⬢ DragonFlyBSD Kernel Audit
DF-1088 / verify.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
#!/bin/sh
# DF-1088 static source-verification script.
# Confirms the bug exists in the audit tree without requiring a SCSI device.
# Run from repo root.
set +e
PASS=0; FAIL=0
check() {
	if eval "$2"; then
		echo "PASS  $1"
		PASS=$((PASS+1))
	else
		echo "FAIL  $1"
		FAIL=$((FAIL+1))
	fi
}

# 1. passsendccb gates cam_periph_mapmem on (flags & CAM_DATA_PHYS)==0 only
check "passsendccb gate uses only CAM_DATA_PHYS (no strip)" \
	'grep -q "((ccb->ccb_h.flags & CAM_DATA_PHYS) == 0)" sys/bus/cam/scsi/scsi_pass.c'

# 2. No CAM_DATA_PHYS rejection anywhere in scsi_pass.c
check "no CAM_DATA_PHYS rejection in scsi_pass.c (unpatched)" \
	'! grep -q "flags & (CAM_DATA_PHYS" sys/bus/cam/scsi/scsi_pass.c'

# 3. No cdb_len clamp against IOCDBLEN anywhere in scsi_pass.c
check "no cdb_len clamp against IOCDBLEN in scsi_pass.c (unpatched)" \
	'! grep -qE "cdb_len > IOCDBLEN|cdb_len > CAM_MAX_CDBLEN" sys/bus/cam/scsi/scsi_pass.c'

# 4. The kernel-internal XPT path DOES reject CAM_DATA_PHYS for DEV_MATCH
check "XPT rejects CAM_DATA_PHYS for XPT_DEV_MATCH (control case)" \
	'grep -qA1 "if (inccb->ccb_h.flags & CAM_DATA_PHYS)" sys/bus/cam/cam_xpt.c'

# 5. Dangerous flags are all defined in cam_ccb.h
check "CAM_CDB_POINTER/CAM_SENSE_PTR/CAM_SENSE_PHYS/CAM_CDB_PHYS all defined" \
	'grep -q "CAM_CDB_POINTER" sys/bus/cam/cam_ccb.h && grep -q "CAM_SENSE_PTR" sys/bus/cam/cam_ccb.h && grep -q "CAM_SENSE_PHYS" sys/bus/cam/cam_ccb.h && grep -q "CAM_CDB_PHYS" sys/bus/cam/cam_ccb.h'

# 6. IOCDBLEN == 16 (so cdb_len=255 is a 239-byte over-read)
check "IOCDBLEN == 16 (CAM_MAX_CDBLEN)" \
	'grep -q "^#define CAM_MAX_CDBLEN 16" sys/bus/cam/cam.h'

# 7. passopen is gated by caps_priv_check_self(SYSCAP_RESTRICTEDROOT)
check "passopen gated by SYSCAP_RESTRICTEDROOT (privilege required)" \
	'grep -q "caps_priv_check_self(SYSCAP_RESTRICTEDROOT)" sys/bus/cam/scsi/scsi_pass.c'

echo
echo "PASS=$PASS FAIL=$FAIL"
[ "$FAIL" -eq 0 ]