src/core/apparmor-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #if HAVE_APPARMOR
   5 #  include <sys/apparmor.h>
   6 #endif
   7 #include <unistd.h>
   8
   9 #include "apparmor-setup.h"
  10 #include "apparmor-util.h"
  11 #include "fd-util.h"
  12 #include "fileio.h"
  13 #include "log.h"
  14 #include "macro.h"
  15 #include "string-util.h"
  16 #include "strv.h"
  17
  18 #if HAVE_APPARMOR
  19 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_policy_cache *, aa_policy_cache_unref, NULL);
  20 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_features *, aa_features_unref, NULL);
  21 #endif
  22
  23 int mac_apparmor_setup(void) {
  24 #if HAVE_APPARMOR
  25         _cleanup_(aa_policy_cache_unrefp) aa_policy_cache *policy_cache = NULL;
  26         _cleanup_(aa_features_unrefp) aa_features *features = NULL;
  27         _cleanup_free_ char *current_profile = NULL, *cache_dir_path = NULL;
  28         int r;
  29
  30         if (!mac_apparmor_use()) {
  31                 log_debug("AppArmor either not supported by the kernel or disabled.");
  32                 return 0;
  33         }
  34
  35         /* To enable LSM stacking a patch to the kernel is proposed to create a
  36          * per-LSM subdirectory to distinguish between the LSMs. Therefore, we
  37          * read the file from the LSM specific directory first and only if that
  38          * fails the one from the generic directory.
  39          */
  40         FOREACH_STRING(current_file, "/proc/self/attr/apparmor/current", "/proc/self/attr/current") {
  41                 r = read_one_line_file(current_file, &current_profile);
  42                 if (r == -ENOENT)
  43                         continue;
  44                 else if (r < 0)
  45                         log_warning_errno(r, "Failed to read current AppArmor profile from file %s, ignoring: %m", current_file);
  46                 else
  47                         break;
  48         }
  49         if (!current_profile) {
  50                 log_warning("Failed to get the current AppArmor profile of systemd from /proc/self/attr/apparmor/current or /proc/self/attr/current, ignoring.");
  51                 return 0;
  52         }
  53         if (!streq(current_profile, "unconfined")) {
  54                 log_debug("We are already confined in an AppArmor profile.");
  55                 return 0;
  56         }
  57
  58         r = aa_features_new_from_kernel(&features);
  59         if (r < 0) {
  60                 log_warning_errno(errno, "Failed to get the AppArmor feature set from the kernel, ignoring: %m");
  61                 return 0;
  62         }
  63         cache_dir_path = aa_policy_cache_dir_path_preview(features, AT_FDCWD, "/etc/apparmor/earlypolicy");
  64         if (!cache_dir_path) {
  65                 log_debug_errno(errno, "Failed to get the path of the early AppArmor policy cache directory.");
  66                 return 0;
  67         }
  68
  69         /* aa_policy_cache_new will internally use the same path as aa_policy_cache_dir_path_preview has returned. */
  70         r = aa_policy_cache_new(&policy_cache, features, AT_FDCWD, "/etc/apparmor/earlypolicy", 0);
  71         if (r < 0) {
  72                 if (errno == ENOENT) {
  73                         log_debug_errno(errno, "The early AppArmor policy cache directory %s does not exist.", cache_dir_path);
  74                         return 0;
  75                 }
  76                 log_warning_errno(errno, "Failed to create a new AppArmor policy cache, ignoring: %m");
  77                 return 0;
  78         }
  79         r = aa_policy_cache_replace_all(policy_cache, NULL);
  80         if (r < 0) {
  81                 log_warning_errno(errno, "Failed to load the profiles from the early AppArmor policy cache directory %s, ignoring: %m", cache_dir_path);
  82                 return 0;
  83         }
  84
  85         log_info("Successfully loaded all binary profiles from AppArmor early policy cache at %s.", cache_dir_path);
  86
  87         r = aa_change_profile("systemd");
  88         if (r < 0) {
  89                 if (errno == ENOENT)
  90                         log_debug_errno(errno, "Failed to change to AppArmor profile 'systemd'. Please ensure that one of the binary profile files in policy cache directory %s contains a profile with that name.", cache_dir_path);
  91                 else
  92                         log_error_errno(errno, "Failed to change to AppArmor profile 'systemd': %m");
  93                 return 0;
  94         }
  95
  96         log_info("Changed to AppArmor profile systemd.");
  97 #endif
  98         return 0;
  99 }