Restrict DAC/DBI download to verifiable cases and verify DBI

Enforce that a DAC/DBI is only downloaded from a symbol server when it
will be authenticode-verified before it is loaded and run.

- SOS: only download DAC/DBI on a Windows host and only when DAC
  signature verification is enabled (downloaded => verified). On other
  hosts, or when verification is disabled, the matching DAC/DBI must be
  provided locally (collocated runtime or 'setclrpath').
- Verify the DBI signature on load like the DAC, via a shared
  TOCTOU-safe VerifyAndLoadLibrary helper; consolidate DAC/DBI
  verification onto the single DacSignatureVerificationEnabled setting.
- dotnet-symbol: only stage PE debugging libraries (Windows DAC and the
  Windows-hosted cross-OS DAC/DBI) via KeyTypeFlags
  WindowsDebuggingLibrariesOnly; never download native ELF/Mach-O
  DAC/DBI, since a staged file may later be loaded by another tool. Warn
  on non-Windows --debugging.
- IRuntime.GetDbiFilePath now returns whether the DBI requires signature
  verification, matching GetDacFilePath.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8acf622f-1741-40d6-b7df-135160672aa3

Author: hoyosjs

src/Microsoft.Diagnostics.DebugServices.Implementation/Runtime.cs

@@ -23,10 +23,10 @@ public class Runtime : IRuntime, IDisposable
         private readonly IHostAssetResolver _hostAssetResolver;
         private readonly ISettingsService _settingsService;
         private readonly ISymbolService _symbolService;
+        private readonly IConsoleService _consoleService;
         private Version _runtimeVersion;
         private ClrRuntime _clrRuntime;
         private string _dacFilePath;
-        private bool _verifySignature;      // This only applies to the regular DAC, not the CDAC
         private string _cdacFilePath;
         private string _dbiFilePath;
 
@@ -43,6 +43,9 @@ public Runtime(IServiceProvider services, int id, ClrInfo clrInfo)
             _hostAssetResolver = services.GetService<IHostAssetResolver>();
             _settingsService = services.GetService<ISettingsService>() ?? throw new ArgumentException("ISettingsService required");
             _symbolService = services.GetService<ISymbolService>() ?? throw new ArgumentException("ISymbolService required");
+            // IConsoleService is optional: when present it is used to surface actionable guidance
+            // (for example, to run 'setclrpath') when the DAC/DBI cannot be found or downloaded.
+            _consoleService = services.GetService<IConsoleService>();
 
             RuntimeType = GetRuntimeType(clrInfo.Flavor);
             RuntimeModule = services.GetService<IModuleService>().GetModuleFromBaseAddress(clrInfo.ModuleInfo.ImageBase);
@@ -101,13 +104,13 @@ public string GetDacFilePath(out bool verifySignature)
         {
             if (_dacFilePath is null)
             {
-                _dacFilePath = GetLibraryPath(DebugLibraryKind.Dac);
-                if (_dacFilePath is not null)
+                _dacFilePath = GetLibraryPath(DebugLibraryKind.Dac, allowDownload: DownloadAllowed);
+                if (_dacFilePath is null)
                 {
-                    _verifySignature = _settingsService.DacSignatureVerificationEnabled;
+                    WriteDebugLibraryNotFoundWarning(DebugLibraryKind.Dac);
                 }
             }
-            verifySignature = _verifySignature;
+            verifySignature = VerifyDebugLibrarySignature(_dacFilePath);
             return _dacFilePath;
         }
 
@@ -122,7 +125,7 @@ public string GetCDacFilePath()
 
             // The cDAC is bundled with the diagnostics tool and is never downloaded, so a missing
             // path means it isn't available for this host.
-            _cdacFilePath ??= GetLibraryPath(DebugLibraryKind.CDac);
+            _cdacFilePath ??= GetLibraryPath(DebugLibraryKind.CDac, allowDownload: false);
             if (_cdacFilePath is null && _settingsService.CDacLoadPolicy == CDacLoadPolicy.UseCDac)
             {
                 // The cDAC was explicitly forced but isn't bundled with this tool.
@@ -131,12 +134,28 @@ public string GetCDacFilePath()
             return _cdacFilePath;
         }
 
-        public string GetDbiFilePath()
+        public string GetDbiFilePath(out bool verifySignature)
         {
-            _dbiFilePath ??= GetLibraryPath(DebugLibraryKind.Dbi);
+            if (_dbiFilePath is null)
+            {
+                _dbiFilePath = GetLibraryPath(DebugLibraryKind.Dbi, allowDownload: DownloadAllowed);
+                if (_dbiFilePath is null)
+                {
+                    WriteDebugLibraryNotFoundWarning(DebugLibraryKind.Dbi);
+                }
+            }
+            verifySignature = VerifyDebugLibrarySignature(_dbiFilePath);
             return _dbiFilePath;
         }
 
+        /// <summary>
+        /// The DAC and DBI are both verified according to the single DacSignatureVerificationEnabled
+        /// setting; there is no path where one is verified and the other is not. The cDAC is the only
+        /// debugging library that is never verified, and it is loaded through a separate path.
+        /// </summary>
+        private bool VerifyDebugLibrarySignature(string libraryPath) =>
+            libraryPath is not null && _settingsService.DacSignatureVerificationEnabled;
+
         #endregion
 
         /// <summary>
@@ -218,7 +237,7 @@ InvalidDataException or
             return null;
         }
 
-        private string GetLibraryPath(DebugLibraryKind kind)
+        private string GetLibraryPath(DebugLibraryKind kind, bool allowDownload)
         {
             Architecture currentArch = RuntimeInformation.ProcessArchitecture;
             string libraryPath = null;
@@ -239,7 +258,7 @@ private string GetLibraryPath(DebugLibraryKind kind)
                     {
                         continue;
                     }
-                    if (libraryInfo.ArchivedUnder != SymbolProperties.None)
+                    if (libraryInfo.ArchivedUnder != SymbolProperties.None && allowDownload)
                     {
                         libraryPath = DownloadFile(libraryInfo);
                         if (libraryPath is not null)
@@ -253,6 +272,32 @@ private string GetLibraryPath(DebugLibraryKind kind)
             return libraryPath;
         }
 
+        /// <summary>
+        /// Symbol-server download of a DAC/DBI is only permitted when the downloaded binary will be
+        /// authenticode-verified before it is loaded and run. That requires a Windows host (authenticode
+        /// verification is Windows-only, and a non-Windows host cannot load a foreign-format PE DAC/DBI
+        /// anyway) AND that verification has not been disabled. The DacSignatureVerification override only
+        /// relaxes verification for locally-provided DAC/DBI (see 'setclrpath'); it must never allow a
+        /// remotely-acquired, unauthenticated binary to be loaded. When download is not permitted the
+        /// matching DAC/DBI must be provided locally.
+        /// </summary>
+        private bool DownloadAllowed =>
+            RuntimeInformation.IsOSPlatform(OSPlatform.Windows) && _settingsService.DacSignatureVerificationEnabled;
+
+        private void WriteDebugLibraryNotFoundWarning(DebugLibraryKind kind)
+        {
+            if (DownloadAllowed)
+            {
+                return;
+            }
+            string library = kind == DebugLibraryKind.Dbi ? "DBI" : "DAC";
+            _consoleService?.WriteWarning(
+                $"Could not find matching {library} for runtime: {RuntimeModule.FileName}{Environment.NewLine}" +
+                $"Downloading debugging libraries from the symbol server is only supported on Windows with DAC signature verification enabled.{Environment.NewLine}" +
+                $"Use 'setclrpath <directory>' to point at the directory that contains the matching DAC/DBI files{Environment.NewLine}" +
+                $"(for example the runtime's shared framework directory). See 'soshelp setclrpath' for more information.{Environment.NewLine}");
+        }
+
         private string GetLocalPath(DebugLibraryInfo libraryInfo)
         {
             string localFilePath;
@@ -408,7 +453,7 @@ public override string ToString()
             if (_dacFilePath is not null)
             {
                 sb.AppendLine();
-                string verify = _verifySignature ? "(verify)" : "(don't verify)";
+                string verify = VerifyDebugLibrarySignature(_dacFilePath) ? "(verify)" : "(don't verify)";
                 sb.Append($"    DAC: {_dacFilePath} {verify}");
             }
             if (_cdacFilePath is not null)
@@ -419,7 +464,8 @@ public override string ToString()
             if (_dbiFilePath is not null)
             {
                 sb.AppendLine();
-                sb.Append($"    DBI: {_dbiFilePath}");
+                string verify = VerifyDebugLibrarySignature(_dbiFilePath) ? "(verify)" : "(don't verify)";
+                sb.Append($"    DBI: {_dbiFilePath} {verify}");
             }
             return sb.ToString();
         }

src/Microsoft.Diagnostics.DebugServices/IRuntime.cs

@@ -75,6 +75,7 @@ public interface IRuntime
         /// <summary>
         /// Returns the DBI file path
         /// </summary>
-        string GetDbiFilePath();
+        /// <param name="verifySignature">returns whether the returned DBI requires signature verification.</param>
+        string GetDbiFilePath(out bool verifySignature);
     }
 }

src/Microsoft.SymbolStore/KeyGenerators/ELFFileKeyGenerator.cs

@@ -166,7 +166,14 @@ public static IEnumerable<SymbolStoreKey> GetKeys(KeyTypeFlags flags, string pat
                         // Creates all the special CLR keys if the path is the coreclr module for this platform
                         if (fileName == CoreClrFileName)
                         {
-                            foreach (string specialFileName in (flags & KeyTypeFlags.ClrKeys) != 0 ? s_coreClrSpecialFiles : s_dacdbiSpecialFiles)
+                            IEnumerable<string> specialFiles = (flags & KeyTypeFlags.ClrKeys) != 0 ? s_coreClrSpecialFiles : s_dacdbiSpecialFiles;
+                            if ((flags & KeyTypeFlags.WindowsDebuggingLibrariesOnly) != 0)
+                            {
+                                // Only the Windows-hosted cross-OS DAC/DBI (mscordaccore.dll / mscordbi.dll)
+                                // are PE images that can be authenticode-verified. Skip the native ELF images.
+                                specialFiles = specialFiles.Where(static specialFile => specialFile.EndsWith(".dll", StringComparison.OrdinalIgnoreCase));
+                            }
+                            foreach (string specialFileName in specialFiles)
                             {
                                 yield return BuildKey(specialFileName, CoreClrPrefix, buildId);
                             }

src/Microsoft.SymbolStore/KeyGenerators/KeyGenerator.cs

@@ -65,7 +65,15 @@ public enum KeyTypeFlags
         /// <summary>
         /// Generate the r2r perfmap key of the binary (if one exists).
         /// </summary>
-        PerfMapKeys = 0x80
+        PerfMapKeys = 0x80,
+
+        /// <summary>
+        /// When combined with <see cref="ClrKeys"/> or <see cref="DacDbiKeys"/>, restricts the
+        /// generated DAC/DBI/SOS special-file keys to Windows (PE) images only: the native Windows
+        /// DAC/DBI and the Windows-hosted cross-OS DAC/DBI. This is a defense in depth measure
+        /// to ensure we only enumerate files we can authenticate when that are intended to run.
+        /// </summary>
+        WindowsDebuggingLibrariesOnly = 0x100
     }
 
     /// <summary>

src/Microsoft.SymbolStore/KeyGenerators/MachOKeyGenerator.cs

@@ -141,7 +141,12 @@ public static IEnumerable<SymbolStoreKey> GetKeys(KeyTypeFlags flags, string pat
                     /// Creates all the special CLR keys if the path is the coreclr module for this platform
                     if (fileName == CoreClrFileName)
                     {
-                        foreach (string specialFileName in (flags & KeyTypeFlags.ClrKeys) != 0 ? s_coreClrSpecialFiles : s_dacdbiSpecialFiles)
+                        IEnumerable<string> specialFiles = (flags & KeyTypeFlags.ClrKeys) != 0 ? s_coreClrSpecialFiles : s_dacdbiSpecialFiles;
+                        if ((flags & KeyTypeFlags.WindowsDebuggingLibrariesOnly) != 0)
+                        {
+                            specialFiles = specialFiles.Where(static specialFile => specialFile.EndsWith(".dll", StringComparison.OrdinalIgnoreCase));
+                        }
+                        foreach (string specialFileName in specialFiles)
                         {
                             yield return BuildKey(specialFileName, CoreClrPrefix, uuid);
                         }

src/SOS/SOS.Hosting/RuntimeWrapper.cs

@@ -383,7 +383,7 @@ private IntPtr CreateClrDataProcess(IntPtr dacHandle)
 
         private IntPtr CreateCorDebugProcess()
         {
-            string dbiFilePath = _runtime.GetDbiFilePath();
+            string dbiFilePath = _runtime.GetDbiFilePath(out bool verifyDbiSignature);
             if (dbiFilePath == null)
             {
                 Trace.TraceError($"Could not find matching DBI {dbiFilePath ?? ""} for this runtime: {_runtime.RuntimeModule.FileName}");
@@ -405,16 +405,13 @@ private IntPtr CreateCorDebugProcess()
 
             if (_dbiHandle == IntPtr.Zero)
             {
-                try
-                {
-                    _dbiHandle = DataTarget.PlatformFunctions.LoadLibrary(dbiFilePath);
-                }
-                catch (Exception ex) when (ex is DllNotFoundException or BadImageFormatException)
+                // Verify the DBI signature (when required) and load it, holding the verification
+                // file lock through LoadLibrary to prevent a TOCTOU swap between verify and load.
+                _dbiHandle = VerifyAndLoadLibrary(dbiFilePath, verifyDbiSignature, "DBI");
+                if (_dbiHandle == IntPtr.Zero)
                 {
-                    Trace.TraceError($"LoadLibrary({dbiFilePath}) FAILED {ex}");
                     return IntPtr.Zero;
                 }
-                Debug.Assert(_dbiHandle != IntPtr.Zero);
             }
             ClrDebuggingVersion maxDebuggerSupportedVersion = new()
             {
@@ -549,38 +546,53 @@ private IntPtr GetCDacHandle()
             return _cdacHandle;
         }
 
-        private static IntPtr LoadDacLibrary(string dacFilePath, bool verifySignature)
+        /// <summary>
+        /// Verifies the signature (when required) and loads the native library, holding the
+        /// verification file lock through LoadLibrary to prevent a TOCTOU race where the file could
+        /// be swapped after verification but before loading. Returns IntPtr.Zero on failure.
+        /// </summary>
+        private static IntPtr VerifyAndLoadLibrary(string filePath, bool verifySignature, string description)
         {
-            IntPtr dacHandle = IntPtr.Zero;
+            IntPtr handle = IntPtr.Zero;
             IDisposable fileLock = null;
             try
             {
                 if (verifySignature)
                 {
-                    Trace.TraceInformation($"Verifying DAC signing and cert {dacFilePath}");
+                    Trace.TraceInformation($"Verifying {description} signing and cert {filePath}");
 
-                    // Check if the DAC cert is valid before loading
-                    if (!AuthenticodeUtil.VerifyDacDll(dacFilePath, out fileLock))
+                    // Check if the cert is valid before loading
+                    if (!AuthenticodeUtil.VerifyDacDll(filePath, out fileLock))
                     {
                         return IntPtr.Zero;
                     }
                 }
                 try
                 {
-                    dacHandle = DataTarget.PlatformFunctions.LoadLibrary(dacFilePath);
+                    handle = DataTarget.PlatformFunctions.LoadLibrary(filePath);
                 }
                 catch (Exception ex) when (ex is DllNotFoundException or BadImageFormatException)
                 {
-                    Trace.TraceError($"LoadLibrary({dacFilePath}) FAILED {ex}");
+                    Trace.TraceError($"LoadLibrary({filePath}) FAILED {ex}");
                     return IntPtr.Zero;
                 }
             }
             finally
             {
-                // Keep DAC file locked until it loaded
+                // Keep the file locked until it is loaded
                 fileLock?.Dispose();
             }
-            Debug.Assert(dacHandle != IntPtr.Zero);
+            Debug.Assert(handle != IntPtr.Zero);
+            return handle;
+        }
+
+        private static IntPtr LoadDacLibrary(string dacFilePath, bool verifySignature)
+        {
+            IntPtr dacHandle = VerifyAndLoadLibrary(dacFilePath, verifySignature, "DAC");
+            if (dacHandle == IntPtr.Zero)
+            {
+                return IntPtr.Zero;
+            }
             if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
             {
                 DllMainDelegate dllmain = SOSHost.GetDelegateFunction<DllMainDelegate>(dacHandle, "DllMain");

src/Tools/dotnet-symbol/Program.cs

@@ -161,6 +161,14 @@ public static void Main(string[] args)
 
                     case "--debugging":
                         program.Debugging = true;
+                        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+                        {
+                            // Native (ELF/Mach-O) DAC/DBI are never downloaded from the symbol server because they
+                            // are loaded unverified; only the Windows and Windows-hosted cross-OS (PE) debugging
+                            // libraries are. Warn so users on non-Windows know to obtain the matching native DAC/DBI
+                            // from the runtime install or via SOS 'setclrpath' when debugging on this platform.
+                            tracer.Warning("Native DAC/DBI debugging libraries are not downloaded on this platform; only the Windows cross-OS debugging libraries are. Obtain native DAC/DBI from the matching runtime or via 'setclrpath'.");
+                        }
                         break;
 
                     case "--windows-pdbs":
@@ -381,6 +389,15 @@ private IEnumerable<SymbolStoreKeyWrapper> GetKeys()
                     {
                         flags |= KeyTypeFlags.ForceWindowsPdbs;
                     }
+                    if ((flags & (KeyTypeFlags.ClrKeys | KeyTypeFlags.DacDbiKeys)) != 0)
+                    {
+                        // Only download DAC/DBI images that the loader (SOS/dotnet-dump) can authenticode-verify
+                        // before running them: the native Windows DAC/DBI and the Windows-hosted cross-OS DAC/DBI
+                        // (PE images). Native ELF/Mach-O DAC/DBI are never downloaded here because they are loaded
+                        // unverified; they must be provided locally from the matching (trusted) runtime. This holds
+                        // on every host because the file downloaded now may be loaded later by a tool on any OS.
+                        flags |= KeyTypeFlags.WindowsDebuggingLibrariesOnly;
+                    }
                     foreach (SymbolStoreKeyWrapper wrapper in generator.GetKeys(flags).Select((key) => new SymbolStoreKeyWrapper(key, inputFile)))
                     {
                         count++;
@@ -403,7 +420,6 @@ private IEnumerable<KeyGenerator> GetKeyGenerators(string inputFile)
             using (Stream inputStream = File.Open(inputFile, FileMode.Open, FileAccess.Read, FileShare.Read))
             {
                 SymbolStoreFile file = new(inputStream, inputFile);
-                string extension = Path.GetExtension(inputFile);
                 yield return new FileKeyGenerator(Tracer, file);
             }
         }

src/tests/DbgShim.UnitTests/DbgShimTests.cs

@@ -261,7 +261,7 @@ await RemoteInvoke(config, nameof(OpenVirtualProcess), static (string configXml)
                 IRuntime runtime = runtimeService.EnumerateRuntimes().Single();
 
                 CorDebugDataTargetWrapper dataTarget = new(target.Services, runtime);
-                LibraryProviderWrapper libraryProvider = new(target.OperatingSystem, runtime.RuntimeModule.BuildId, runtime.GetDbiFilePath(), runtime.GetDacFilePath(out bool verifySignature));
+                LibraryProviderWrapper libraryProvider = new(target.OperatingSystem, runtime.RuntimeModule.BuildId, runtime.GetDbiFilePath(out bool _), runtime.GetDacFilePath(out _));
                 ClrDebuggingVersion maxDebuggerSupportedVersion = new()
                 {
                     StructVersion = 0,