6c8f7fc3ba
. add all sys/sys headers not already present to help compiling . take netbsd dirent.h and struct dirent; main result is introducing d_type and d_namlen that have to be set by getdents() in all FS code implementing it . d_off is gone . alignment of the struct has become 8 bytes instead of 4 . remove _MAX_BLOCK_SIZE, _MIN_BLOCK_SIZE, _STATIC_BLOCK_SIZE . libminlib: cleanup unused yet duplicate code . mfs: throw out the long-broken v1, v2 support . new test for dirent contents filled by getdents() Change-Id: I1459755c7ba5e5d1c9396d3a587ce6e63ddc283e
133 lines
5 KiB
C
133 lines
5 KiB
C
/* $NetBSD: verified_exec.h,v 1.58 2010/11/19 06:44:34 dholland Exp $ */
|
|
|
|
/*-
|
|
* Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org>
|
|
* Copyright (c) 2005, 2006 Brett Lymn <blymn@NetBSD.org>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. The name of the authors may not be used to endorse or promote products
|
|
* derived from this software without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifndef _SYS_VERIFIED_EXEC_H_
|
|
#define _SYS_VERIFIED_EXEC_H_
|
|
|
|
#include <sys/ioccom.h>
|
|
|
|
#if defined(_KERNEL) && !defined(HAVE_NBTOOL_CONFIG_H)
|
|
#include <sys/types.h>
|
|
#include <prop/proplib.h>
|
|
|
|
struct mount;
|
|
struct vnode;
|
|
|
|
#ifdef notyet
|
|
struct vm_page;
|
|
#endif /* notyet */
|
|
#endif /* _KERNEL */
|
|
|
|
/* Flags for a Veriexec entry. These can be OR'd together. */
|
|
#define VERIEXEC_DIRECT 0x01 /* Direct execution (exec) */
|
|
#define VERIEXEC_INDIRECT 0x02 /* Indirect execution (#!) */
|
|
#define VERIEXEC_FILE 0x04 /* Plain file (open) */
|
|
#define VERIEXEC_UNTRUSTED 0x10 /* Untrusted storage */
|
|
|
|
/* Operations for the Veriexec pseudo-device. */
|
|
#define VERIEXEC_LOAD _IOW('X', 0x1, struct plistref)
|
|
#define VERIEXEC_TABLESIZE _IOW('X', 0x2, struct plistref)
|
|
#define VERIEXEC_DELETE _IOW('X', 0x3, struct plistref)
|
|
#define VERIEXEC_QUERY _IOWR('X', 0x4, struct plistref)
|
|
#define VERIEXEC_DUMP _IOR('X', 0x5, struct plistref)
|
|
#define VERIEXEC_FLUSH _IO('X', 0x6)
|
|
|
|
/* Veriexec modes (strict levels). */
|
|
#define VERIEXEC_LEARNING 0 /* Learning mode. */
|
|
#define VERIEXEC_IDS 1 /* Intrusion detection mode. */
|
|
#define VERIEXEC_IPS 2 /* Intrusion prevention mode. */
|
|
#define VERIEXEC_LOCKDOWN 3 /* Lockdown mode. */
|
|
|
|
/* Valid status field values. */
|
|
#define FINGERPRINT_NOTEVAL 0 /* fingerprint has not been evaluated */
|
|
#define FINGERPRINT_VALID 1 /* fingerprint evaluated and matches list */
|
|
#define FINGERPRINT_NOMATCH 2 /* fingerprint evaluated but does not match */
|
|
|
|
/* Per-page fingerprint status. */
|
|
#define PAGE_FP_NONE 0 /* no per-page fingerprints. */
|
|
#define PAGE_FP_READY 1 /* per-page fingerprints ready for use. */
|
|
#define PAGE_FP_FAIL 2 /* mismatch in per-page fingerprints. */
|
|
|
|
#if defined(_KERNEL) && !defined(HAVE_NBTOOL_CONFIG_H)
|
|
|
|
#if NVERIEXEC > 0
|
|
/* FUTURE: remove this macro entirely - dholland 20100215 */
|
|
#define VERIEXEC_PATH_GET(from, cto, to) \
|
|
do { \
|
|
to = NULL; \
|
|
cto = from; \
|
|
} \
|
|
} while (/*CONSTCOND*/0)
|
|
#define VERIEXEC_PATH_PUT(to) \
|
|
do { \
|
|
(void)(to); \
|
|
} while (/*CONSTCOND*/0)
|
|
#else
|
|
#define VERIEXEC_PATH_GET(from, cto, to) \
|
|
cto = from
|
|
#define VERIEXEC_PATH_PUT(to) \
|
|
(void)to
|
|
|
|
#endif
|
|
|
|
/*
|
|
* Fingerprint operations vector for Veriexec.
|
|
* Function types: init, update, final.
|
|
*/
|
|
typedef void (*veriexec_fpop_init_t)(void *);
|
|
typedef void (*veriexec_fpop_update_t)(void *, u_char *, u_int);
|
|
typedef void (*veriexec_fpop_final_t)(u_char *, void *);
|
|
|
|
void veriexec_init(void);
|
|
int veriexec_fpops_add(const char *, size_t, size_t, veriexec_fpop_init_t,
|
|
veriexec_fpop_update_t, veriexec_fpop_final_t);
|
|
int veriexec_file_add(struct lwp *, prop_dictionary_t);
|
|
int veriexec_verify(struct lwp *, struct vnode *, const u_char *, int,
|
|
bool *);
|
|
#ifdef notyet
|
|
int veriexec_page_verify(struct veriexec_file_entry *, struct vm_page *,
|
|
size_t, struct lwp *);
|
|
#endif /* notyet */
|
|
bool veriexec_lookup(struct vnode *);
|
|
int veriexec_file_delete(struct lwp *, struct vnode *);
|
|
int veriexec_table_delete(struct lwp *, struct mount *);
|
|
int veriexec_convert(struct vnode *, prop_dictionary_t);
|
|
int veriexec_dump(struct lwp *, prop_array_t);
|
|
int veriexec_flush(struct lwp *);
|
|
void veriexec_purge(struct vnode *);
|
|
int veriexec_removechk(struct lwp *, struct vnode *, const char *);
|
|
int veriexec_renamechk(struct lwp *, struct vnode *, const char *,
|
|
struct vnode *, const char *);
|
|
int veriexec_unmountchk(struct mount *);
|
|
int veriexec_openchk(struct lwp *, struct vnode *, const char *, int);
|
|
#endif /* _KERNEL */
|
|
|
|
#endif /* !_SYS_VERIFIED_EXEC_H_ */
|