1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2011, 2012, 2013, 2015, Juniper Networks, Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/types.h>
30#include <sys/errno.h>
31#include <sys/mac.h>
32#include <sys/stat.h>
33
34#include <stdio.h>
35#include <string.h>
36#include <unistd.h>
37#include <fcntl.h>
38#include <paths.h>
39
40#include <security/mac_veriexec/mac_veriexec.h>
41
42#include "libveriexec.h"
43
44
45static int
46check_fd_mode(int fd, unsigned int mask)
47{
48	struct stat st;
49
50	if (fstat(fd, &st) < 0)
51		return errno;
52
53	if ((st.st_mode & mask) == 0)
54		return EAUTH;
55
56	return 0;
57}
58
59int
60veriexec_check_fd_mode(int fd, unsigned int mask)
61{
62	int error;
63
64	if (fd < 0) {
65		errno = EINVAL;
66		return -1;
67	}
68
69	error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_FD_SYSCALL,
70	    (void *)(intptr_t)fd);
71	if (error == -1) {
72		switch (errno) {
73		case ENOSYS:	/* veriexec not loaded */
74			error = 0;	/* ignore */
75			break;
76		}
77	}
78	if (mask && error == 0)
79	    error = check_fd_mode(fd, mask);
80
81	return (error);
82}
83
84int
85veriexec_check_path_mode(const char *file, unsigned int mask)
86{
87	int error;
88
89	if (!file) {
90		errno = EINVAL;
91		return -1;
92	}
93
94	if (mask) {
95		int fd;
96
97		if ((fd = open(file, O_RDONLY)) < 0)
98			return errno;
99
100		error = veriexec_check_fd_mode(fd, mask);
101		close(fd);
102		return error;
103	}
104
105	error = mac_syscall(MAC_VERIEXEC_NAME, MAC_VERIEXEC_CHECK_PATH_SYSCALL,
106	    __DECONST(void *, file));
107	if (error == -1) {
108		switch (errno) {
109		case ENOSYS:	/* veriexec not loaded */
110			error = 0;	/* ignore */
111			break;
112		}
113	}
114	return (error);
115}
116
117int
118veriexec_check_fd(int fd)
119{
120	return veriexec_check_fd_mode(fd, 0);
121}
122
123int
124veriexec_check_path(const char *file)
125{
126	return veriexec_check_path_mode(file, 0);
127}
128
129#if defined(MAIN) || defined(UNIT_TEST)
130int
131main(int argc __unused, char *argv[] __unused)
132{
133	int error;
134	int rc = 0;
135
136	while (*++argv) {
137		error = veriexec_check_path(*argv);
138		if (error == -1) {
139			rc = 1;
140			warn("%s", *argv);
141		}
142	}
143	exit(rc);
144}
145#endif
146