81 {
82 N_("kernelcheckinterval"),
83 sh_kern_set_timer
84 },
85 {
86 N_("kernelcheckidt"),
87 sh_kern_set_idt
88 },
89 {
90 N_("kernelsystemcall"),
91 sh_kern_set_sc_addr
92 },
93 {
94 N_("kernelsyscalltable"),
95 sh_kern_set_sct_addr
96 },
97 {
98 N_("kernelprocrootlookup"),
99 sh_kern_set_proc_root_lookup
100 },
101 {
102 N_("kernelprocrootiops"),
103 sh_kern_set_proc_root_iops
104 },
105 {
106 N_("kernelprocroot"),
107 sh_kern_set_proc_root
108 },
109 {
110 NULL,
111 NULL
112 },
113};
114
115
116static time_t lastcheck;
117static int ShKernActive = S_TRUE;
118static int ShKernInterval = 300;
119static int ShKernSeverity = SH_ERR_SEVERE;
120static int ShKernDelay = 100; /* milliseconds */
121static int ShKernIDT = S_TRUE;
122
123/* The address of system_call
124 */
125#ifdef SH_SYS_CALL_ADDR
126static unsigned long system_call_addr = SH_SYS_CALL_ADDR;
127#else
128static unsigned long system_call_addr = 0;
129#endif
130
131/* The address of the sys_call_table
132 */
133#ifdef SH_SYS_CALL_TABLE
134static unsigned int kaddr = SH_SYS_CALL_TABLE;
135#else
136static unsigned int kaddr = 0;
137#endif
138
139#ifdef PROC_ROOT_LOC
140static unsigned long proc_root = PROC_ROOT_LOC;
141#else
142static unsigned long proc_root = 0;
143#endif
144#ifdef PROC_ROOT_IOPS_LOC
145static unsigned long proc_root_iops = PROC_ROOT_IOPS_LOC;
146#else
147static unsigned long proc_root_iops = 0;
148#endif
149#ifdef PROC_ROOT_LOOKUP_LOC
150static unsigned long proc_root_lookup = PROC_ROOT_LOOKUP_LOC;
151#else
152static unsigned long proc_root_lookup = 0;
153#endif
154
[93]155/* This is the module 'reconfigure' function, which is a no-op.
156 */
[1]157int sh_kern_null()
158{
159 return 0;
160}
161
[93]162#define SH_KERN_DBPUSH 0
163#define SH_KERN_DBPOP 1
[1]164
165char * sh_kern_db_syscall (int num, char * prefix,
[93]166 void * in_name, unsigned long * addr,
[1]167 unsigned int * code1, unsigned int * code2,
168 int * size, int direction)
169{
[83]170 char path[128];
171 char * p = NULL;
172 unsigned long x1 = 0, x2 = 0;
173 unsigned char * name = (unsigned char *) in_name;
[1]174
175 sl_snprintf(path, 128, "K_%s_%04d", prefix, num);
176
[93]177 if (direction == SH_KERN_DBPUSH)
[1]178 {
179 x1 = *code1;
180 x2 = *code2;
181
[93]182 sh_hash_push2db (path, *addr, x1, x2,
[1]183 name, (name == NULL) ? 0 : (*size));
184 }
185 else
186 {
[93]187 p = sh_hash_db2pop (path, addr, &x1, &x2, size);
[1]188 *code1 = (unsigned int) x1;
189 *code2 = (unsigned int) x2;
190 }
191 return p;
192}
[93]193
194static char * sh_kern_pathmsg (char * msg, size_t msg_len,
195 int num, char * prefix,
196 unsigned char * old, size_t old_len,
197 unsigned char * new, size_t new_len)
198{
199 size_t k;
200 char tmp[128];
201 char *p;
202 char *linkpath_old;
203 char *linkpath_new;
[137]204 char i2h[2];
[93]205
206#ifdef SH_USE_XML
207 sl_snprintf(tmp, sizeof(tmp), _("path=\"K_%s_%04d\" "),
208 prefix, num);
209#else
210 sl_snprintf(tmp, sizeof(tmp), _("path=<K_%s_%04d> "),
211 prefix, num);
212#endif
213 sl_strlcpy(msg, tmp, msg_len);
214
215 if (SL_TRUE == sl_ok_muls(old_len, 2) &&
216 SL_TRUE == sl_ok_adds(old_len * 2, 1))
217 linkpath_old = SH_ALLOC(old_len * 2 + 1);
218 else
219 return msg;
220
221 if (SL_TRUE == sl_ok_muls(new_len, 2) &&
222 SL_TRUE == sl_ok_adds(new_len * 2, 1))
223 linkpath_new = SH_ALLOC(new_len * 2 + 1);
224 else
225 return msg;
226
227 for (k = 0; k < old_len; ++k)
228 {
[137]229 p = sh_util_charhex (old[k], i2h);
[93]230 linkpath_old[2*k] = p[0];
231 linkpath_old[2*k+1] = p[1];
232 linkpath_old[2*k+2] = '\0';
233 }
234
235 for (k = 0; k < new_len; ++k)
236 {
[137]237 p = sh_util_charhex (new[k], i2h);
[93]238 linkpath_new[2*k] = p[0];
239 linkpath_new[2*k+1] = p[1];
240 linkpath_new[2*k+2] = '\0';
241
242}
243#ifdef SH_USE_XML
244 sl_strlcat(msg, _("link_old=\""), msg_len);
245 sl_strlcat(msg, linkpath_old, msg_len);
246 sl_strlcat(msg, _("\" link_new=\""), msg_len);
247 sl_strlcat(msg, linkpath_new, msg_len);
248 sl_strlcat(msg, _("\""), msg_len);
249#else
250 sl_strlcat(msg, _("link_old=<"), msg_len);
251 sl_strlcat(msg, linkpath_old, msg_len);
252 sl_strlcat(msg, _(">, link_new=<"), msg_len);
253 sl_strlcat(msg, linkpath_new, msg_len);
254 sl_strlcat(msg, _(">"), msg_len);
255#endif
256
257 SH_FREE(linkpath_old);
258 SH_FREE(linkpath_new);
259
260 return msg;
261}
[1]262
263#ifdef HOST_IS_LINUX
264
[93]265/*
266 * Interrupt Descriptor Table
267 */
[162]268#ifdef HAVE_ASM_SEGMENT_H
[93]269#include <asm/segment.h>
[162]270#endif
[93]271
272#define SH_MAXIDT 256
273
274static unsigned char sh_idt_table[SH_MAXIDT * 8];
275
276static char * sh_strseg(unsigned short segment)
[1]277{
[93]278 switch (segment) {
[162]279#ifdef __KERNEL_CS
[93]280 case __KERNEL_CS:
281 return _("KERNEL_CS");
[162]282#endif
283#ifdef __KERNEL_DS
[93]284 case __KERNEL_DS:
285 return _("KERNEL_DS");
[162]286#endif
287#ifdef __USER_CS
[93]288 case __USER_CS:
289 return _("USER_CS");
[162]290#endif
291#ifdef __USER_DS
[93]292 case __USER_DS:
293 return _("USER_DS");
[162]294#endif
[93]295 default:
296 return _("unknown");
297 }
298}
299
300
301static int sh_kern_data_init ()
302{
[1]303 unsigned long store0 = 0;
304 unsigned int store1 = 0, store2 = 0;
305 int datasize, i, j;
306 char * databuf;
307
308 /* system_call code
309 */
310 databuf = sh_kern_db_syscall (0, _("system_call"),
311 NULL, &store0, &store1, &store2,
[93]312 &datasize, SH_KERN_DBPOP);
[1]313 if (datasize == sizeof(system_call_code))
314 {
315 memcpy (system_call_code, databuf, sizeof(system_call_code));
316 SH_FREE(databuf);
317 }
318 else
319 {
320 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
321 _("system_call_code not found in database"),
322 _("sh_kern_data_init"));
323 return -1;
324 }
325
326 /* syscall address and code
327 */
328 for (i = 0; i < SH_MAXCALLS; ++i)
329 {
330 databuf = sh_kern_db_syscall (i, _("syscall"),
331 NULL, &store0, &store1, &store2,
[93]332 &datasize, SH_KERN_DBPOP);
[1]333 sh_syscalls[i].addr = store0;
334 if (store0 == 0) {
335 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, i, MSG_E_SUBGEN,
336 _("syscall address not found in database"),
337 _("sh_kern_data_init"));
338 return -1;
339 }
[93]340
[1]341 sh_syscalls[i].code[0] = (unsigned int) store1;
342 sh_syscalls[i].code[1] = (unsigned int) store2;
343 if ((store1 == 0) || (store2 == 0)) {
344 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, i, MSG_E_SUBGEN,
345 _("syscall code not found in database"),
346 _("sh_kern_data_init"));
347 }
[93]348
[1]349 if (databuf != NULL) {
350 SH_FREE(databuf);
351 }
352
353 }
354
355 if (ShKernIDT == S_TRUE)
356 {
357 for (j = 0; j < SH_MAXIDT; ++j)
358 {
359 databuf = sh_kern_db_syscall (j, _("idt_table"),
360 NULL,
361 &store0, &store1, &store2,
[93]362 &datasize, SH_KERN_DBPOP);
[1]363 if (datasize == 8) {
364 memcpy(&idt_table[j*8], databuf, 8);
365 SH_FREE(databuf);
366 } else {
367 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, j, MSG_E_SUBGEN,
368 _("idt table not found in database"),
369 _("sh_kern_data_init"));
370 return -1;
371 }
372 }
373 }
374
375 return 0;
376}
377
[83]378
379/*
380 * Defined in include/linux/fs.h
381 */
382
383/* Here. we are only interested in 'lookup'. I.e. the struct
384 * must be <= the real one, and 'lookup' must be at the
385 * correct position.
386 */
[1]387struct inode_operations {
388 int (*create) (int *,int *,int);
389 int * (*lookup) (int *,int *);
390 int (*link) (int *,int *,int *);
391 int (*unlink) (int *,int *);
392 int (*symlink) (int *,int *,const char *);
393 int (*mkdir) (int *,int *,int);
394 int (*rmdir) (int *,int *);
395 int (*mknod) (int *,int *,int,int);
396 int (*rename) (int *, int *,
397 int *, int *);
[22]398 /* flawfinder: ignore */
[1]399 int (*readlink) (int *, char *,int);
400 int (*follow_link) (int *, int *);
401 void (*truncate) (int *);
402 int (*permission) (int *, int);
403 int (*revalidate) (int *);
404 /*
405 int (*setattr) (int *, int *);
406 int (*getattr) (int *, int *);
407 int (*setxattr) (int *, const char *, void *, size_t, int);
408 ssize_t (*getxattr) (int *, const char *, void *, size_t);
409 ssize_t (*listxattr) (int *, char *, size_t);
410 int (*removexattr) (int *, const char *);
411 */
412};
413
[83]414/*
415 * this one is just for dummy purposes
[51]416 */
[1]417struct file_operations {
418 int (*create) (int *,int *,int);
419};
420
[83]421/* Defined in include/linux/proc_fs.h
422 * Here we are interested in the 'proc_iops' member.
423 */
[1]424struct proc_dir_entry {
425 unsigned short low_ino;
426 unsigned short namelen;
427 const char * name;
428 mode_t mode;
429 nlink_t nlink;
430 uid_t uid;
431 gid_t gid;
[51]432#if defined TWO_SIX_SEVENTEEN_PLUS
433 /* size is loff_t in 2.6.17+ kernels */
434 unsigned long dummy;
435#endif
436 unsigned long size;
[1]437 struct inode_operations * proc_iops;
438 struct file_operations * proc_fops;
439 /*
440 get_info_t *get_info;
441 struct module *owner;
442 struct proc_dir_entry *next, *parent, *subdir;
443 void *data;
444 read_proc_t *read_proc;
445 write_proc_t *write_proc;
446 atomic_t count;
447 int deleted;
448 */
449};
450
[93]451
[41]452static int sh_kern_kmem_read (int fd, unsigned long addr,
453 unsigned char * buf, int len)
454{
455 if (lseek(fd, addr, SEEK_SET) == (off_t) (-1))
456 {
457 return -1;
458 }
459 if (read(fd, buf, len) < 0)
460 {
461 return -1;
462 }
463 return 0;
464}
465
466static int sh_kern_read_data (int fd, unsigned long addr,
467 unsigned char * buf, size_t len)
468{
469 size_t moff, roff;
470 size_t sz;
471 char * kmap;
472
473 /* first, try read()
474 */
475 if (0 == sh_kern_kmem_read (fd, addr, buf, len))
476 return 0;
477
478 /* next, try mmap()
479 */
480 sz = getpagesize(); /* unistd.h */
481
482 moff = ((size_t)(addr/sz)) * sz; /* lower page boundary */
483 roff = addr - moff; /* off relative to lower address of mmapped area */
484
485 kmap = mmap(0, len+sz, PROT_READ, MAP_PRIVATE, fd, moff);/* sys/mman.h */
486
487 if (kmap == MAP_FAILED)
488 {
489 return -1;
490 }
491 memcpy (buf, &kmap[roff], len);
492 return munmap(kmap, len+sz);
493}
494
[93]495
496static int check_init (int * init_retval)
[1]497{
498 static int is_init = 0;
499
[93]500 SL_ENTER(_("check_init"));
[1]501
502 if (is_init == 0)
503 {
504 if (sh.flag.checkSum != SH_CHECK_INIT && sh.flag.update != S_TRUE)
505 {
506 if (0 == sh_kern_data_init()) {
507 is_init = 1;
508 } else {
[93]509 sh_error_handle (ShKernSeverity, FIL__, __LINE__, 1,
[1]510 MSG_E_SUBGEN,
[93]511 _("could not initialize kernel check - switching off"),
512 _("check_init") );
[1]513 ShKernActive = S_FALSE;
[93]514 *init_retval = is_init;
515 SL_RETURN( (-1), _("check_init"));
[1]516 }
517 }
518 else if ((sh.flag.checkSum == SH_CHECK_INIT ||
519 sh.flag.checkSum == SH_CHECK_CHECK) &&
520 (sh.flag.update == S_TRUE))
521 {
522 if (0 == sh_kern_data_init()) {
523 is_init = 1;
524 } else {
[93]525 sh_error_handle (SH_ERR_WARN, FIL__, __LINE__, 0,
[1]526 MSG_E_SUBGEN,
[93]527 _("no or incomplete data in baseline database for kernel check"),
528 _("check_init") );
[1]529 }
530 }
531 }
[93]532 *init_retval = is_init;
533 SL_RETURN( (0), _("check_init"));
534}
[1]535
[93]536#define SH_KERN_SIZ 512
537#define SH_KERN_SCC 256
538
539static void run_child(int kd, int mpipe[2])
540{
541 int j;
542
543 unsigned long kmem_call_table[SH_KERN_SIZ];
544 unsigned int kmem_code_table[SH_KERN_SIZ][2];
545
546 unsigned char buf[6];
547 unsigned short idt_size;
548 unsigned long idt_addr;
549
550 unsigned char new_system_call_code[SH_KERN_SCC];
551
552 struct inode_operations proc_root_inode;
553 struct proc_dir_entry proc_root_dir;
554
555 int status = close(mpipe[0]);
556
557 setpgid(0, 0);
558
559 /* Seek to the system call table (at kaddr) and read it into
560 * the kmem_call_table array
[1]561 */
[93]562 if(status == 0)
563 {
564 retry_msleep (0, ShKernDelay); /* milliseconds */
565
566 if (sh_kern_read_data (kd, kaddr,
567 (unsigned char *) &kmem_call_table,
568 sizeof(kmem_call_table)))
569 {
570 status = -2;
571 }
572 }
[1]573
[93]574 /*
575 * Seek to the system call address (at sh_syscalls[j].addr) and
576 * read first 8 bytes into the array kmem_code_table[j][] (2 * unsigned int)
577 */
578 if(status == 0)
[1]579 {
[93]580 memset(kmem_code_table, 0, sizeof(kmem_code_table));
581 for (j = 0; j < SH_MAXCALLS; ++j)
582 {
583 if (sh_syscalls[j].addr == 0UL) {
584 sh_syscalls[j].addr = kmem_call_table[j];
585 }
586
587 if (sh_syscalls[j].name == NULL ||
588 sh_syscalls[j].addr == 0UL)
589 break;
590
591 if ((sh.flag.checkSum == SH_CHECK_INIT ||
592 sh.flag.checkSum == SH_CHECK_CHECK) &&
593 (sh.flag.update == S_TRUE))
594 {
595 sh_kern_read_data (kd, kmem_call_table[j],
596 (unsigned char *) &(kmem_code_table[j][0]),
597 2 * sizeof(unsigned int));
598 }
599 else
600 {
601 sh_kern_read_data (kd, sh_syscalls[j].addr,
602 (unsigned char *) &(kmem_code_table[j][0]),
603 2 * sizeof(unsigned int));
604 }
605 }
[1]606 }
[93]607
608 if(status == 0)
609 {
610 /*
611 * Get the address and size of Interrupt Descriptor Table,
612 * and read the content into the global array sh_idt_table[]
613 */
614 __asm__ volatile ("sidt %0": "=m" (buf));
615 idt_size = *((unsigned short *) &buf[0]);
616 idt_addr = *((unsigned long *) &buf[2]);
617 idt_size = (idt_size + 1)/8;
618
619 if (idt_size > SH_MAXIDT)
620 idt_size = SH_MAXIDT;
621
622 memset(sh_idt_table, '\0', SH_MAXIDT*8);
623 sh_kern_read_data (kd, idt_addr,
624 (unsigned char *) sh_idt_table, idt_size*8);
625 }
626
627 /*
628 * Seek to the system_call address (at system_call_addr) and
629 * read first 256 bytes into new_system_call_code[]
630 *
631 * system_call_addr is defined in the include file.
632 */
633 if(status == 0)
634 {
635 sh_kern_read_data (kd, system_call_addr,
636 (unsigned char *) new_system_call_code, SH_KERN_SCC);
637 }
[1]638
[93]639 /*
640 * Seek to proc_root and read the structure.
641 * Seek to proc_root_inode_operations and get the structure.
642 */
643 if(status == 0)
644 {
645 sh_kern_read_data (kd, proc_root,
646 (unsigned char *) &proc_root_dir,
647 sizeof(proc_root_dir));
648 sh_kern_read_data (kd, proc_root_iops,
649 (unsigned char *) &proc_root_inode,
650 sizeof(proc_root_inode));
651 }
[1]652
[93]653 /*
654 * Write out data to the pipe
655 */
656 if(status == 0)
[1]657 {
[93]658 status = write(mpipe[1], &kmem_call_table, sizeof(kmem_call_table));
659
660 if(status > 0)
661 status = write(mpipe[1], &kmem_code_table, sizeof(kmem_code_table));
662
663 if(status > 0)
664 status = write(mpipe[1], &sh_idt_table, sizeof(sh_idt_table));
665
666 if(status > 0)
667 status = write(mpipe[1], new_system_call_code, SH_KERN_SCC);
668
669 if(status > 0)
670 status = write(mpipe[1], &proc_root_dir, sizeof(proc_root_dir));
671
672 if(status > 0)
673 status = write(mpipe[1], &proc_root_inode, sizeof(proc_root_inode));
[1]674 }
[93]675 _exit( (status >= 0) ? 0 : status);
676}
[1]677
678
[93]679struct sh_kernel_info {
680 unsigned long kmem_call_table[SH_KERN_SIZ];
681 unsigned int kmem_code_table[SH_KERN_SIZ][2];
682
683 unsigned char new_system_call_code[SH_KERN_SCC];
684
685 struct inode_operations proc_root_inode;
686 struct proc_dir_entry proc_root_dir;
687};
688
689static int read_from_child(pid_t mpid, int * mpipe,
690 struct sh_kernel_info * kinfo)
691{
692 int res;
693 int status;
694 long size;
695
696 /* Close reading side of pipe, and wait some milliseconds
697 */
698 close (mpipe[1]);
699 retry_msleep (0, ShKernDelay); /* milliseconds */
700
701 size = SH_KERN_SIZ * sizeof(unsigned long);
702
703 if (size != read(mpipe[0], &(kinfo->kmem_call_table), size))
704 status = -4;
705 else
706 status = 0;
707
708 if(status == 0)
[1]709 {
[93]710 size = sizeof(unsigned int) * 2 * SH_KERN_SIZ;
[1]711
[93]712 if (size != read(mpipe[0], &(kinfo->kmem_code_table), size))
713 status = -5;
714 else
715 status = 0;
716 }
717
718 if(status == 0)
719 {
720 memset(sh_idt_table, '\0', SH_MAXIDT*8);
721 if (sizeof(sh_idt_table) !=
722 read(mpipe[0], &sh_idt_table, sizeof(sh_idt_table)))
723 status = -5;
724 else
725 status = 0;
726 }
727
728 if(status == 0)
729 {
730 size = SH_KERN_SCC;
731
732 if (size != read(mpipe[0], &(kinfo->new_system_call_code), size))
733 status = -6;
734 else
735 status = 0;
736 }
737
738 if(status == 0)
739 {
740 size = sizeof (struct proc_dir_entry);
741
742 if (size != read(mpipe[0], &(kinfo->proc_root_dir), size))
743 status = -7;
744 else
745 status = 0;
746 }
747
748 if(status == 0)
749 {
750 size = sizeof (struct inode_operations);
751
752 if (size != read(mpipe[0], &(kinfo->proc_root_inode), size))
753 status = -8;
754 else
755 status = 0;
756 }
757
758 if (status < 0)
759 res = waitpid(mpid, NULL, WNOHANG|WUNTRACED);
760 else
761 {
762 res = waitpid(mpid, &status, WNOHANG|WUNTRACED);
763 if (res == 0 && 0 != WIFEXITED(status))
764 status = WEXITSTATUS(status);
765 }
766 close (mpipe[0]);
767 if (res <= 0)
768 {
769 aud_kill(FIL__, __LINE__, mpid, 9);
770 waitpid(mpid, NULL, 0);
771 }
772 return status;
773}
774
775
776static void check_idt_table(int is_init)
777{
778 int i, j;
779
780 unsigned short idt_offset_lo, idt_offset_hi, idt_selector;
781 unsigned char idt_reserved, idt_flag;
782 unsigned short sh_idt_offset_lo, sh_idt_offset_hi, sh_idt_selector;
783 unsigned char sh_idt_reserved, sh_idt_flag;
784 int dpl;
785 unsigned long idt_iaddr;
786 int sh_dpl;
787 unsigned long sh_idt_iaddr;
788 char idt_type, sh_idt_type;
789
790 unsigned long store0;
791 unsigned int store1, store2;
792 int datasize;
793 char msg[2*SH_BUFSIZE];
794
795 if (ShKernIDT == S_TRUE)
796 {
797 if (sh.flag.checkSum == SH_CHECK_INIT || sh.flag.update == S_TRUE)
[1]798 {
[93]799 datasize = 8;
800 for (j = 0; j < SH_MAXIDT; ++j)
[1]801 {
[93]802 sh_kern_db_syscall (j, _("idt_table"),
803 &sh_idt_table[j*8],
804 &store0, &store1, &store2,
805 &datasize, SH_KERN_DBPUSH);
[1]806 }
[93]807 }
[1]808
[93]809 if ((sh.flag.checkSum != SH_CHECK_INIT) ||
810 (sh.flag.update == S_TRUE && is_init == 1))
811 {
812 /* Check the Interrupt Descriptor Table
813 *
814 * Stored(old) is idt_table[]
[1]815 */
[93]816 for (j = 0; j < SH_MAXIDT; ++j)
[1]817 {
[93]818 i = j * 8;
819
820 sh_idt_offset_lo = *((unsigned short *) &sh_idt_table[i]);
821 sh_idt_selector = *((unsigned short *) &sh_idt_table[i+2]);
822 sh_idt_reserved = (unsigned char) sh_idt_table[i+4];
823 sh_idt_flag = (unsigned char) sh_idt_table[i+5];
824 sh_idt_offset_hi = *((unsigned short *) &sh_idt_table[i+6]);
825 sh_idt_iaddr = (unsigned long)(sh_idt_offset_hi << 16)
826 + sh_idt_offset_lo;
827
828 if (sh_idt_iaddr == 0)
[1]829 {
[93]830 sh_idt_table[i+2] = '\0';
831 sh_idt_table[i+3] = '\0';
832 sh_idt_table[i+5] = '\0';
[1]833
[93]834 idt_offset_lo = *((unsigned short *) &idt_table[i]);
835 idt_offset_hi = *((unsigned short *) &idt_table[i+6]);
836 idt_iaddr = (unsigned long)(idt_offset_hi << 16)
837 + idt_offset_lo;
838 if (idt_iaddr == 0)
[1]839 {
[93]840 idt_table[i+2] = '\0';
841 idt_table[i+3] = '\0';
842 idt_table[i+5] = '\0';
[1]843 }
[93]844
845 }
846
847 if (memcmp(&sh_idt_table[i], &idt_table[i], 8) != 0)
848 {
849
850 idt_offset_lo = *((unsigned short *) &idt_table[i]);
851 idt_selector = *((unsigned short *) &idt_table[i+2]);
852 idt_reserved = (unsigned char) idt_table[i+4];
853 idt_flag = (unsigned char) idt_table[i+5];
854 idt_offset_hi = *((unsigned short *) &idt_table[i+6]);
855 idt_iaddr = (unsigned long)(idt_offset_hi << 16)
856 + idt_offset_lo;
857
858 if (idt_iaddr != 0)
[1]859 {
[93]860 if (idt_flag & 64) { dpl = 3; }
861 else { dpl = 0; }
862 if (idt_flag & 1) {
863 if (dpl == 3) idt_type = 'S';
864 else idt_type = 'T'; }
865 else { idt_type = 'I'; }
[1]866 }
[93]867 else { dpl = -1; idt_type = 'U'; }
868
869 if (sh_idt_iaddr != 0)
870 {
871 if (sh_idt_flag & 64) { sh_dpl = 3; }
872 else { sh_dpl = 0; }
873 if (sh_idt_flag & 1) {
874 if (sh_dpl == 3) sh_idt_type = 'S';
875 else sh_idt_type = 'T'; }
876 else { sh_idt_type = 'I'; }
877 }
878 else { sh_dpl = -1; sh_idt_type = 'U'; }
879
880 sh_kern_pathmsg (msg, SH_BUFSIZE,
881 j, _("idt_table"),
882 &idt_table[i], 8,
883 &sh_idt_table[i], 8);
884
885 sh_error_handle (ShKernSeverity, FIL__, __LINE__,
886 0, MSG_KERN_IDT,
887 j,
888 sh_idt_iaddr, sh_strseg(sh_idt_selector),
889 (int) sh_dpl, sh_idt_type,
890 idt_iaddr, sh_strseg(idt_selector),
891 (int) dpl, idt_type, msg);
892
893 memcpy(&idt_table[i], &sh_idt_table[i], 8);
[1]894 }
895 }
[93]896 }
897 }
898}
[1]899
900
[93]901#define SYS_BUS_PCI _("/sys/bus/pci/devices")
902#include <dirent.h>
[1]903
[93]904static void check_rom (char * pcipath, char * name)
905{
906 file_type theFile;
907 char fileHash[2*(KEY_LEN + 1)];
908 int status;
909 char * tmp;
910 extern unsigned long sh_files_maskof (int class);
[1]911
[93]912 (void) sl_strlcpy (theFile.fullpath, pcipath, PATH_MAX);
913 theFile.check_mask = sh_files_maskof(SH_LEVEL_READONLY);
[162]914 theFile.check_mask &= ~(MODI_MTM|MODI_CTM|MODI_INO);
[114]915 CLEAR_SH_FFLAG_REPORTED(theFile.file_reported);
[93]916 theFile.attr_string = NULL;
[167]917 theFile.link_path = NULL;
[93]918
919 status = sh_unix_getinfo (ShDFLevel[SH_ERR_T_RO],
920 name, &theFile, fileHash, 0);
[1]921
[93]922 if (status != 0)
923 {
924 tmp = sh_util_safe_name(pcipath);
925 sh_error_handle (ShKernSeverity, FIL__, __LINE__,
926 0, MSG_E_SUBGPATH,
927 _("Could not check PCI ROM"),
928 _("check_rom"),
929 tmp);
930 SH_FREE(tmp);
[167]931 goto out;
[93]932 }
[1]933
[93]934 if ( sh.flag.checkSum == SH_CHECK_INIT )
935 {
936 sh_hash_pushdata (&theFile, fileHash);
937 }
938 else if (sh.flag.checkSum == SH_CHECK_CHECK )
939 {
940 sh_hash_compdata (SH_LEVEL_READONLY, &theFile, fileHash, NULL, -1);
941 }
[1]942
[167]943 out:
944 if (theFile.attr_string) SH_FREE(theFile.attr_string);
945 if (theFile.link_path) SH_FREE(theFile.link_path);
[93]946 return;
947}
[1]948
[93]949static void check_pci_rom (char * pcipath, char * name)
950{
951 struct stat buf;
952 int fd;
[162]953 int status;
[1]954
[93]955 if (0 == stat(pcipath, &buf))
956 {
957 /* Need to write "1" to the file to enable the ROM. Afterwards,
958 * write "0" to disable it.
959 */
960 fd = open ( pcipath, O_RDWR );
[162]961 do {
962 status = write( fd, "1", 1 );
963 } while (status < 0 && errno == EINTR);
[93]964 close ( fd );
[1]965
[93]966 check_rom(pcipath, name);
[1]967
[93]968 fd = open ( pcipath, O_RDWR );
[162]969 do {
970 status = write( fd, "0", 1 );
971 } while (status < 0 && errno == EINTR);
[93]972 close ( fd );
[1]973 }
[93]974 return;
975}
[1]976
[93]977static void check_pci()
978{
979 char pci_dir[256];
980 char * pcipath;
981 DIR * df;
982 struct dirent * entry;
983
984 sl_strlcpy(pci_dir, SYS_BUS_PCI, sizeof(pci_dir));
985
986 df = opendir(pci_dir);
987 if (df)
[1]988 {
[143]989 while (1)
990 {
991 SH_MUTEX_LOCK(mutex_readdir);
992 entry = readdir(df);
993 SH_MUTEX_UNLOCK(mutex_readdir);
[131]994
[143]995 if (entry == NULL)
996 break;
997
[93]998 if (0 == strcmp(entry->d_name, ".") &&
999 0 == strcmp(entry->d_name, ".."))
1000 continue;
1001
1002 pcipath = sh_util_strconcat(pci_dir, "/",
1003 entry->d_name, "/rom", NULL);
1004 check_pci_rom(pcipath, entry->d_name);
1005 SH_FREE(pcipath);
1006 }
[131]1007
[93]1008 closedir(df);
[1]1009 }
[93]1010}
[1]1011
[93]1012/* -- Check the proc_root inode.
1013 *
1014 * This will detect adore-ng.
1015 */
1016static void check_proc_root (struct sh_kernel_info * kinfo)
1017{
1018 struct proc_dir_entry proc_root_dir;
1019
[102]1020/* 2.6.21 (((2) << 16) + ((6) << 8) + (21)) */
1021#if SH_KERNEL_NUMBER < 132629
1022 struct inode_operations proc_root_inode;
1023
[93]1024 memcpy (&proc_root_inode, &(kinfo->proc_root_inode), sizeof(struct inode_operations));
1025
[102]1026 /* Seems that the info does not relate anymore to proc_root_lookup(?)
1027 */
[1]1028 if ( (unsigned int) *proc_root_inode.lookup != proc_root_lookup)
1029 {
1030 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_KERN_PROC,
1031 _("proc_root_inode_operations.lookup != proc_root_lookup"));
1032 }
[102]1033#endif
1034
1035 memcpy (&proc_root_dir, &(kinfo->proc_root_dir), sizeof(struct proc_dir_entry));
1036 if ( (((unsigned int) * &proc_root_dir.proc_iops) != proc_root_iops)
[83]1037 && (proc_root_dir.size != proc_root_iops)
1038 && (((unsigned int) * &proc_root_dir.proc_fops) != proc_root_iops)
1039 )
[1]1040 {
1041 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_KERN_PROC,
1042 _("proc_root.proc_iops != proc_root_inode_operations"));
1043 }
[102]1044
[93]1045 return;
1046}
[1]1047
[93]1048/* -- Check the system_call syscall gate.
1049 *
1050 * Stored(old) is system_call_code[]
1051 */
1052static void check_syscall_gate(int is_init, struct sh_kernel_info * kinfo)
1053{
1054 int i, j;
1055 unsigned long store0;
1056 unsigned int store1, store2;
1057 int datasize;
1058 int max_system_call = (SYS_CALL_LOC < 128) ? 128 : SYS_CALL_LOC;
1059 char msg[2*SH_BUFSIZE];
1060
[3]1061 if (sh.flag.checkSum == SH_CHECK_INIT || sh.flag.update == S_TRUE)
[1]1062 {
1063 store0 = 0; store1 = 0; store2 = 0;
[93]1064 datasize = SH_KERN_SCC;
[1]1065 sh_kern_db_syscall (0, _("system_call"),
[93]1066 &(kinfo->new_system_call_code), &store0, &store1, &store2,
1067 &datasize, SH_KERN_DBPUSH);
[1]1068 }
1069
1070 if ((sh.flag.checkSum != SH_CHECK_INIT) ||
1071 (sh.flag.update == S_TRUE && is_init == 1))
1072 {
1073 for (i = 0; i < (max_system_call + 4); ++i)
1074 {
[93]1075 if (system_call_code[i] != kinfo->new_system_call_code[i])
[1]1076 {
1077
[93]1078 sh_kern_pathmsg (msg, sizeof(msg),
1079 0, _("system_call"),
1080 system_call_code, SH_KERN_SCC,
1081 kinfo->new_system_call_code, SH_KERN_SCC);
[1]1082
1083 sh_error_handle (ShKernSeverity, FIL__, __LINE__,
[93]1084 0, MSG_KERN_GATE,
1085 kinfo->new_system_call_code[i], 0,
[1]1086 system_call_code[i], 0,
1087 0, _("system_call (interrupt handler)"),
1088 msg);
1089
1090 for (j = 0; j < (max_system_call + 4); ++j)
[93]1091 system_call_code[j] = kinfo->new_system_call_code[j];
[1]1092 break;
1093 }
1094 }
1095 }
[93]1096 return;
1097}
1098
1099static void check_system_calls (int is_init, struct sh_kernel_info * kinfo)
1100{
1101 int i;
1102
1103#ifdef SH_USE_LKM
1104 static int check_getdents = 0;
1105 /* #ifdef __NR_getdents64 */
1106 static int check_getdents64 = 0;
1107 /* #endif */
1108 static int copy_if_next = -1;
1109 static int copy_if_next_64 = -1;
1110#endif
1111
1112 unsigned long store0;
1113 unsigned int store1, store2;
1114 int mod_syscall_addr = 0;
1115 int mod_syscall_code = 0;
1116 UINT64 size_old = 0, size_new = 0;
1117 UINT64 mtime_old = 0, mtime_new = 0;
1118 UINT64 ctime_old = 0, ctime_new = 0;
1119 char tmp[128];
1120 char msg[2*SH_BUFSIZE];
1121 char timstr_o[32];
1122 char timstr_n[32];
1123
[3]1124 if (sh.flag.checkSum == SH_CHECK_INIT || sh.flag.update == S_TRUE)
[1]1125 {
1126 for (i = 0; i < SH_MAXCALLS; ++i)
1127 {
[93]1128 store0 = kinfo->kmem_call_table[i];
1129 store1 = kinfo->kmem_code_table[i][0]; store2 = kinfo->kmem_code_table[i][1];
[1]1130 sh_kern_db_syscall (i, _("syscall"),
1131 NULL, &store0, &store1, &store2,
[93]1132 0, SH_KERN_DBPUSH);
[1]1133 }
1134 }
1135
1136 if ((sh.flag.checkSum != SH_CHECK_INIT) ||
1137 (sh.flag.update == S_TRUE && is_init == 1))
1138 {
1139 for (i = 0; i < SH_MAXCALLS; ++i)
1140 {
1141 if (sh_syscalls[i].name == NULL /* || sh_syscalls[i].addr == 0UL */)
1142 break;
1143
1144#ifdef SH_USE_LKM
[93]1145 if (sh_syscalls[i].addr != kinfo->kmem_call_table[i])
[1]1146 {
1147 if (check_getdents == 0 &&
1148 0 == strcmp(_(sh_syscalls[i].name), _("sys_getdents")))
1149 {
1150 check_getdents = 1;
1151 sh_error_handle (SH_ERR_WARN, FIL__, __LINE__,
[93]1152 0, MSG_E_SUBGEN,
[1]1153 _("Modified kernel syscall (expected)."),
1154 _(sh_syscalls[i].name) );
1155 copy_if_next = i;
[93]1156 sh_syscalls[i].addr = kinfo->kmem_call_table[i];
[1]1157 continue;
1158 }
1159 /* #ifdef __NR_getdents64 */
1160 else if (check_getdents64 == 0 &&
1161 0 == strcmp(_(sh_syscalls[i].name),
1162 _("sys_getdents64")))
1163 {
1164 check_getdents64 = 1;
1165 sh_error_handle (SH_ERR_WARN, FIL__, __LINE__,
[93]1166 0, MSG_E_SUBGEN,
[1]1167 _("Modified kernel syscall (expected)."),
1168 _(sh_syscalls[i].name) );
1169 copy_if_next_64 = i;
[93]1170 sh_syscalls[i].addr = kinfo->kmem_call_table[i];
[1]1171 continue;
1172 }
1173 /* #endif */
1174 else
1175 {
1176 size_old = sh_syscalls[i].addr;
[93]1177 size_new = kinfo->kmem_call_table[i];
[1]1178 mod_syscall_addr = 1;
1179 }
[93]1180 sh_syscalls[i].addr = kinfo->kmem_call_table[i];
[1]1181 }
1182#else
[93]1183 if (sh_syscalls[i].addr != kinfo->kmem_call_table[i])
[1]1184 {
1185 size_old = sh_syscalls[i].addr;
[93]1186 size_new = kinfo->kmem_call_table[i];
[1]1187 mod_syscall_addr = 1;
[93]1188 sh_syscalls[i].addr = kinfo->kmem_call_table[i];
[1]1189 }
1190#endif
1191
1192
[93]1193 /* -- Check the code at syscall address
[1]1194 *
1195 * Stored(old) is sh_syscalls[]
1196 */
1197 if ( (mod_syscall_addr == 0) &&
[93]1198 ((sh_syscalls[i].code[0] != kinfo->kmem_code_table[i][0]) ||
1199 (sh_syscalls[i].code[1] != kinfo->kmem_code_table[i][1]))
[1]1200 )
1201 {
1202 mtime_old = sh_syscalls[i].code[0];
[93]1203 mtime_new = kinfo->kmem_code_table[i][0];
[1]1204 ctime_old = sh_syscalls[i].code[1];
[93]1205 ctime_new = kinfo->kmem_code_table[i][1];
[1]1206 mod_syscall_code = 1;
1207
1208#ifdef SH_USE_LKM
1209 if (i == copy_if_next)
1210 {
1211 mod_syscall_code = 0;
1212 copy_if_next = -1;
1213 }
1214 if (i == copy_if_next_64)
1215 {
1216 mod_syscall_code = 0;
1217 copy_if_next_64 = -1;
1218 }
1219#endif
1220
[93]1221 sh_syscalls[i].code[0] = kinfo->kmem_code_table[i][0];
1222 sh_syscalls[i].code[1] = kinfo->kmem_code_table[i][1];
[1]1223 }
[93]1224
1225 /* Build the error message, if something has been
[1]1226 * detected.
1227 */
1228 if ((mod_syscall_addr != 0) || (mod_syscall_code != 0))
1229 {
1230#ifdef SH_USE_XML
1231 sl_snprintf(tmp, 128, "path=\"K_%s_%04d\" ",
1232 _("syscall"), i);
1233#else
1234 sl_snprintf(tmp, 128, "path=<K_%s_%04d>, ",
1235 _("syscall"), i);
1236#endif
1237 sl_strlcpy(msg, tmp, SH_BUFSIZE);
1238
1239 if (mod_syscall_addr != 0)
1240 {
1241 sl_snprintf(tmp, 128, sh_hash_size_format(),
1242 size_old, size_new);
1243 sl_strlcat(msg, tmp, SH_BUFSIZE);
1244 }
1245 if (mod_syscall_code != 0)
1246 {
[132]1247 (void) sh_unix_gmttime (ctime_old, timstr_o, sizeof(timstr_o));
1248 (void) sh_unix_gmttime (ctime_new, timstr_n, sizeof(timstr_n));
[1]1249#ifdef SH_USE_XML
1250 sl_snprintf(tmp, 128,
1251 _("ctime_old=\"%s\" ctime_new=\"%s\" "),
1252 timstr_o, timstr_n);
1253#else
1254 sl_snprintf(tmp, 128,
1255 _("ctime_old=<%s>, ctime_new=<%s>, "),
1256 timstr_o, timstr_n);
1257#endif
1258 sl_strlcat(msg, tmp, SH_BUFSIZE);
[132]1259 (void) sh_unix_gmttime (mtime_old, timstr_o, sizeof(timstr_o));
1260 (void) sh_unix_gmttime (mtime_new, timstr_n, sizeof(timstr_n));
[1]1261#ifdef SH_USE_XML
1262 sl_snprintf(tmp, 128,
1263 _("mtime_old=\"%s\" mtime_new=\"%s\" "),
1264 timstr_o, timstr_n);
1265#else
1266 sl_snprintf(tmp, 128,
1267 _("mtime_old=<%s>, mtime_new=<%s> "),
1268 timstr_o, timstr_n);
1269#endif
1270 sl_strlcat(msg, tmp, SH_BUFSIZE);
1271 }
1272 sh_error_handle (ShKernSeverity, FIL__, __LINE__,
[93]1273 0, MSG_KERN_SYSCALL,
[1]1274 i, _(sh_syscalls[i].name), msg);
1275 mod_syscall_addr = 0;
1276 mod_syscall_code = 0;
1277 }
1278 }
1279 }
[93]1280 return;
1281}
1282
1283int sh_kern_check_internal ()
1284{
1285 int kd;
1286 int is_init;
1287 pid_t mpid;
1288 int mpipe[2];
1289 int status = 0;
[1]1290
[93]1291 struct sh_kernel_info kinfo;
1292
1293
1294 SL_ENTER(_("sh_kern_check_internal"));
1295
1296 /* -- Check whether initialisation is required; if yes, initialize.
1297 */
1298
1299 if (0 != check_init(&is_init))
[1]1300 {
[93]1301 SL_RETURN( (-1), _("sh_kern_check_internal"));
1302 }
1303
1304
1305 /* -- Open /dev/kmem and fork subprocess to read from it.
1306 */
1307
1308 if (kaddr == (unsigned int) -1) /* kaddr = address of the sys_call_table */
1309 {
1310 sh_error_handle (ShKernSeverity, FIL__, __LINE__, status, MSG_E_SUBGEN,
1311 _("no address for sys_call_table - switching off"),
1312 _("kern_check_internal") );
1313 ShKernActive = S_FALSE;
1314 SL_RETURN( (-1), _("sh_kern_check_internal"));
1315 }
1316
1317 kd = aud_open(FIL__, __LINE__, SL_YESPRIV, _("/dev/kmem"), O_RDONLY, 0);
1318
1319 if (kd < 0)
1320 {
1321 status = errno;
1322 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1323 _("error opening /dev/kmem"),
1324 _("kern_check_internal") );
1325 SL_RETURN( (-1), _("sh_kern_check_internal"));
1326 }
1327
1328 status = aud_pipe(FIL__, __LINE__, mpipe);
1329
1330 if (status == 0)
1331 {
1332 mpid = aud_fork(FIL__, __LINE__);
1333
1334 switch (mpid)
[1]1335 {
[93]1336 case -1:
1337 status = -1;
1338 break;
1339 case 0:
[1]1340
[93]1341 /* -- Child process reads /dev/kmem and writes to pipe
[1]1342 */
[93]1343 run_child(kd, mpipe);
1344 break;
[1]1345
[93]1346 /* -- Parent process reads from child via pipe
1347 */
1348 default:
1349 close(kd);
1350 status = read_from_child(mpid, mpipe, &kinfo);
1351 break;
1352 }
1353 }
[1]1354
[93]1355 if ( status < 0)
1356 {
1357 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1358 _("error reading from /dev/kmem"),
1359 _("kern_check_internal") );
1360 SL_RETURN( (-1), _("sh_kern_check_internal"));
1361 }
[1]1362
[93]1363 /* -- Check the proc_root inode.
1364 *
1365 * This will detect adore-ng.
1366 */
1367 check_proc_root( &kinfo );
[1]1368
1369
[93]1370 /* -- Check the system_call syscall gate.
1371 *
1372 * Stored(old) is system_call_code[]
1373 */
1374 check_syscall_gate( is_init, &kinfo );
[1]1375
[93]1376 /* -- Check the individual syscalls
1377 *
1378 * Stored(old) is sh_syscalls[] array.
1379 */
1380 check_system_calls ( is_init, &kinfo );
1381
1382 /* -- Check the Interrupt Descriptor Table
1383 */
1384 check_idt_table(is_init);
1385
1386 /* -- Check PCI ROM
1387 */
1388 check_pci();
1389
[1]1390 SL_RETURN( (0), _("sh_kern_check_internal"));
1391}
1392/* ifdef HOST_IS_LINUX */
1393#else
1394
[93]1395/********************************************************
1396 *
1397 * --- BSD ---
1398 *
1399 ********************************************************/
1400
[1]1401#include <err.h>
1402#include <kvm.h>
1403#include <nlist.h>
1404
1405/* not OpenBSD */
1406#if defined(HOST_IS_FREEBSD)
1407#include <sys/sysent.h>
1408#endif
1409
1410#include <sys/syscall.h>
1411#ifndef SYS_MAXSYSCALL
1412#define SYS_MAXSYSCALL 512
1413#endif
1414
1415#ifdef __OpenBSD__
1416struct proc;
1417struct sysent {
1418 short sy_narg;
1419 short sy_argsize;
1420 int (*sy_call)(struct proc *, void *, register_t *);
1421};
1422#endif
1423
1424int sh_kern_data_init ()
1425{
1426 unsigned long store0 = 0;
1427 unsigned int store1 = 0, store2 = 0;
1428 int datasize, i;
1429 char * databuf = NULL;
1430
1431 /* syscall address and code
1432 */
1433 for (i = 0; i < SH_MAXCALLS; ++i)
1434 {
1435 databuf = sh_kern_db_syscall (i, _("syscall"),
1436 NULL, &store0, &store1, &store2,
[93]1437 &datasize, SH_KERN_DBPOP);
[1]1438 sh_syscalls[i].addr = store0;
1439 if (databuf != NULL) { SH_FREE(databuf); }
1440 if (store0 == 0) {
1441 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1442 _("syscall address not found in database"),
1443 _("sh_kern_data_init"));
1444 return -1;
1445 }
1446
1447 sh_syscalls[i].code[0] = (unsigned int) store1;
1448 sh_syscalls[i].code[1] = (unsigned int) store2;
1449 if ((store1 == 0) || (store2 == 0)) {
1450 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1451 _("syscall code not found in database"),
1452 _("sh_kern_data_init"));
1453 return -1;
1454 }
1455
1456 }
1457
1458 return 0;
1459}
1460
1461int sh_kern_check_internal ()
1462{
1463 struct sysent sy;
1464 kvm_t * kd;
1465 int i;
1466 int status = -1;
1467 char errbuf[_POSIX2_LINE_MAX+1];
1468 struct nlist * sys_list;
1469 struct nlist list[2];
1470
1471 unsigned long offset = 0L;
1472 unsigned int syscall_code[2]; /* 8 bytes */
1473 unsigned long syscall_addr;
1474
1475 unsigned long store0 = 0;
1476 unsigned int store1 = 0, store2 = 0;
1477
1478 UINT64 size_old = 0, size_new = 0;
1479 UINT64 mtime_old = 0, mtime_new = 0;
1480 UINT64 ctime_old = 0, ctime_new = 0;
1481 char tmp[128];
1482 char msg[2*SH_BUFSIZE];
1483 char timstr_o[32];
1484 char timstr_n[32];
1485
1486 static int is_init = 0;
1487
1488 SL_ENTER(_("sh_kern_check_internal"));
1489
1490 if (is_init == 0)
1491 {
1492 if (sh.flag.checkSum != SH_CHECK_INIT && sh.flag.update != S_TRUE)
1493 {
1494 if (0 == sh_kern_data_init()) {
1495 is_init = 1;
1496 } else {
1497 sh_error_handle (ShKernSeverity, FIL__, __LINE__, status,
1498 MSG_E_SUBGEN,
1499 _("could not initialize - switching off"),
1500 _("kern_check_internal") );
1501 ShKernActive = S_FALSE;
1502 SL_RETURN( (-1), _("sh_kern_check_internal"));
1503 }
1504 }
1505 else if ((sh.flag.checkSum == SH_CHECK_INIT ||
1506 sh.flag.checkSum == SH_CHECK_CHECK) &&
1507 (sh.flag.update == S_TRUE))
1508 {
1509 if (0 == sh_kern_data_init()) {
1510 is_init = 1;
1511 } else {
1512 sh_error_handle (ShKernSeverity, FIL__, __LINE__, status,
1513 MSG_E_SUBGEN,
1514 _("no or incomplete data in baseline database"),
1515 _("kern_check_internal") );
1516 }
1517 }
1518 }
1519
1520 /* defined, but not used
1521 */
1522 ShKernDelay = 0;
1523
1524 list[0].n_name = "_sysent";
1525 list[1].n_name = NULL;
1526
1527 kd = kvm_openfiles(NULL, NULL, NULL, O_RDONLY, errbuf);
1528 if (!kd)
1529 {
1530 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1531 errbuf,
1532 _("kvm_openfiles") );
1533 SL_RETURN( (-1), _("sh_kern_check_internal"));
1534 }
1535
1536 i = kvm_nlist(kd, list);
1537 if (i == -1)
1538 {
1539 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1540 kvm_geterr(kd),
1541 _("kvm_nlist (_sysent)") );
1542 kvm_close(kd);
1543 SL_RETURN( (-1), _("sh_kern_check_internal"));
1544 }
1545
1546 sys_list = SH_ALLOC((SYS_MAXSYSCALL+1) * sizeof(struct nlist));
1547
1548 for (i = 0; i < SH_MAXCALLS; ++i)
1549 sys_list[i].n_name = sh_syscalls[i].name;
1550 sys_list[SH_MAXCALLS].n_name = NULL;
1551
1552 i = kvm_nlist(kd, sys_list);
1553 if (i == -1)
1554 {
1555 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1556 kvm_geterr(kd),
1557 _("kvm_nlist (syscalls)") );
1558 kvm_close(kd);
1559 SH_FREE(sys_list);
1560 SL_RETURN( (-1), _("sh_kern_check_internal"));
1561 }
1562 else if (i > 0)
1563 {
1564 sl_snprintf(tmp, 128,
1565 _("%d invalid syscalls"), i);
1566 /*
1567 for (i = 0; i < SH_MAXCALLS; ++i) {
1568 if (sys_list[i].n_type == 0 && sys_list[i].n_value == 0)
1569 fprintf(stderr, "invalid: [%3d] %s\n", i, sh_syscalls[i].name);
1570 }
1571 */
1572 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, status, MSG_E_SUBGEN,
1573 tmp,
1574 _("kvm_nlist (syscalls)") );
1575 }
1576
1577 /* Check the individual syscalls
1578 *
1579 * Stored(old) is sh_syscalls[] array.
1580 */
[3]1581 if (sh.flag.checkSum == SH_CHECK_INIT || sh.flag.update == S_TRUE)
[1]1582 {
1583 for (i = 0; i < SH_MAXCALLS; ++i)
1584 {
1585 if (sh_syscalls[i].name == NULL)
1586 {
1587 sl_snprintf(tmp, 128,
1588 _("too few entries in sh_syscalls[]: have %d, expect %d"),
1589 i, SH_MAXCALLS);
1590
1591 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1592 tmp,
1593 _("sh_kern_check_internal") );
1594 break;
1595 }
1596
1597 /* read address of syscall from sysent table
1598 */
1599 offset = list[0].n_value + (i*sizeof(struct sysent));
1600 if (kvm_read(kd, offset, &sy, sizeof(struct sysent)) < 0)
1601 {
1602 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1603 kvm_geterr(kd),
1604 _("kvm_read (syscall table)") );
1605 kvm_close(kd);
1606 SH_FREE(sys_list);
1607 SL_RETURN( (-1), _("sh_kern_check_internal"));
1608 }
1609 syscall_addr = (unsigned long) sy.sy_call;
1610 store0 = syscall_addr;
1611
1612 /* read the syscall code
1613 */
1614 if(kvm_read(kd, (unsigned int) sy.sy_call, &(syscall_code[0]),
1615 2 * sizeof(unsigned int)) < 0)
1616 {
1617 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1618 kvm_geterr(kd),
1619 _("kvm_read (syscall code)") );
1620 kvm_close(kd);
1621 SH_FREE(sys_list);
1622 SL_RETURN( (-1), _("sh_kern_check_internal"));
1623 }
1624 store1 = syscall_code[0]; store2 = syscall_code[1];
1625
1626 sh_kern_db_syscall (i, _("syscall"),
1627 NULL, &store0, &store1, &store2,
[93]1628 0, SH_KERN_DBPUSH);
[1]1629 }
1630 }
1631
1632 if ((sh.flag.checkSum != SH_CHECK_INIT) ||
1633 (sh.flag.update == S_TRUE && is_init == 1))
1634 {
1635 for (i = 0; i < SH_MAXCALLS; ++i)
1636 {
1637 if (sh_syscalls[i].name == NULL)
1638 {
1639 sl_snprintf(tmp, 128,
1640 _("too few entries in sh_syscalls[]: have %d, expect %d"),
1641 i, SH_MAXCALLS);
1642
1643 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1644 tmp,
1645 _("sh_kern_check_internal") );
1646 break;
1647 }
1648
1649 /* read address of syscall from sysent table
1650 */
1651 offset = list[0].n_value + (i*sizeof(struct sysent));
1652 if (kvm_read(kd, offset, &sy, sizeof(struct sysent)) < 0)
1653 {
1654 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1655 kvm_geterr(kd),
1656 _("kvm_read (syscall table)") );
1657 kvm_close(kd);
1658 SH_FREE(sys_list);
1659 SL_RETURN( (-1), _("sh_kern_check_internal"));
1660 }
1661 syscall_addr = (unsigned long) sy.sy_call;
1662
1663 if (sh_syscalls[i].addr != syscall_addr)
1664 {
1665#ifdef SH_USE_XML
1666 sl_snprintf(tmp, 128, "path=\"K_%s_%04d\" ",
1667 _("syscall"), i);
1668#else
1669 sl_snprintf(tmp, 128, "path=<K_%s_%04d>, ",
1670 _("syscall"), i);
1671#endif
1672 sl_strlcpy(msg, tmp, SH_BUFSIZE);
1673
1674 size_old = sh_syscalls[i].addr;
1675 size_new = syscall_addr;
1676 sl_snprintf(tmp, 128, sh_hash_size_format(),
1677 size_old, size_new);
1678 sl_strlcat(msg, tmp, SH_BUFSIZE);
1679
1680 sh_error_handle (ShKernSeverity, FIL__, __LINE__,
1681 status, MSG_KERN_SYSCALL,
1682 i, _(sh_syscalls[i].name),
1683 msg);
1684 sh_syscalls[i].addr = syscall_addr;
1685 }
1686 else
1687 {
1688 /* read the syscall code
1689 */
1690 if(kvm_read(kd, (unsigned int) sy.sy_call, &(syscall_code[0]),
1691 2 * sizeof(unsigned int)) < 0)
1692 {
1693 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1694 kvm_geterr(kd),
1695 _("kvm_read (syscall code)") );
1696 kvm_close(kd);
1697 SH_FREE(sys_list);
1698 SL_RETURN( (-1), _("sh_kern_check_internal"));
1699 }
1700
1701 if (sh_syscalls[i].code[0] != syscall_code[0] ||
1702 sh_syscalls[i].code[1] != syscall_code[1])
1703 {
1704 mtime_old = sh_syscalls[i].code[0];
1705 mtime_new = syscall_code[0];
1706 ctime_old = sh_syscalls[i].code[1];
1707 ctime_new = syscall_code[1];
1708
1709#ifdef SH_USE_XML
1710 sl_snprintf(tmp, 128, "path=\"K_%s_%04d\" ",
1711 _("syscall"), i);
1712#else
1713 sl_snprintf(tmp, 128, "path=<K_%s_%04d>, ",
1714 _("syscall"), i);
1715#endif
1716 sl_strlcpy(msg, tmp, SH_BUFSIZE);
1717
[132]1718 (void) sh_unix_gmttime (ctime_old, timstr_o, sizeof(timstr_o));
1719 (void) sh_unix_gmttime (ctime_new, timstr_n, sizeof(timstr_n));
[1]1720#ifdef SH_USE_XML
1721 sl_snprintf(tmp, 128,
1722 _("ctime_old=\"%s\" ctime_new=\"%s\" "),
1723 timstr_o, timstr_n);
1724#else
1725 sl_snprintf(tmp, 128,
1726 _("ctime_old=<%s>, ctime_new=<%s>, "),
1727 timstr_o, timstr_n);
1728#endif
1729 sl_strlcat(msg, tmp, SH_BUFSIZE);
[132]1730 (void) sh_unix_gmttime (mtime_old, timstr_o, sizeof(timstr_o));
1731 (void) sh_unix_gmttime (mtime_new, timstr_n, sizeof(timstr_n));
[1]1732#ifdef SH_USE_XML
1733 sl_snprintf(tmp, 128,
1734 _("mtime_old=\"%s\" mtime_new=\"%s\" "),
1735 timstr_o, timstr_n);
1736#else
1737 sl_snprintf(tmp, 128,
1738 _("mtime_old=<%s>, mtime_new=<%s> "),
1739 timstr_o, timstr_n);
1740#endif
1741 sl_strlcat(msg, tmp, SH_BUFSIZE);
1742
1743 sh_error_handle (ShKernSeverity, FIL__, __LINE__,
1744 status, MSG_KERN_SYSCALL,
1745 i, _(sh_syscalls[i].name),
1746 msg);
1747 sh_syscalls[i].code[0] = syscall_code[0];
1748 sh_syscalls[i].code[1] = syscall_code[1];
1749 }
1750 }
1751 }
1752 }
1753 SH_FREE(sys_list);
1754 if(kvm_close(kd) < 0)
1755 {
1756 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1757 kvm_geterr(kd),
1758 _("kvm_close") );
1759 exit(EXIT_FAILURE);
1760 }
1761
1762 SL_RETURN( (0), _("sh_kern_check_internal"));
1763}
1764
1765#endif
1766
1767/*************
1768 *
1769 * module init
1770 *
1771 *************/
1772#if defined(HOST_IS_LINUX)
1773#include <sys/utsname.h>
1774#endif
1775
1776static int AddressReconf = 0;
1777
[140]1778int sh_kern_init (struct mod_type * arg)
[1]1779{
1780#if defined(HOST_IS_LINUX)
1781 struct utsname buf;
1782 char * str;
1783#endif
[140]1784 (void) arg;
[1]1785
1786 SL_ENTER(_("sh_kern_init"));
1787 if (ShKernActive == S_FALSE)
1788 SL_RETURN( (-1), _("sh_kern_init"));
1789
1790#if defined(HOST_IS_LINUX)
1791 uname(&buf);
1792
1793 if ((AddressReconf < 5) && (0 != strcmp(SH_KERNEL_VERSION, buf.release)))
1794 {
1795 str = SH_ALLOC(256);
1796 sl_snprintf(str, 256,
1797 "Compiled for kernel %s, but current kernel is %s, and kernel addresses have not been re-configured",
1798 SH_KERNEL_VERSION, buf.release);
1799 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_SUBGEN,
1800 str,
1801 _("kern_check") );
1802 SH_FREE(str);
1803 ShKernActive = S_FALSE;
1804 SL_RETURN( (-1), _("sh_kern_init"));
1805 }
1806#endif
1807
1808 lastcheck = time (NULL);
1809 if (sh.flag.checkSum != SH_CHECK_INIT)
1810 {
1811 sh_error_handle (SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1812 _("Checking kernel syscalls"),
1813 _("kern_check") );
1814 }
1815 sh_kern_check_internal ();
1816 SL_RETURN( (0), _("sh_kern_init"));
1817}
1818
1819/*************
1820 *
1821 * module cleanup
1822 *
1823 *************/
1824int sh_kern_end ()
1825{
1826 return (0);
1827}
1828
1829
1830/*************
1831 *
1832 * module timer
1833 *
1834 *************/
1835int sh_kern_timer (time_t tcurrent)
1836{
1837 if (ShKernActive == S_FALSE)
1838 return 0;
1839
1840 if ((int) (tcurrent - lastcheck) >= ShKernInterval)
1841 {
1842 lastcheck = tcurrent;
1843 return (-1);
1844 }
1845 return 0;
1846}
1847
1848/*************
1849 *
1850 * module check
1851 *
1852 *************/
1853int sh_kern_check ()
1854{
1855 sh_error_handle (SH_ERR_INFO, FIL__, __LINE__, EINVAL, MSG_E_SUBGEN,
1856 _("Checking kernel syscalls"),
1857 _("kern_check") );
1858 return (sh_kern_check_internal ());
1859}
1860
1861/*************
1862 *
1863 * module setup
1864 *
1865 *************/
1866
[68]1867int sh_kern_set_severity (const char * c)
[1]1868{
1869 char tmp[32];
1870 tmp[0] = '='; tmp[1] = '\0';
1871 sl_strlcat (tmp, c, 32);
1872 sh_error_set_level (tmp, &ShKernSeverity);
1873 return 0;
1874}
1875
[68]1876int sh_kern_set_timer (const char * c)
[1]1877{
1878 long val;
1879
1880 SL_ENTER(_("sh_kern_set_timer"));
1881
1882 val = strtol (c, (char **)NULL, 10);
1883 if (val <= 0)
1884 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
1885 _("kern timer"), c);
1886
1887 val = (val <= 0 ? 60 : val);
1888
1889 ShKernInterval = (time_t) val;
1890 SL_RETURN( 0, _("sh_kern_set_timer"));
1891}
1892
[68]1893int sh_kern_set_activate (const char * c)
[1]1894{
1895 int i;
1896 SL_ENTER(_("sh_kern_set_activate"));
1897 i = sh_util_flagval(c, &ShKernActive);
1898 SL_RETURN(i, _("sh_kern_set_activate"));
1899}
1900
[68]1901int sh_kern_set_idt (const char * c)
[1]1902{
1903 int i;
1904 SL_ENTER(_("sh_kern_set_idt"));
1905 i = sh_util_flagval(c, &ShKernIDT);
1906 SL_RETURN(i, _("sh_kern_set_idt"));
1907}
1908
[68]1909int sh_kern_set_sc_addr (const char * c)
[1]1910{
1911 char * endptr;
1912 unsigned long value;
1913
1914 SL_ENTER(_("sh_kern_set_sc_addr"));
1915 errno = 0;
1916 value = strtoul(c, &endptr, 16);
1917 if ((ULONG_MAX == value) && (errno == ERANGE))
1918 {
1919 SL_RETURN((-1), _("sh_kern_set_sc_addr"));
1920 }
1921 if ((*c == '\0') || (*endptr != '\0'))
1922 {
1923 SL_RETURN((-1), _("sh_kern_set_sc_addr"));
1924 }
1925 system_call_addr = value;
1926 ++AddressReconf;
1927 SL_RETURN((0), _("sh_kern_set_sc_addr"));
1928}
1929
[68]1930int sh_kern_set_sct_addr (const char * c)
[1]1931{
1932 char * endptr;
1933 unsigned long value;
1934
1935 SL_ENTER(_("sh_kern_set_sct_addr"));
1936 errno = 0;
1937 value = strtoul(c, &endptr, 16);
1938 if ((ULONG_MAX == value) && (errno == ERANGE))
1939 {
1940 SL_RETURN((-1), _("sh_kern_set_sct_addr"));
1941 }
1942 if ((*c == '\0') || (*endptr != '\0'))
1943 {
1944 SL_RETURN((-1), _("sh_kern_set_sct_addr"));
1945 }
1946 kaddr = (unsigned int) value;
1947 ++AddressReconf;
1948 SL_RETURN((0), _("sh_kern_set_sct_addr"));
1949}
1950
[68]1951int sh_kern_set_proc_root (const char * c)
[1]1952{
1953 char * endptr;
1954 unsigned long value;
1955
1956 SL_ENTER(_("sh_kern_set_proc_root"));
1957 errno = 0;
1958 value = strtoul(c, &endptr, 16);
1959 if ((ULONG_MAX == value) && (errno == ERANGE))
1960 {
1961 SL_RETURN((-1), _("sh_kern_set_proc_root"));
1962 }
1963 if ((*c == '\0') || (*endptr != '\0'))
1964 {
1965 SL_RETURN((-1), _("sh_kern_set_proc_root"));
1966 }
1967
1968 proc_root = value;
1969 ++AddressReconf;
1970 SL_RETURN((0), _("sh_kern_set_proc_root"));
1971}
1972
[68]1973int sh_kern_set_proc_root_iops (const char * c)
[1]1974{
1975 char * endptr;
1976 unsigned long value;
1977
1978 SL_ENTER(_("sh_kern_set_proc_root_iops"));
1979 errno = 0;
1980 value = strtoul(c, &endptr, 16);
1981 if ((ULONG_MAX == value) && (errno == ERANGE))
1982 {
1983 SL_RETURN((-1), _("sh_kern_set_proc_root_iops"));
1984 }
1985 if ((*c == '\0') || (*endptr != '\0'))
1986 {
1987 SL_RETURN((-1), _("sh_kern_set_proc_root_iops"));
1988 }
1989
1990 proc_root_iops = value;
1991 ++AddressReconf;
1992 SL_RETURN((0), _("sh_kern_set_proc_root_iops"));
1993}
1994
[68]1995int sh_kern_set_proc_root_lookup (const char * c)
[1]1996{
1997 char * endptr;
1998 unsigned long value;
1999
2000 SL_ENTER(_("sh_kern_set_proc_root_lookup"));
2001 errno = 0;
2002 value = strtoul(c, &endptr, 16);
2003 if ((ULONG_MAX == value) && (errno == ERANGE))
2004 {
2005 SL_RETURN((-1), _("sh_kern_set_proc_root_lookup"));
2006 }
2007 if ((*c == '\0') || (*endptr != '\0'))
2008 {
2009 SL_RETURN((-1), _("sh_kern_set_proc_root_lookup"));
2010 }
2011 proc_root_lookup = value;
2012 ++AddressReconf;
2013 SL_RETURN((0), _("sh_kern_set_proc_root_lookup"));
2014}
2015
2016#endif
2017
[68]2018/* #ifdef SH_USE_KERN */
[1]2019#endif
Note: See TracBrowser for help on using the repository browser.