src/core/selinux-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <stdio.h>
   5 #include <unistd.h>
   6
   7 #if HAVE_SELINUX
   8 #include <selinux/selinux.h>
   9 #endif
  10
  11 #include "log.h"
  12 #include "macro.h"
  13 #include "selinux-setup.h"
  14 #include "selinux-util.h"
  15 #include "string-util.h"
  16 #include "time-util.h"
  17 #include "util.h"
  18
  19 #if HAVE_SELINUX
  20 _printf_(2,3)
  21 static int null_log(int type, const char *fmt, ...) {
  22         return 0;
  23 }
  24 #endif
  25
  26 int mac_selinux_setup(bool *loaded_policy) {
  27
  28 #if HAVE_SELINUX
  29         int enforce = 0;
  30         usec_t before_load, after_load;
  31         char *con;
  32         int r;
  33         static const union selinux_callback cb = {
  34                 .func_log = null_log,
  35         };
  36
  37         bool initialized = false;
  38
  39         assert(loaded_policy);
  40
  41         /* Turn off all of SELinux' own logging, we want to do that */
  42         selinux_set_callback(SELINUX_CB_LOG, cb);
  43
  44         /* Don't load policy in the initrd if we don't appear to have
  45          * it.  For the real root, we check below if we've already
  46          * loaded policy, and return gracefully.
  47          */
  48         if (in_initrd() && access(selinux_path(), F_OK) < 0)
  49                 return 0;
  50
  51         /* Already initialized by somebody else? */
  52         r = getcon_raw(&con);
  53         /* getcon_raw can return 0, and still give us a NULL pointer if
  54          * /proc/self/attr/current is empty. SELinux guarantees this won't
  55          * happen, but that file isn't specific to SELinux, and may be provided
  56          * by some other arbitrary LSM with different semantics. */
  57         if (r == 0 && con) {
  58                 initialized = !streq(con, "kernel");
  59                 freecon(con);
  60         }
  61
  62         /* Make sure we have no fds open while loading the policy and
  63          * transitioning */
  64         log_close();
  65
  66         /* Now load the policy */
  67         before_load = now(CLOCK_MONOTONIC);
  68         r = selinux_init_load_policy(&enforce);
  69         if (r == 0) {
  70                 _cleanup_(mac_selinux_freep) char *label = NULL;
  71                 char timespan[FORMAT_TIMESPAN_MAX];
  72
  73                 mac_selinux_retest();
  74
  75                 /* Transition to the new context */
  76                 r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);
  77                 if (r < 0 || !label) {
  78                         log_open();
  79                         log_error("Failed to compute init label, ignoring.");
  80                 } else {
  81                         r = setcon_raw(label);
  82
  83                         log_open();
  84                         if (r < 0)
  85                                 log_error("Failed to transition into init label '%s', ignoring.", label);
  86                 }
  87
  88                 after_load = now(CLOCK_MONOTONIC);
  89
  90                 log_info("Successfully loaded SELinux policy in %s.",
  91                          format_timespan(timespan, sizeof(timespan), after_load - before_load, 0));
  92
  93                 *loaded_policy = true;
  94
  95         } else {
  96                 log_open();
  97
  98                 if (enforce > 0) {
  99                         if (!initialized)
 100                                 return log_emergency_errno(SYNTHETIC_ERRNO(EIO),
 101                                                            "Failed to load SELinux policy.");
 102
 103                         log_warning("Failed to load new SELinux policy. Continuing with old policy.");
 104                 } else
 105                         log_debug("Unable to load SELinux policy. Ignoring.");
 106         }
 107 #endif
 108
 109         return 0;
 110 }