src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright © 2013 Intel Corporation
   4   Authors:
   5         Nathaniel Chen <nathaniel.chen@intel.com>
   6 ***/
   7
   8 #include <dirent.h>
   9 #include <errno.h>
  10 #include <fcntl.h>
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <unistd.h>
  15
  16 #include "alloc-util.h"
  17 #include "dirent-util.h"
  18 #include "fd-util.h"
  19 #include "fileio.h"
  20 #include "log.h"
  21 #include "macro.h"
  22 #include "smack-setup.h"
  23 #include "string-util.h"
  24 #include "util.h"
  25
  26 #if ENABLE_SMACK
  27
  28 static int fdopen_unlocked_at(int dfd, const char *dir, const char *name, int *status, FILE **ret_file) {
  29         int fd, r;
  30         FILE *f;
  31
  32         fd = openat(dfd, name, O_RDONLY|O_CLOEXEC);
  33         if (fd < 0) {
  34                 if (*status == 0)
  35                         *status = -errno;
  36
  37                 return log_warning_errno(errno, "Failed to open \"%s/%s\": %m", dir, name);
  38         }
  39
  40         r = fdopen_unlocked(fd, "r", &f);
  41         if (r < 0) {
  42                 if (*status == 0)
  43                         *status = r;
  44
  45                 safe_close(fd);
  46                 return log_error_errno(r, "Failed to open \"%s/%s\": %m", dir, name);
  47         }
  48
  49         *ret_file = f;
  50         return 0;
  51 }
  52
  53 static int write_access2_rules(const char *srcdir) {
  54         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  55         _cleanup_closedir_ DIR *dir = NULL;
  56         struct dirent *entry;
  57         int dfd = -1, r = 0;
  58
  59         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  60         if (load2_fd < 0)  {
  61                 if (errno != ENOENT)
  62                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  63                 return -errno; /* negative error */
  64         }
  65
  66         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  67         if (change_fd < 0)  {
  68                 if (errno != ENOENT)
  69                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  70                 return -errno; /* negative error */
  71         }
  72
  73         /* write rules to load2 or change-rule from every file in the directory */
  74         dir = opendir(srcdir);
  75         if (!dir) {
  76                 if (errno != ENOENT)
  77                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  78                 return errno; /* positive on purpose */
  79         }
  80
  81         dfd = dirfd(dir);
  82         assert(dfd >= 0);
  83
  84         FOREACH_DIRENT(entry, dir, return 0) {
  85                 _cleanup_fclose_ FILE *policy = NULL;
  86
  87                 dirent_ensure_type(dir, entry);
  88                 if (!dirent_is_file(entry))
  89                         continue;
  90
  91                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
  92                         continue;
  93
  94                 /* load2 write rules in the kernel require a line buffered stream */
  95                 for (;;) {
  96                         _cleanup_free_ char *buf = NULL, *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
  97                         int q;
  98
  99                         q = read_line(policy, NAME_MAX, &buf);
 100                         if (q < 0)
 101                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 102                         if (q == 0)
 103                                 break;
 104
 105                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 106                                 continue;
 107
 108                         /* if 3 args -> load rule   : subject object access1 */
 109                         /* if 4 args -> change rule : subject object access1 access2 */
 110                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 111                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 112                                 continue;
 113                         }
 114
 115                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 116                                 if (r == 0)
 117                                         r = -errno;
 118                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s': %m",
 119                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 120                         }
 121                 }
 122         }
 123
 124         return r;
 125 }
 126
 127 static int write_cipso2_rules(const char *srcdir) {
 128         _cleanup_close_ int cipso2_fd = -1;
 129         _cleanup_closedir_ DIR *dir = NULL;
 130         struct dirent *entry;
 131         int dfd = -1, r = 0;
 132
 133         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 134         if (cipso2_fd < 0)  {
 135                 if (errno != ENOENT)
 136                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 137                 return -errno; /* negative error */
 138         }
 139
 140         /* write rules to cipso2 from every file in the directory */
 141         dir = opendir(srcdir);
 142         if (!dir) {
 143                 if (errno != ENOENT)
 144                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 145                 return errno; /* positive on purpose */
 146         }
 147
 148         dfd = dirfd(dir);
 149         assert(dfd >= 0);
 150
 151         FOREACH_DIRENT(entry, dir, return 0) {
 152                 _cleanup_fclose_ FILE *policy = NULL;
 153
 154                 dirent_ensure_type(dir, entry);
 155                 if (!dirent_is_file(entry))
 156                         continue;
 157
 158                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
 159                         continue;
 160
 161                 /* cipso2 write rules in the kernel require a line buffered stream */
 162                 for (;;) {
 163                         _cleanup_free_ char *buf = NULL;
 164                         int q;
 165
 166                         q = read_line(policy, NAME_MAX, &buf);
 167                         if (q < 0)
 168                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 169                         if (q == 0)
 170                                 break;
 171
 172                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 173                                 continue;
 174
 175                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 176                                 if (r == 0)
 177                                         r = -errno;
 178                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s': %m",
 179                                                 buf, entry->d_name);
 180                                 break;
 181                         }
 182                 }
 183         }
 184
 185         return r;
 186 }
 187
 188 static int write_netlabel_rules(const char *srcdir) {
 189         _cleanup_fclose_ FILE *dst = NULL;
 190         _cleanup_closedir_ DIR *dir = NULL;
 191         struct dirent *entry;
 192         int dfd = -1, r = 0;
 193
 194         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 195         if (!dst)  {
 196                 if (errno != ENOENT)
 197                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 198                 return -errno; /* negative error */
 199         }
 200
 201         /* write rules to dst from every file in the directory */
 202         dir = opendir(srcdir);
 203         if (!dir) {
 204                 if (errno != ENOENT)
 205                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 206                 return errno; /* positive on purpose */
 207         }
 208
 209         dfd = dirfd(dir);
 210         assert(dfd >= 0);
 211
 212         FOREACH_DIRENT(entry, dir, return 0) {
 213                 _cleanup_fclose_ FILE *policy = NULL;
 214
 215                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
 216                         continue;
 217
 218                 /* load2 write rules in the kernel require a line buffered stream */
 219                 for (;;) {
 220                         _cleanup_free_ char *buf = NULL;
 221                         int q;
 222
 223                         q = read_line(policy, NAME_MAX, &buf);
 224                         if (q < 0)
 225                                 return log_error_errno(q, "Failed to read line from %s: %m", entry->d_name);
 226                         if (q == 0)
 227                                 break;
 228
 229                         if (!fputs(buf, dst)) {
 230                                 if (r == 0)
 231                                         r = -EINVAL;
 232                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel: %m");
 233                                 break;
 234                         }
 235                         q = fflush_and_check(dst);
 236                         if (q < 0) {
 237                                 if (r == 0)
 238                                         r = q;
 239                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 240                                 break;
 241                         }
 242                 }
 243         }
 244
 245         return r;
 246 }
 247
 248 static int write_onlycap_list(void) {
 249         _cleanup_close_ int onlycap_fd = -1;
 250         _cleanup_free_ char *list = NULL;
 251         _cleanup_fclose_ FILE *f = NULL;
 252         size_t len = 0, allocated = 0;
 253         int r;
 254
 255         f = fopen("/etc/smack/onlycap", "re");
 256         if (!f) {
 257                 if (errno != ENOENT)
 258                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap': %m");
 259
 260                 return errno == ENOENT ? ENOENT : -errno;
 261         }
 262
 263         for (;;) {
 264                 _cleanup_free_ char *buf = NULL;
 265                 size_t l;
 266
 267                 r = read_line(f, LONG_LINE_MAX, &buf);
 268                 if (r < 0)
 269                         return log_error_errno(r, "Failed to read line from /etc/smack/onlycap: %m");
 270                 if (r == 0)
 271                         break;
 272
 273                 if (isempty(buf) || strchr(COMMENTS, *buf))
 274                         continue;
 275
 276                 l = strlen(buf);
 277                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 278                         return log_oom();
 279
 280                 stpcpy(list + len, buf)[0] = ' ';
 281                 len += l + 1;
 282         }
 283
 284         if (len == 0)
 285                 return 0;
 286
 287         list[len - 1] = 0;
 288
 289         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 290         if (onlycap_fd < 0) {
 291                 if (errno != ENOENT)
 292                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap': %m");
 293                 return -errno; /* negative error */
 294         }
 295
 296         r = write(onlycap_fd, list, len);
 297         if (r < 0)
 298                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap': %m", list);
 299
 300         return 0;
 301 }
 302
 303 #endif
 304
 305 int mac_smack_setup(bool *loaded_policy) {
 306
 307 #if ENABLE_SMACK
 308
 309         int r;
 310
 311         assert(loaded_policy);
 312
 313         r = write_access2_rules("/etc/smack/accesses.d/");
 314         switch(r) {
 315         case -ENOENT:
 316                 log_debug("Smack is not enabled in the kernel.");
 317                 return 0;
 318         case ENOENT:
 319                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 320                 return 0;
 321         case 0:
 322                 log_info("Successfully loaded Smack policies.");
 323                 break;
 324         default:
 325                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 326                 return 0;
 327         }
 328
 329 #ifdef SMACK_RUN_LABEL
 330         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 331         if (r < 0)
 332                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 333         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 334         if (r < 0)
 335                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 336         r = write_string_file("/sys/fs/smackfs/netlabel",
 337                               "0.0.0.0/0 " SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 338         if (r < 0)
 339                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 340         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", WRITE_STRING_FILE_DISABLE_BUFFER);
 341         if (r < 0)
 342                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 343 #endif
 344
 345         r = write_cipso2_rules("/etc/smack/cipso.d/");
 346         switch(r) {
 347         case -ENOENT:
 348                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 349                 return 0;
 350         case ENOENT:
 351                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 352                 break;
 353         case 0:
 354                 log_info("Successfully loaded Smack/CIPSO policies.");
 355                 break;
 356         default:
 357                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 358                 break;
 359         }
 360
 361         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 362         switch(r) {
 363         case -ENOENT:
 364                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 365                 return 0;
 366         case ENOENT:
 367                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 368                 break;
 369         case 0:
 370                 log_info("Successfully loaded Smack network host rules.");
 371                 break;
 372         default:
 373                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 374                 break;
 375         }
 376
 377         r = write_onlycap_list();
 378         switch(r) {
 379         case -ENOENT:
 380                 log_debug("Smack is not enabled in the kernel.");
 381                 break;
 382         case ENOENT:
 383                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 384                 break;
 385         case 0:
 386                 log_info("Successfully wrote Smack onlycap list.");
 387                 break;
 388         default:
 389                 log_emergency_errno(r, "Failed to write Smack onlycap list: %m");
 390                 return r;
 391         }
 392
 393         *loaded_policy = true;
 394
 395 #endif
 396
 397         return 0;
 398 }