⬢ DragonFlyBSD Kernel Audit
DF-2343 / prep.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
#!/bin/sh
# prep.sh -- one-time guest preparation for the umcs.c rig (DF-2343/DF-2344).
# Files are pushed to /root/umcs from the host.  The guest's /usr/src is the
# build scratch; the host-side sys/ tree is never modified.
set -e
cd /root/umcs

# 0. VERBATIM GATE: the guest's umcs.c must be byte-identical to the
#    audited tree (pristine sha256).  Refuse to prep a patched tree
#    unless UMCSH_ALLOW_PATCHED=1 (fix A/B phase).
PRISTINE=33f9ea999efb8aa68ae520a86023c88affe64b71ddf692c786f36f7c172bef67
GOT=$(sha256 -r /usr/src/sys/bus/u4b/serial/umcs.c | awk '{print $1}')
if [ "$GOT" != "$PRISTINE" ]; then
	if [ "${UMCSH_ALLOW_PATCHED:-0}" = 1 ]; then
		echo "VERBATIM_CHECK umcs.c PATCHED $GOT (pristine=$PRISTINE) -- allowed"
	else
		echo "VERBATIM_CHECK umcs.c PATCHED $GOT (pristine=$PRISTINE) -- REFUSING"
		exit 3
	fi
else
	echo "VERBATIM_CHECK umcs.c PRISTINE $GOT"
fi

# 1. install the harness into the kernel tree.  The stock umcs.c unit
#    stays registered as "optional umcs ucom" but is NOT enabled (no
#    "device umcs" below): its TU is compiled inside umcs_harness.c,
#    exactly once, verbatim.
install -m 644 umcs_harness.c umcsh.h /usr/src/sys/bus/u4b/serial/
grep -q umcs_harness.c /usr/src/sys/conf/files || \
    printf 'bus/u4b/serial/umcs_harness.c	optional umcs_harness\n' \
        >> /usr/src/sys/conf/files
grep -n 'bus/u4b/serial/umcs' /usr/src/sys/conf/files

# 2. kernel config: stock generic + ucom framework + the harness.
#    (X86_64_GENERIC already has "device usb"; ucom is normally a
#    module -- compile it in so the harness links against the stock
#    framework.)
if [ ! -f /usr/src/sys/config/UMCSH ]; then
	cp /usr/src/sys/config/X86_64_GENERIC /usr/src/sys/config/UMCSH
	printf '\n# umcs.c audit rig (DF-2343 / DF-2344)\ndevice\t\tucom\ndevice\t\tumcs_harness\n' \
	    >> /usr/src/sys/config/UMCSH
fi
tail -5 /usr/src/sys/config/UMCSH

# 3. panic behavior: print + dump + reboot, no ddb prompt
grep -q debugger_on_panic /etc/sysctl.conf || \
    echo 'debug.debugger_on_panic=0' >> /etc/sysctl.conf
sysctl debug.debugger_on_panic=0

# 4. build the userland tools
cc -O -Wall -o umcshctl umcshctl.c
cc -O -Wall -o tioc0 tioc0.c
ls -l umcshctl tioc0
echo PREP_OK