src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright © 2013 Intel Corporation
   4   Authors:
   5         Nathaniel Chen <nathaniel.chen@intel.com>
   6 ***/
   7
   8 #include <dirent.h>
   9 #include <errno.h>
  10 #include <fcntl.h>
  11 #include <stdio.h>
  12 #include <stdio_ext.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15
  16 #include "alloc-util.h"
  17 #include "def.h"
  18 #include "dirent-util.h"
  19 #include "fd-util.h"
  20 #include "fileio.h"
  21 #include "log.h"
  22 #include "macro.h"
  23 #include "smack-setup.h"
  24 #include "string-util.h"
  25 #include "util.h"
  26
  27 #if ENABLE_SMACK
  28
  29 static int write_access2_rules(const char* srcdir) {
  30         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  31         _cleanup_closedir_ DIR *dir = NULL;
  32         struct dirent *entry;
  33         int dfd = -1;
  34         int r = 0;
  35
  36         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  37         if (load2_fd < 0)  {
  38                 if (errno != ENOENT)
  39                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  40                 return -errno; /* negative error */
  41         }
  42
  43         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  44         if (change_fd < 0)  {
  45                 if (errno != ENOENT)
  46                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  47                 return -errno; /* negative error */
  48         }
  49
  50         /* write rules to load2 or change-rule from every file in the directory */
  51         dir = opendir(srcdir);
  52         if (!dir) {
  53                 if (errno != ENOENT)
  54                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  55                 return errno; /* positive on purpose */
  56         }
  57
  58         dfd = dirfd(dir);
  59         assert(dfd >= 0);
  60
  61         FOREACH_DIRENT(entry, dir, return 0) {
  62                 int fd;
  63                 _cleanup_fclose_ FILE *policy = NULL;
  64
  65                 if (!dirent_is_file(entry))
  66                         continue;
  67
  68                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  69                 if (fd < 0) {
  70                         if (r == 0)
  71                                 r = -errno;
  72                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  73                         continue;
  74                 }
  75
  76                 policy = fdopen(fd, "re");
  77                 if (!policy) {
  78                         if (r == 0)
  79                                 r = -errno;
  80                         safe_close(fd);
  81                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  82                         continue;
  83                 }
  84
  85                 /* load2 write rules in the kernel require a line buffered stream */
  86                 for (;;) {
  87                         _cleanup_free_ char *buf = NULL, *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
  88                         int q;
  89
  90                         q = read_line(policy, NAME_MAX, &buf);
  91                         if (q < 0)
  92                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
  93                         if (q == 0)
  94                                 break;
  95
  96                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
  97                                 continue;
  98
  99                         /* if 3 args -> load rule   : subject object access1 */
 100                         /* if 4 args -> change rule : subject object access1 access2 */
 101                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 102                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 103                                 continue;
 104                         }
 105
 106                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 107                                 if (r == 0)
 108                                         r = -errno;
 109                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 110                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 111                         }
 112                 }
 113         }
 114
 115         return r;
 116 }
 117
 118 static int write_cipso2_rules(const char* srcdir) {
 119         _cleanup_close_ int cipso2_fd = -1;
 120         _cleanup_closedir_ DIR *dir = NULL;
 121         struct dirent *entry;
 122         int dfd = -1;
 123         int r = 0;
 124
 125         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 126         if (cipso2_fd < 0)  {
 127                 if (errno != ENOENT)
 128                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 129                 return -errno; /* negative error */
 130         }
 131
 132         /* write rules to cipso2 from every file in the directory */
 133         dir = opendir(srcdir);
 134         if (!dir) {
 135                 if (errno != ENOENT)
 136                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 137                 return errno; /* positive on purpose */
 138         }
 139
 140         dfd = dirfd(dir);
 141         assert(dfd >= 0);
 142
 143         FOREACH_DIRENT(entry, dir, return 0) {
 144                 int fd;
 145                 _cleanup_fclose_ FILE *policy = NULL;
 146
 147                 if (!dirent_is_file(entry))
 148                         continue;
 149
 150                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 151                 if (fd < 0) {
 152                         if (r == 0)
 153                                 r = -errno;
 154                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 155                         continue;
 156                 }
 157
 158                 policy = fdopen(fd, "re");
 159                 if (!policy) {
 160                         if (r == 0)
 161                                 r = -errno;
 162                         safe_close(fd);
 163                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 164                         continue;
 165                 }
 166
 167                 /* cipso2 write rules in the kernel require a line buffered stream */
 168                 for (;;) {
 169                         _cleanup_free_ char *buf = NULL;
 170                         int q;
 171
 172                         q = read_line(policy, NAME_MAX, &buf);
 173                         if (q < 0)
 174                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 175                         if (q == 0)
 176                                 break;
 177
 178                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 179                                 continue;
 180
 181                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 182                                 if (r == 0)
 183                                         r = -errno;
 184                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 185                                                 buf, entry->d_name);
 186                                 break;
 187                         }
 188                 }
 189         }
 190
 191         return r;
 192 }
 193
 194 static int write_netlabel_rules(const char* srcdir) {
 195         _cleanup_fclose_ FILE *dst = NULL;
 196         _cleanup_closedir_ DIR *dir = NULL;
 197         struct dirent *entry;
 198         int dfd = -1;
 199         int r = 0;
 200
 201         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 202         if (!dst)  {
 203                 if (errno != ENOENT)
 204                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 205                 return -errno; /* negative error */
 206         }
 207
 208         /* write rules to dst from every file in the directory */
 209         dir = opendir(srcdir);
 210         if (!dir) {
 211                 if (errno != ENOENT)
 212                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 213                 return errno; /* positive on purpose */
 214         }
 215
 216         dfd = dirfd(dir);
 217         assert(dfd >= 0);
 218
 219         FOREACH_DIRENT(entry, dir, return 0) {
 220                 int fd;
 221                 _cleanup_fclose_ FILE *policy = NULL;
 222
 223                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 224                 if (fd < 0) {
 225                         if (r == 0)
 226                                 r = -errno;
 227                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 228                         continue;
 229                 }
 230
 231                 policy = fdopen(fd, "re");
 232                 if (!policy) {
 233                         if (r == 0)
 234                                 r = -errno;
 235                         safe_close(fd);
 236                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 237                         continue;
 238                 }
 239
 240                 (void) __fsetlocking(policy, FSETLOCKING_BYCALLER);
 241
 242                 /* load2 write rules in the kernel require a line buffered stream */
 243                 for (;;) {
 244                         _cleanup_free_ char *buf = NULL;
 245                         int q;
 246
 247                         q = read_line(policy, NAME_MAX, &buf);
 248                         if (q < 0)
 249                                 return log_error_errno(q, "Failed to read line from %s: %m", entry->d_name);
 250                         if (q == 0)
 251                                 break;
 252
 253                         if (!fputs(buf, dst)) {
 254                                 if (r == 0)
 255                                         r = -EINVAL;
 256                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
 257                                 break;
 258                         }
 259                         q = fflush_and_check(dst);
 260                         if (q < 0) {
 261                                 if (r == 0)
 262                                         r = q;
 263                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 264                                 break;
 265                         }
 266                 }
 267         }
 268
 269         return r;
 270 }
 271
 272 static int write_onlycap_list(void) {
 273         _cleanup_close_ int onlycap_fd = -1;
 274         _cleanup_free_ char *list = NULL;
 275         _cleanup_fclose_ FILE *f = NULL;
 276         size_t len = 0, allocated = 0;
 277         int r;
 278
 279         f = fopen("/etc/smack/onlycap", "re");
 280         if (!f) {
 281                 if (errno != ENOENT)
 282                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap': %m");
 283
 284                 return errno == ENOENT ? ENOENT : -errno;
 285         }
 286
 287         for (;;) {
 288                 _cleanup_free_ char *buf = NULL;
 289                 size_t l;
 290
 291                 r = read_line(f, LONG_LINE_MAX, &buf);
 292                 if (r < 0)
 293                         return log_error_errno(r, "Failed to read line from /etc/smack/onlycap: %m");
 294                 if (r == 0)
 295                         break;
 296
 297                 if (isempty(buf) || strchr(COMMENTS, *buf))
 298                         continue;
 299
 300                 l = strlen(buf);
 301                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 302                         return log_oom();
 303
 304                 stpcpy(list + len, buf)[0] = ' ';
 305                 len += l + 1;
 306         }
 307
 308         if (len == 0)
 309                 return 0;
 310
 311         list[len - 1] = 0;
 312
 313         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 314         if (onlycap_fd < 0) {
 315                 if (errno != ENOENT)
 316                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap': %m");
 317                 return -errno; /* negative error */
 318         }
 319
 320         r = write(onlycap_fd, list, len);
 321         if (r < 0)
 322                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap': %m", list);
 323
 324         return 0;
 325 }
 326
 327 #endif
 328
 329 int mac_smack_setup(bool *loaded_policy) {
 330
 331 #if ENABLE_SMACK
 332
 333         int r;
 334
 335         assert(loaded_policy);
 336
 337         r = write_access2_rules("/etc/smack/accesses.d/");
 338         switch(r) {
 339         case -ENOENT:
 340                 log_debug("Smack is not enabled in the kernel.");
 341                 return 0;
 342         case ENOENT:
 343                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 344                 return 0;
 345         case 0:
 346                 log_info("Successfully loaded Smack policies.");
 347                 break;
 348         default:
 349                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 350                 return 0;
 351         }
 352
 353 #ifdef SMACK_RUN_LABEL
 354         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 355         if (r < 0)
 356                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 357         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 358         if (r < 0)
 359                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 360         r = write_string_file("/sys/fs/smackfs/netlabel",
 361                               "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 362         if (r < 0)
 363                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 364         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 365         if (r < 0)
 366                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 367 #endif
 368
 369         r = write_cipso2_rules("/etc/smack/cipso.d/");
 370         switch(r) {
 371         case -ENOENT:
 372                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 373                 return 0;
 374         case ENOENT:
 375                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 376                 break;
 377         case 0:
 378                 log_info("Successfully loaded Smack/CIPSO policies.");
 379                 break;
 380         default:
 381                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 382                 break;
 383         }
 384
 385         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 386         switch(r) {
 387         case -ENOENT:
 388                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 389                 return 0;
 390         case ENOENT:
 391                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 392                 break;
 393         case 0:
 394                 log_info("Successfully loaded Smack network host rules.");
 395                 break;
 396         default:
 397                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 398                 break;
 399         }
 400
 401         r = write_onlycap_list();
 402         switch(r) {
 403         case -ENOENT:
 404                 log_debug("Smack is not enabled in the kernel.");
 405                 break;
 406         case ENOENT:
 407                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 408                 break;
 409         case 0:
 410                 log_info("Successfully wrote Smack onlycap list.");
 411                 break;
 412         default:
 413                 log_emergency_errno(r, "Failed to write Smack onlycap list.");
 414                 return r;
 415         }
 416
 417         *loaded_policy = true;
 418
 419 #endif
 420
 421         return 0;
 422 }