--- vboxdrv.sh.orig 2024-02-28 15:40:56.680861821 +0100 +++ vboxdrv.sh 2024-02-28 15:47:52.417842405 +0100 @@ -45,39 +45,13 @@ MODPROBE="$MODPROBE --allow-unsupported-modules" fi -setup_log() -{ - test -n "${LOG}" && return 0 - # Rotate log files - LOG="/var/log/vbox-setup.log" - mv "${LOG}.3" "${LOG}.4" 2>/dev/null - mv "${LOG}.2" "${LOG}.3" 2>/dev/null - mv "${LOG}.1" "${LOG}.2" 2>/dev/null - mv "${LOG}" "${LOG}.1" 2>/dev/null -} - [ -f /etc/vbox/vbox.cfg ] && . /etc/vbox/vbox.cfg export VBOX_KBUILD_TYPE export USERNAME export USER=$USERNAME -if test -n "${INSTALL_DIR}" && test -x "${INSTALL_DIR}/VirtualBox"; then - MODULE_SRC="${INSTALL_DIR}/src/vboxhost" -elif test -x /usr/lib/virtualbox/VirtualBox; then - INSTALL_DIR=/usr/lib/virtualbox - MODULE_SRC="/usr/share/virtualbox/src/vboxhost" -elif test -x "${SCRIPT_DIR}/VirtualBox"; then - # Executing from the build directory - INSTALL_DIR="${SCRIPT_DIR}" - MODULE_SRC="${INSTALL_DIR}/src" -else - # Silently exit if the package was uninstalled but not purged. - # Applies to Debian packages only (but shouldn't hurt elsewhere) - exit 0 -fi VIRTUALBOX="${INSTALL_DIR}/VirtualBox" VBOXMANAGE="${INSTALL_DIR}/VBoxManage" -BUILDINTMP="${MODULE_SRC}/build_in_tmp" if test -u "${VIRTUALBOX}"; then GROUP=root DEVICE_MODE=0600 @@ -173,333 +147,12 @@ lsmod | grep -q "$1[^_-]" } -log() -{ - setup_log - echo "${1}" >> "${LOG}" -} - -module_build_log() -{ - setup_log - echo "${1}" | egrep -v \ - "^test -e include/generated/autoconf.h|^echo >&2|^/bin/false\)$" \ - >> "${LOG}" -} - # Detect VirtualBox version info or report error. VBOX_VERSION="`"$VBOXMANAGE" -v | cut -d r -f1`" [ -n "$VBOX_VERSION" ] || failure 'Cannot detect VirtualBox version number' VBOX_REVISION="r`"$VBOXMANAGE" -v | cut -d r -f2`" [ "$VBOX_REVISION" != "r" ] || failure 'Cannot detect VirtualBox revision number' -## Output the vboxdrv part of our udev rule. This is redirected to the right file. -udev_write_vboxdrv() { - VBOXDRV_GRP="$1" - VBOXDRV_MODE="$2" - - echo "KERNEL==\"vboxdrv\", NAME=\"vboxdrv\", OWNER=\"root\", GROUP=\"$VBOXDRV_GRP\", MODE=\"$VBOXDRV_MODE\"" - echo "KERNEL==\"vboxdrvu\", NAME=\"vboxdrvu\", OWNER=\"root\", GROUP=\"root\", MODE=\"0666\"" - echo "KERNEL==\"vboxnetctl\", NAME=\"vboxnetctl\", OWNER=\"root\", GROUP=\"$VBOXDRV_GRP\", MODE=\"$VBOXDRV_MODE\"" -} - -## Output the USB part of our udev rule. This is redirected to the right file. -udev_write_usb() { - INSTALLATION_DIR="$1" - USB_GROUP="$2" - - echo "SUBSYSTEM==\"usb_device\", ACTION==\"add\", RUN+=\"$INSTALLATION_DIR/VBoxCreateUSBNode.sh \$major \$minor \$attr{bDeviceClass}${USB_GROUP}\"" - echo "SUBSYSTEM==\"usb\", ACTION==\"add\", ENV{DEVTYPE}==\"usb_device\", RUN+=\"$INSTALLATION_DIR/VBoxCreateUSBNode.sh \$major \$minor \$attr{bDeviceClass}${USB_GROUP}\"" - echo "SUBSYSTEM==\"usb_device\", ACTION==\"remove\", RUN+=\"$INSTALLATION_DIR/VBoxCreateUSBNode.sh --remove \$major \$minor\"" - echo "SUBSYSTEM==\"usb\", ACTION==\"remove\", ENV{DEVTYPE}==\"usb_device\", RUN+=\"$INSTALLATION_DIR/VBoxCreateUSBNode.sh --remove \$major \$minor\"" -} - -## Generate our udev rule file. This takes a change in udev rule syntax in -## version 55 into account. It only creates rules for USB for udev versions -## recent enough to support USB device nodes. -generate_udev_rule() { - VBOXDRV_GRP="$1" # The group owning the vboxdrv device - VBOXDRV_MODE="$2" # The access mode for the vboxdrv device - INSTALLATION_DIR="$3" # The directory VirtualBox is installed in - USB_GROUP="$4" # The group that has permission to access USB devices - NO_INSTALL="$5" # Set this to "1" to remove but not re-install rules - - # Extra space! - case "$USB_GROUP" in ?*) USB_GROUP=" $USB_GROUP" ;; esac - case "$NO_INSTALL" in "1") return ;; esac - udev_write_vboxdrv "$VBOXDRV_GRP" "$VBOXDRV_MODE" - udev_write_usb "$INSTALLATION_DIR" "$USB_GROUP" -} - -## Install udev rule (disable with INSTALL_NO_UDEV=1 in -## /etc/default/virtualbox). -install_udev() { - VBOXDRV_GRP="$1" # The group owning the vboxdrv device - VBOXDRV_MODE="$2" # The access mode for the vboxdrv device - INSTALLATION_DIR="$3" # The directory VirtualBox is installed in - USB_GROUP="$4" # The group that has permission to access USB devices - NO_INSTALL="$5" # Set this to "1" to remove but not re-install rules - - if test -d /etc/udev/rules.d; then - generate_udev_rule "$VBOXDRV_GRP" "$VBOXDRV_MODE" "$INSTALLATION_DIR" \ - "$USB_GROUP" "$NO_INSTALL" - fi - # Remove old udev description file - rm -f /etc/udev/rules.d/10-vboxdrv.rules 2> /dev/null -} - -## Create a usb device node for a given sysfs path to a USB device. -install_create_usb_node_for_sysfs() { - path="$1" # sysfs path for the device - usb_createnode="$2" # Path to the USB device node creation script - usb_group="$3" # The group to give ownership of the node to - if test -r "${path}/dev"; then - dev="`cat "${path}/dev" 2> /dev/null`" - major="`expr "$dev" : '\(.*\):' 2> /dev/null`" - minor="`expr "$dev" : '.*:\(.*\)' 2> /dev/null`" - class="`cat ${path}/bDeviceClass 2> /dev/null`" - sh "${usb_createnode}" "$major" "$minor" "$class" \ - "${usb_group}" 2>/dev/null - fi -} - -udev_rule_file=/etc/udev/rules.d/60-vboxdrv.rules -sysfs_usb_devices="/sys/bus/usb/devices/*" - -## Install udev rules and create device nodes for usb access -setup_usb() { - VBOXDRV_GRP="$1" # The group that should own /dev/vboxdrv - VBOXDRV_MODE="$2" # The mode to be used for /dev/vboxdrv - INSTALLATION_DIR="$3" # The directory VirtualBox is installed in - USB_GROUP="$4" # The group that should own the /dev/vboxusb device - # nodes unless INSTALL_NO_GROUP=1 in - # /etc/default/virtualbox. Optional. - usb_createnode="$INSTALLATION_DIR/VBoxCreateUSBNode.sh" - # install udev rule (disable with INSTALL_NO_UDEV=1 in - # /etc/default/virtualbox) - if [ "$INSTALL_NO_GROUP" != "1" ]; then - usb_group=$USB_GROUP - vboxdrv_group=$VBOXDRV_GRP - else - usb_group=root - vboxdrv_group=root - fi - install_udev "${vboxdrv_group}" "$VBOXDRV_MODE" \ - "$INSTALLATION_DIR" "${usb_group}" \ - "$INSTALL_NO_UDEV" > ${udev_rule_file} - # Build our device tree - for i in ${sysfs_usb_devices}; do # This line intentionally without quotes. - install_create_usb_node_for_sysfs "$i" "${usb_createnode}" \ - "${usb_group}" - done -} - -cleanup_usb() -{ - # Remove udev description file - rm -f /etc/udev/rules.d/60-vboxdrv.rules - rm -f /etc/udev/rules.d/10-vboxdrv.rules - - # Remove our USB device tree - rm -rf /dev/vboxusb -} - -# Returns path to module file as seen by modinfo(8) or empty string. -module_path() -{ - mod="$1" - [ -n "$mod" ] || return - - modinfo "$mod" 2>/dev/null | grep -e "^filename:" | tr -s ' ' | cut -d " " -f2 -} - -# Returns module version if module is available or empty string. -module_version() -{ - mod="$1" - [ -n "$mod" ] || return - - modinfo "$mod" 2>/dev/null | grep -e "^version:" | tr -s ' ' | cut -d " " -f2 -} - -# Returns module revision if module is available in the system or empty string. -module_revision() -{ - mod="$1" - [ -n "$mod" ] || return - - modinfo "$mod" 2>/dev/null | grep -e "^version:" | tr -s ' ' | cut -d " " -f3 -} - -# Reads kernel configuration option. -kernel_get_config_opt() -{ - opt_name="$1" - [ -n "$opt_name" ] || return - - # Check if there is a kernel tool which can extract config option. - if test -x /lib/modules/"$KERN_VER"/build/scripts/config; then - /lib/modules/"$KERN_VER"/build/scripts/config \ - --file /lib/modules/"$KERN_VER"/build/.config \ - --state "$opt_name" 2>/dev/null - elif test -f /lib/modules/"$KERN_VER"/build/.config; then - # Extract config option manually. - grep "$opt_name=" /lib/modules/"$KERN_VER"/build/.config | sed -e "s/^$opt_name=//" -e "s/\"//g" - fi -} - -# Reads CONFIG_MODULE_SIG_HASH from kernel config. -kernel_module_sig_hash() -{ - kernel_get_config_opt "CONFIG_MODULE_SIG_HASH" -} - -# Returns "1" if kernel module signature hash algorithm -# is supported by us. Or empty string otherwise. -module_sig_hash_supported() -{ - sig_hashalgo="$1" - [ -n "$sig_hashalgo" ] || return - - # Go through supported list. - [ "$sig_hashalgo" = "sha1" \ - -o "$sig_hashalgo" = "sha224" \ - -o "$sig_hashalgo" = "sha256" \ - -o "$sig_hashalgo" = "sha384" \ - -o "$sig_hashalgo" = "sha512" ] || return - - echo "1" -} - -# Check if kernel configuration requires modules signature. -kernel_requires_module_signature() -{ - vbox_sys_lockdown_path="/sys/kernel/security/lockdown" - - requires="" - # We consider that if kernel is running in the following configurations, - # it will require modules to be signed. - if [ "$(kernel_get_config_opt "CONFIG_MODULE_SIG")" = "y" ]; then - - # Modules signature verification is hardcoded in kernel config. - [ "$(kernel_get_config_opt "CONFIG_MODULE_SIG_FORCE")" = "y" ] && requires="1" - - # Unsigned modules loading is restricted by "lockdown" feature in runtime. - if [ "$(kernel_get_config_opt "CONFIG_LOCK_DOWN_KERNEL")" = "y" \ - -o "$(kernel_get_config_opt "CONFIG_SECURITY_LOCKDOWN_LSM")" = "y" \ - -o "$(kernel_get_config_opt "CONFIG_SECURITY_LOCKDOWN_LSM_EARLY")" = "y" ]; then - - # Once lockdown level is set to something different than "none" (e.g., "integrity" - # or "confidentiality"), kernel will reject unsigned modules loading. - if [ -r "$vbox_sys_lockdown_path" ]; then - [ -n "$(cat "$vbox_sys_lockdown_path" | grep "\[integrity\]")" ] && requires="1" - [ -n "$(cat "$vbox_sys_lockdown_path" | grep "\[confidentiality\]")" ] && requires="1" - fi - - # This configuration is used by a number of modern Linux distributions and restricts - # unsigned modules loading when Secure Boot mode is enabled. - [ "$(kernel_get_config_opt "CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT")" = "y" -a -n "$HAVE_SEC_BOOT" ] && requires="1" - fi - fi - - [ -n "$requires" ] && echo "1" -} - -# Returns "1" if module is signed and signature can be verified -# with public key provided in DEB_PUB_KEY. Or empty string otherwise. -module_signed() -{ - mod="$1" - [ -n "$mod" ] || return - - extraction_tool=/lib/modules/"$(uname -r)"/build/scripts/extract-module-sig.pl - mod_path=$(module_path "$mod" 2>/dev/null) - openssl_tool=$(which openssl 2>/dev/null) - # Do not use built-in printf! - printf_tool=$(which printf 2>/dev/null) - - # Make sure all the tools required for signature validation are available. - [ -x "$extraction_tool" ] || return - [ -n "$mod_path" ] || return - [ -n "$openssl_tool" ] || return - [ -n "$printf_tool" ] || return - - # Make sure openssl can handle hash algorithm. - sig_hashalgo=$(modinfo -F sig_hashalgo "$mod" 2>/dev/null) - [ "$(module_sig_hash_supported $sig_hashalgo)" = "1" ] || return - - # Generate file names for temporary stuff. - mod_pub_key=$(mktemp -u) - mod_signature=$(mktemp -u) - mod_unsigned=$(mktemp -u) - - # Convert public key in DER format into X509 certificate form. - "$openssl_tool" x509 -pubkey -inform DER -in "$DEB_PUB_KEY" -out "$mod_pub_key" 2>/dev/null - # Extract raw module signature and convert it into binary format. - "$printf_tool" \\x$(modinfo -F signature "$mod" | sed -z 's/[ \t\n]//g' | sed -e "s/:/\\\x/g") 2>/dev/null > "$mod_signature" - # Extract unsigned module for further digest calculation. - "$extraction_tool" -0 "$mod_path" 2>/dev/null > "$mod_unsigned" - - # Verify signature. - rc="" - "$openssl_tool" dgst "-$sig_hashalgo" -binary -verify "$mod_pub_key" -signature "$mod_signature" "$mod_unsigned" 2>&1 >/dev/null && rc="1" - # Clean up. - rm -f $mod_pub_key $mod_signature $mod_unsigned - - # Check result. - [ "$rc" = "1" ] || return - - echo "1" -} - -# Returns "1" if externally built module is available in the system and its -# version and revision number do match to current VirtualBox installation. -# Or empty string otherwise. -module_available() -{ - mod="$1" - [ -n "$mod" ] || return - - [ "$VBOX_VERSION" = "$(module_version "$mod")" ] || return - [ "$VBOX_REVISION" = "$(module_revision "$mod")" ] || return - - # Check if module belongs to VirtualBox installation. - # - # We have a convention that only modules from /lib/modules/*/misc - # belong to us. Modules from other locations are treated as - # externally built. - mod_path="$(module_path "$mod")" - - # If module path points to a symbolic link, resolve actual file location. - [ -L "$mod_path" ] && mod_path="$(readlink -e -- "$mod_path")" - - # File exists? - [ -f "$mod_path" ] || return - - # Extract last component of module path and check whether it is located - # outside of /lib/modules/*/misc. - mod_dir="$(dirname "$mod_path" | sed 's;^.*/;;')" - [ "$mod_dir" = "misc" ] || return - - # In case if kernel configuration requires module signature, check if module is signed. - if test "$(kernel_requires_module_signature)" = "1"; then - [ "$(module_signed "$mod")" = "1" ] || return - fi - - echo "1" -} - -# Check if required modules are installed in the system and versions match. -setup_complete() -{ - [ "$(module_available vboxdrv)" = "1" ] || return - [ "$(module_available vboxnetflt)" = "1" ] || return - [ "$(module_available vboxnetadp)" = "1" ] || return - - # All modules are in place. - echo "1" -} - start() { begin_msg "Starting VirtualBox services" console @@ -518,9 +171,6 @@ if ! running vboxdrv; then - # Check if system already has matching modules installed. - [ "$(setup_complete)" = "1" ] || setup - if ! rm -f $DEVICE; then failure "Cannot remove $DEVICE" fi @@ -572,8 +222,6 @@ mkdir -p -m 0750 /dev/vboxusb 2>/dev/null chown root:vboxusers /dev/vboxusb 2>/dev/null fi - # Remove any kernel modules left over from previously installed kernels. - cleanup only_old succ_msg "VirtualBox services started" } @@ -654,153 +302,10 @@ fi } -cleanup() -{ - # If this is set, only remove kernel modules for no longer installed - # kernels. Note that only generated kernel modules should be placed - # in /lib/modules/*/misc. Anything that we should not remove automatically - # should go elsewhere. - only_old="${1}" - for i in /lib/modules/*; do - # Check whether we are only cleaning up for uninstalled kernels. - test -n "${only_old}" && test -e "${i}/kernel/drivers" && continue - - unset do_update - for j in $MODULE_LIST; do - for mod_ext in ko ko.gz ko.xz ko.zst; do - test -f "${i}/misc/${j}.${mod_ext}" && do_update=1 && rm -f "${i}/misc/${j}.${mod_ext}" - done - done - - # Trigger depmod(8) only in case if directory content was modified - # and save a bit of run time. - test -n "$do_update" && depmod -a "$(basename "$i")" && sync - - # Remove the kernel version folder if it was empty except for us. - test "`echo ${i}/misc/* ${i}/misc/.?* ${i}/* ${i}/.?*`" \ - = "${i}/misc/* ${i}/misc/.. ${i}/misc ${i}/.." && - rmdir "${i}/misc" "${i}" # We used to leave empty folders. - done -} - # setup_script setup() { - begin_msg "Building VirtualBox kernel modules" console - log "Building the main VirtualBox module." - - # Detect if kernel was built with clang. - unset LLVM - vbox_cc_is_clang=$(kernel_get_config_opt "CONFIG_CC_IS_CLANG") - if test "${vbox_cc_is_clang}" = "y"; then - log "Using clang compiler." - export LLVM=1 - fi - - if ! myerr=`$BUILDINTMP \ - --save-module-symvers /tmp/vboxdrv-Module.symvers \ - --module-source "$MODULE_SRC/vboxdrv" \ - --no-print-directory install 2>&1`; then - "${INSTALL_DIR}/check_module_dependencies.sh" || exit 1 - log "Error building the module:" - module_build_log "$myerr" - failure "Look at $LOG to find out what went wrong" - fi - log "Building the net filter module." - if ! myerr=`$BUILDINTMP \ - --use-module-symvers /tmp/vboxdrv-Module.symvers \ - --module-source "$MODULE_SRC/vboxnetflt" \ - --no-print-directory install 2>&1`; then - log "Error building the module:" - module_build_log "$myerr" - failure "Look at $LOG to find out what went wrong" - fi - log "Building the net adapter module." - if ! myerr=`$BUILDINTMP \ - --use-module-symvers /tmp/vboxdrv-Module.symvers \ - --module-source "$MODULE_SRC/vboxnetadp" \ - --no-print-directory install 2>&1`; then - log "Error building the module:" - module_build_log "$myerr" - failure "Look at $LOG to find out what went wrong" - fi - if test -e "$MODULE_SRC/vboxpci"; then - log "Building the PCI pass-through module." - if ! myerr=`$BUILDINTMP \ - --use-module-symvers /tmp/vboxdrv-Module.symvers \ - --module-source "$MODULE_SRC/vboxpci" \ - --no-print-directory install 2>&1`; then - log "Error building the module:" - module_build_log "$myerr" - failure "Look at $LOG to find out what went wrong" - fi - fi - rm -f /etc/vbox/module_not_compiled - depmod -a - sync - succ_msg "VirtualBox kernel modules built" - - # Sign kernel modules if kernel configuration requires it. - if test "$(kernel_requires_module_signature)" = "1"; then - begin_msg "Signing VirtualBox kernel modules" console - - # Generate new signing key if needed. - [ -n "$HAVE_UPDATE_SECUREBOOT_POLICY_TOOL" ] && SHIM_NOTRIGGER=y update-secureboot-policy --new-key - - # Check if signing keys are in place. - if test ! -f "$DEB_PUB_KEY" || ! test -f "$DEB_PRIV_KEY"; then - # update-secureboot-policy tool present in the system, but keys were not generated. - [ -n "$HAVE_UPDATE_SECUREBOOT_POLICY_TOOL" ] && fail_msg " - -update-secureboot-policy tool does not generate signing keys -in your distribution, see below on how to generate them manually -" - - # update-secureboot-policy not present in the system, recommend generate keys manually. - failure " - -System is running in Secure Boot mode, however your distribution -does not provide tools for automatic generation of keys needed for -modules signing. Please consider to generate and enroll them manually: - - sudo mkdir -p /var/lib/shim-signed/mok - sudo openssl req -nodes -new -x509 -newkey rsa:2048 -outform DER -addext \"extendedKeyUsage=codeSigning\" -keyout $DEB_PRIV_KEY -out $DEB_PUB_KEY - sudo mokutil --import $DEB_PUB_KEY - sudo reboot - -Restart \"rcvboxdrv setup\" after system is rebooted -" - fi - - # Check if signing tool is available. - [ -n "$SIGN_TOOL" ] || failure "Unable to find signing tool" - - # Get kernel signature hash algorithm from kernel config and validate it. - sig_hashalgo=$(kernel_module_sig_hash) - [ "$(module_sig_hash_supported $sig_hashalgo)" = "1" ] \ - || failure "Unsupported kernel signature hash algorithm $sig_hashalgo" - - # Sign modules. - for i in $MODULE_LIST; do - "$SIGN_TOOL" "$sig_hashalgo" "$DEB_PRIV_KEY" "$DEB_PUB_KEY" \ - /lib/modules/"$KERN_VER"/misc/"$i".ko 2>/dev/null || failure "Unable to sign $i.ko" - done - - # Enroll signing key if needed. - if test -n "$HAVE_UPDATE_SECUREBOOT_POLICY_TOOL"; then - # update-secureboot-policy "expects" DKMS modules. - # Work around this and talk to the authors as soon - # as possible to fix it. - mkdir -p /var/lib/dkms/vbox-temp - update-secureboot-policy --enroll-key 2>/dev/null || - begin_msg "Failed to enroll secure boot key." console - rmdir -p /var/lib/dkms/vbox-temp 2>/dev/null - - # Indicate that key has been enrolled and reboot is needed. - HAVE_DEB_KEY=true - fi - succ_msg "Signing completed" - fi + echo "Not implemented! Please use the virtualbox-kernel.SlackBuild available at SlackBuilds.org instead." } dmnstatus() @@ -850,20 +355,7 @@ stop && start ;; setup) - test -n "${2}" && export KERN_VER="${2}" - # Create udev rule and USB device nodes. - ## todo Wouldn't it make more sense to install the rule to /lib/udev? This - ## is not a user-created configuration file after all. - ## todo Do we need a udev rule to create /dev/vboxdrv[u] at all? We have - ## working fall-back code here anyway, and the "right" code is more complex - ## than the fall-back. Unnecessary duplication? - stop && cleanup - setup_usb "$GROUP" "$DEVICE_MODE" "$INSTALL_DIR" - start - ;; -cleanup) - stop && cleanup - cleanup_usb + setup ;; force-reload) stop @@ -873,7 +365,7 @@ dmnstatus ;; *) - echo "Usage: $0 {start|stop|stop_vms|restart|setup|cleanup|force-reload|status}" + echo "Usage: $0 {start|stop|stop_vms|restart|setup|force-reload|status}" exit 1 esac