1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
/*
integrit - file integrity verification system
Copyright (C) 2006 Ed L. Cashin
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
/* many people ask about adding a feature to integrit whereby
* multiple roots could be in one config file. It isn't necessary
* to add this feature, since you can easily run integrit more
* than once on multiple config files.
*
* this integrit-run program serves as an example of a simple
* C program that can be statically linked and used to run
* integrit multiple times on different config files.
*
* for many sites, a simple bourne shell script will be
* sufficient, and this kind of program is overkill.
*
* to compile this example, gcc users may use this command:
*
* gcc -W -Wall -g -o integrit-run -static integrit-run.c
*
* you will need to modify the parts of the code below that
* are marked system-specific.
*
*/
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
/* SYSTEM-SPECIFIC: modify these for your own purposes */
#define INTEGRIT_BIN "/tmp/inst/sbin/integrit"
#define CONFIG_DIR "/tmp/cfg"
const char *configs[] = {
"integrit-a.conf",
"integrit-b.conf",
"integrit-c.conf",
};
/* END SYSTEM-SPECIFIC */
int run_integrit(const char *ibin, const char *cdir, const char *cfile)
{
char cpath_buf[1024];
int status;
int snprintf_ret = snprintf(cpath_buf, sizeof(cpath_buf),
"%s/%s", cdir, cfile);
/* current glibc returns -1 when not enough room, but future ones will
* return the number of chars that would have been printed (per C99)
*/
if ((snprintf_ret == -1) || (snprintf_ret > (((int) sizeof(cpath_buf)) - 1))) {
fputs("integrit-run Error: config file path too long\n", stderr);
exit(EXIT_FAILURE);
}
switch (fork()) {
case -1:
perror("fork");
exit(EXIT_FAILURE);
break; /* not reached */
case 0:
/* the child */
execl(ibin, ibin, "-C", cpath_buf, "-c", "-u", NULL);
perror("execl");
_exit(EXIT_FAILURE);
break; /* not reached */
default:
break;
}
/* only parent gets here */
for (;;) {
if (wait(&status) == -1) {
perror("wait");
exit(EXIT_FAILURE);
}
if (WIFEXITED(status))
return WEXITSTATUS(status);
else if (WIFSIGNALED(status))
return -(WTERMSIG(status));
else if (WIFSTOPPED(status))
continue; /* keep waiting */
}
/* shouldn't ever get here */
fputs("integrit-run Error: undefined child status\n", stderr);
exit(EXIT_FAILURE);
return 0; /* not reached */
}
int main(void)
{
int n = sizeof(configs) / sizeof(char *);
int i;
FILE *out = stdout;
for (i = 0; i < n; ++i) {
int ret = run_integrit(INTEGRIT_BIN, CONFIG_DIR, configs[i]);
fprintf(out, "integrit-run: integrit on %s finished: ", configs[i]);
if (ret == 0) {
fputs("no changes detected\n", out);
} else if (ret == 1) {
fputs("changes were detected\n", out);
} else if (ret < 0) {
fprintf(out, "integrit killed by signal %d\n", -ret);
} else {
fputs("an error occurred\n", out);
}
fflush(out);
}
return 0;
}
|
