src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright © 2013 Intel Corporation
   4   Authors:
   5         Nathaniel Chen <nathaniel.chen@intel.com>
   6 ***/
   7
   8 #include <dirent.h>
   9 #include <errno.h>
  10 #include <fcntl.h>
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <unistd.h>
  14
  15 #include "alloc-util.h"
  16 #include "dirent-util.h"
  17 #include "fd-util.h"
  18 #include "fileio.h"
  19 #include "log.h"
  20 #include "macro.h"
  21 #include "smack-setup.h"
  22 #include "string-util.h"
  23 #include "util.h"
  24
  25 #if ENABLE_SMACK
  26
  27 static int fdopen_unlocked_at(int dfd, const char *dir, const char *name, int *status, FILE **ret_file) {
  28         int fd, r;
  29         FILE *f;
  30
  31         fd = openat(dfd, name, O_RDONLY|O_CLOEXEC);
  32         if (fd < 0) {
  33                 if (*status == 0)
  34                         *status = -errno;
  35
  36                 return log_warning_errno(errno, "Failed to open \"%s/%s\": %m", dir, name);
  37         }
  38
  39         r = fdopen_unlocked(fd, "r", &f);
  40         if (r < 0) {
  41                 if (*status == 0)
  42                         *status = r;
  43
  44                 safe_close(fd);
  45                 return log_error_errno(r, "Failed to open \"%s/%s\": %m", dir, name);
  46         }
  47
  48         *ret_file = f;
  49         return 0;
  50 }
  51
  52 static int write_access2_rules(const char *srcdir) {
  53         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  54         _cleanup_closedir_ DIR *dir = NULL;
  55         struct dirent *entry;
  56         int dfd = -1, r = 0;
  57
  58         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  59         if (load2_fd < 0)  {
  60                 if (errno != ENOENT)
  61                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  62                 return -errno; /* negative error */
  63         }
  64
  65         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  66         if (change_fd < 0)  {
  67                 if (errno != ENOENT)
  68                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  69                 return -errno; /* negative error */
  70         }
  71
  72         /* write rules to load2 or change-rule from every file in the directory */
  73         dir = opendir(srcdir);
  74         if (!dir) {
  75                 if (errno != ENOENT)
  76                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  77                 return errno; /* positive on purpose */
  78         }
  79
  80         dfd = dirfd(dir);
  81         assert(dfd >= 0);
  82
  83         FOREACH_DIRENT(entry, dir, return 0) {
  84                 _cleanup_fclose_ FILE *policy = NULL;
  85
  86                 dirent_ensure_type(dir, entry);
  87                 if (!dirent_is_file(entry))
  88                         continue;
  89
  90                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
  91                         continue;
  92
  93                 /* load2 write rules in the kernel require a line buffered stream */
  94                 for (;;) {
  95                         _cleanup_free_ char *buf = NULL, *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
  96                         int q;
  97
  98                         q = read_line(policy, NAME_MAX, &buf);
  99                         if (q < 0)
 100                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 101                         if (q == 0)
 102                                 break;
 103
 104                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 105                                 continue;
 106
 107                         /* if 3 args -> load rule   : subject object access1 */
 108                         /* if 4 args -> change rule : subject object access1 access2 */
 109                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 110                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 111                                 continue;
 112                         }
 113
 114                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 115                                 if (r == 0)
 116                                         r = -errno;
 117                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s': %m",
 118                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 119                         }
 120                 }
 121         }
 122
 123         return r;
 124 }
 125
 126 static int write_cipso2_rules(const char *srcdir) {
 127         _cleanup_close_ int cipso2_fd = -1;
 128         _cleanup_closedir_ DIR *dir = NULL;
 129         struct dirent *entry;
 130         int dfd = -1, r = 0;
 131
 132         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 133         if (cipso2_fd < 0)  {
 134                 if (errno != ENOENT)
 135                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 136                 return -errno; /* negative error */
 137         }
 138
 139         /* write rules to cipso2 from every file in the directory */
 140         dir = opendir(srcdir);
 141         if (!dir) {
 142                 if (errno != ENOENT)
 143                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 144                 return errno; /* positive on purpose */
 145         }
 146
 147         dfd = dirfd(dir);
 148         assert(dfd >= 0);
 149
 150         FOREACH_DIRENT(entry, dir, return 0) {
 151                 _cleanup_fclose_ FILE *policy = NULL;
 152
 153                 dirent_ensure_type(dir, entry);
 154                 if (!dirent_is_file(entry))
 155                         continue;
 156
 157                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
 158                         continue;
 159
 160                 /* cipso2 write rules in the kernel require a line buffered stream */
 161                 for (;;) {
 162                         _cleanup_free_ char *buf = NULL;
 163                         int q;
 164
 165                         q = read_line(policy, NAME_MAX, &buf);
 166                         if (q < 0)
 167                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 168                         if (q == 0)
 169                                 break;
 170
 171                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 172                                 continue;
 173
 174                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 175                                 if (r == 0)
 176                                         r = -errno;
 177                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s': %m",
 178                                                 buf, entry->d_name);
 179                                 break;
 180                         }
 181                 }
 182         }
 183
 184         return r;
 185 }
 186
 187 static int write_netlabel_rules(const char *srcdir) {
 188         _cleanup_fclose_ FILE *dst = NULL;
 189         _cleanup_closedir_ DIR *dir = NULL;
 190         struct dirent *entry;
 191         int dfd = -1, r = 0;
 192
 193         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 194         if (!dst)  {
 195                 if (errno != ENOENT)
 196                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 197                 return -errno; /* negative error */
 198         }
 199
 200         /* write rules to dst from every file in the directory */
 201         dir = opendir(srcdir);
 202         if (!dir) {
 203                 if (errno != ENOENT)
 204                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 205                 return errno; /* positive on purpose */
 206         }
 207
 208         dfd = dirfd(dir);
 209         assert(dfd >= 0);
 210
 211         FOREACH_DIRENT(entry, dir, return 0) {
 212                 _cleanup_fclose_ FILE *policy = NULL;
 213
 214                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
 215                         continue;
 216
 217                 /* load2 write rules in the kernel require a line buffered stream */
 218                 for (;;) {
 219                         _cleanup_free_ char *buf = NULL;
 220                         int q;
 221
 222                         q = read_line(policy, NAME_MAX, &buf);
 223                         if (q < 0)
 224                                 return log_error_errno(q, "Failed to read line from %s: %m", entry->d_name);
 225                         if (q == 0)
 226                                 break;
 227
 228                         if (!fputs(buf, dst)) {
 229                                 if (r == 0)
 230                                         r = -EINVAL;
 231                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel: %m");
 232                                 break;
 233                         }
 234                         q = fflush_and_check(dst);
 235                         if (q < 0) {
 236                                 if (r == 0)
 237                                         r = q;
 238                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 239                                 break;
 240                         }
 241                 }
 242         }
 243
 244         return r;
 245 }
 246
 247 static int write_onlycap_list(void) {
 248         _cleanup_close_ int onlycap_fd = -1;
 249         _cleanup_free_ char *list = NULL;
 250         _cleanup_fclose_ FILE *f = NULL;
 251         size_t len = 0, allocated = 0;
 252         int r;
 253
 254         f = fopen("/etc/smack/onlycap", "re");
 255         if (!f) {
 256                 if (errno != ENOENT)
 257                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap': %m");
 258
 259                 return errno == ENOENT ? ENOENT : -errno;
 260         }
 261
 262         for (;;) {
 263                 _cleanup_free_ char *buf = NULL;
 264                 size_t l;
 265
 266                 r = read_line(f, LONG_LINE_MAX, &buf);
 267                 if (r < 0)
 268                         return log_error_errno(r, "Failed to read line from /etc/smack/onlycap: %m");
 269                 if (r == 0)
 270                         break;
 271
 272                 if (isempty(buf) || strchr(COMMENTS, *buf))
 273                         continue;
 274
 275                 l = strlen(buf);
 276                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 277                         return log_oom();
 278
 279                 stpcpy(list + len, buf)[0] = ' ';
 280                 len += l + 1;
 281         }
 282
 283         if (len == 0)
 284                 return 0;
 285
 286         list[len - 1] = 0;
 287
 288         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 289         if (onlycap_fd < 0) {
 290                 if (errno != ENOENT)
 291                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap': %m");
 292                 return -errno; /* negative error */
 293         }
 294
 295         r = write(onlycap_fd, list, len);
 296         if (r < 0)
 297                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap': %m", list);
 298
 299         return 0;
 300 }
 301
 302 #endif
 303
 304 int mac_smack_setup(bool *loaded_policy) {
 305
 306 #if ENABLE_SMACK
 307
 308         int r;
 309
 310         assert(loaded_policy);
 311
 312         r = write_access2_rules("/etc/smack/accesses.d/");
 313         switch(r) {
 314         case -ENOENT:
 315                 log_debug("Smack is not enabled in the kernel.");
 316                 return 0;
 317         case ENOENT:
 318                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 319                 return 0;
 320         case 0:
 321                 log_info("Successfully loaded Smack policies.");
 322                 break;
 323         default:
 324                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 325                 return 0;
 326         }
 327
 328 #ifdef SMACK_RUN_LABEL
 329         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 330         if (r < 0)
 331                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 332         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 333         if (r < 0)
 334                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 335         r = write_string_file("/sys/fs/smackfs/netlabel",
 336                               "0.0.0.0/0 " SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 337         if (r < 0)
 338                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 339         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", WRITE_STRING_FILE_DISABLE_BUFFER);
 340         if (r < 0)
 341                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 342 #endif
 343
 344         r = write_cipso2_rules("/etc/smack/cipso.d/");
 345         switch(r) {
 346         case -ENOENT:
 347                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 348                 return 0;
 349         case ENOENT:
 350                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 351                 break;
 352         case 0:
 353                 log_info("Successfully loaded Smack/CIPSO policies.");
 354                 break;
 355         default:
 356                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 357                 break;
 358         }
 359
 360         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 361         switch(r) {
 362         case -ENOENT:
 363                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 364                 return 0;
 365         case ENOENT:
 366                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 367                 break;
 368         case 0:
 369                 log_info("Successfully loaded Smack network host rules.");
 370                 break;
 371         default:
 372                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 373                 break;
 374         }
 375
 376         r = write_onlycap_list();
 377         switch(r) {
 378         case -ENOENT:
 379                 log_debug("Smack is not enabled in the kernel.");
 380                 break;
 381         case ENOENT:
 382                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 383                 break;
 384         case 0:
 385                 log_info("Successfully wrote Smack onlycap list.");
 386                 break;
 387         default:
 388                 log_emergency_errno(r, "Failed to write Smack onlycap list: %m");
 389                 return r;
 390         }
 391
 392         *loaded_policy = true;
 393
 394 #endif
 395
 396         return 0;
 397 }