This library allows for user space applications to check file descriptors

or paths to see if they can be verified by MAC/veriexec.

Reviewed by:	jtl, wblock
Obtained from:	Juniper Networks, Inc.
Differential Revision:	https://reviews.freebsd.org/D8562

4 files changed, 262 insertions, 0 deletions

diff --git a/lib/libveriexec/Makefile b/lib/libveriexec/Makefile
new file mode 100644
index 000000000000..31f35f3592d5
--- /dev/null
+++ b/lib/libveriexec/Makefile
@@ -0,0 +1,14 @@
+# $FreeBSD$
+
+.include <bsd.own.mk>
+
+LIB=		veriexec
+MAN=		veriexec.3
+INCS=		libveriexec.h
+
+WARNS?=		2
+
+SRCS=		veriexec_check.c
+
+.include <bsd.lib.mk>
+
diff --git a/lib/libveriexec/libveriexec.h b/lib/libveriexec/libveriexec.h
new file mode 100644
index 000000000000..9bfc3f7fd841
--- /dev/null
+++ b/lib/libveriexec/libveriexec.h
@@ -0,0 +1,37 @@
+/*
+ * $FreeBSD$
+ *
+ * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef __LIBVERIEXEC_H__
+#define __LIBVERIEXEC_H__
+
+int	veriexec_check_fd_mode(int, unsigned int);
+int	veriexec_check_path_mode(const char *, unsigned int);
+int	veriexec_check_fd(int);
+int	veriexec_check_path(const char *);
+
+#endif  /* __LIBVERIEXEC_H__ */
diff --git a/lib/libveriexec/veriexec.3 b/lib/libveriexec/veriexec.3
new file mode 100644
index 000000000000..d083e1add57d
--- /dev/null
+++ b/lib/libveriexec/veriexec.3
@@ -0,0 +1,65 @@
+.\" Copyright (c) 2018, Juniper Networks, Inc.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd June 19, 2018
+.Dt VERIEXEC 3
+.Os
+.Sh NAME
+.Nm veriexec_check_fd ,
+.Nm veriexec_check_path
+.Nd Verified execution routines
+.Sh LIBRARY
+.Lb libveriexec
+.Sh SYNOPSIS
+.In libveriexec.h
+.Ft int
+.Fn veriexec_check_fd "int fd"
+.Ft int
+.Fn veriexec_check_path "const char *file"
+.Sh DESCRIPTION
+The
+.Fn veriexec_check_fd
+function checks the signature of the file represented by the
+.Fa fd
+file descriptor.
+.Pp
+The
+.Fn veriexec_check_path
+function checks the signature of the file path
+.Fa file .
+.Pp
+The
+.Fn veriexec_check_fd
+and
+.Fn veriexec_check_path
+functions return zero on a successful signature match or if veriexec is not
+enabled.
+If the signature does not match,
+.Va errno
+is set to the reason for the mismatch.
+.Sh SEE ALSO
+.Xr mac_veriexec 4
+.Xr veriexec 4
diff --git a/lib/libveriexec/veriexec_check.c b/lib/libveriexec/veriexec_check.c
new file mode 100644
index 000000000000..60fd02cbe872
--- /dev/null
+++ b/lib/libveriexec/veriexec_check.c
@@ -0,0 +1,146 @@
+/* 
+ * $FreeBSD$
+ *
+ * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/mac.h>
+#include <sys/stat.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <paths.h>
+
+#include <security/mac_veriexec/mac_veriexec.h>
+
+#include "libveriexec.h"
+
+
+static int
+check_fd_mode(int fd, unsigned int mask)
+{
+	struct stat st;
+
+	if (fstat(fd, &st) < 0)
+		return errno;
+
+	if ((st.st_mode & mask) == 0)
+		return EAUTH;
+
+	return 0;
+}
+
+int
+veriexec_check_fd_mode(int fd, unsigned int mask)
+{
+	int error;
+
+	if (fd < 0) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_FD_SYSCALL,
+	    (void *)(intptr_t)fd);
+	if (error == -1) {
+		switch (errno) {
+		case ENOSYS:	/* veriexec not loaded */
+			error = 0;	/* ignore */
+			break;
+		}
+	}
+	if (mask && error == 0)
+	    error = check_fd_mode(fd, mask);
+
+	return (error);
+}
+
+int
+veriexec_check_path_mode(const char *file, unsigned int mask)
+{
+	int error;
+
+	if (!file) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	if (mask) {
+		int fd;
+
+		if ((fd = open(file, O_RDONLY)) < 0)
+			return errno;
+
+		error = veriexec_check_fd_mode(fd, mask);
+		close(fd);
+		return error;
+	}
+
+	error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_PATH_SYSCALL,
+	    __DECONST(void *, file));
+	if (error == -1) {
+		switch (errno) {
+		case ENOSYS:	/* veriexec not loaded */
+			error = 0;	/* ignore */
+			break;
+		}
+	}
+	return (error);
+}
+
+int
+veriexec_check_fd(int fd)
+{
+	return veriexec_check_fd_mode(fd, 0);
+}
+
+int
+veriexec_check_path(const char *file)
+{
+	return veriexec_check_path_mode(file, 0);
+}
+
+#if defined(MAIN) || defined(UNIT_TEST)
+int
+main(int argc __unused, char *argv[] __unused)
+{
+	int error;
+	int rc = 0;
+    
+	while (*++argv) {
+		error = veriexec_check_path(*argv);
+		if (error == -1) {
+			rc = 1;
+			warn("%s", *argv);
+		}
+	}
+	exit(rc);
+}
+#endif