]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
2ffadd3c Y |
2 | |
3 | #include <errno.h> | |
4 | #if HAVE_APPARMOR | |
5 | # include <sys/apparmor.h> | |
6 | #endif | |
7 | #include <unistd.h> | |
8 | ||
9 | #include "apparmor-setup.h" | |
10 | #include "apparmor-util.h" | |
11 | #include "fd-util.h" | |
12 | #include "fileio.h" | |
13 | #include "log.h" | |
14 | #include "macro.h" | |
15 | #include "string-util.h" | |
16 | #include "strv.h" | |
17 | ||
18 | #if HAVE_APPARMOR | |
fd421c4a ZJS |
19 | DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_policy_cache *, aa_policy_cache_unref, NULL); |
20 | DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_features *, aa_features_unref, NULL); | |
2ffadd3c Y |
21 | #endif |
22 | ||
23 | int mac_apparmor_setup(void) { | |
24 | #if HAVE_APPARMOR | |
2ffadd3c Y |
25 | _cleanup_(aa_policy_cache_unrefp) aa_policy_cache *policy_cache = NULL; |
26 | _cleanup_(aa_features_unrefp) aa_features *features = NULL; | |
2ffadd3c | 27 | _cleanup_free_ char *current_profile = NULL, *cache_dir_path = NULL; |
fd421c4a | 28 | int r; |
2ffadd3c Y |
29 | |
30 | if (!mac_apparmor_use()) { | |
31 | log_debug("AppArmor either not supported by the kernel or disabled."); | |
32 | return 0; | |
33 | } | |
34 | ||
35 | /* To enable LSM stacking a patch to the kernel is proposed to create a | |
36 | * per-LSM subdirectory to distinguish between the LSMs. Therefore, we | |
37 | * read the file from the LSM specific directory first and only if that | |
38 | * fails the one from the generic directory. | |
39 | */ | |
40 | FOREACH_STRING(current_file, "/proc/self/attr/apparmor/current", "/proc/self/attr/current") { | |
41 | r = read_one_line_file(current_file, ¤t_profile); | |
42 | if (r == -ENOENT) | |
43 | continue; | |
44 | else if (r < 0) | |
45 | log_warning_errno(r, "Failed to read current AppArmor profile from file %s, ignoring: %m", current_file); | |
46 | else | |
47 | break; | |
48 | } | |
49 | if (!current_profile) { | |
50 | log_warning("Failed to get the current AppArmor profile of systemd from /proc/self/attr/apparmor/current or /proc/self/attr/current, ignoring."); | |
51 | return 0; | |
52 | } | |
53 | if (!streq(current_profile, "unconfined")) { | |
54 | log_debug("We are already confined in an AppArmor profile."); | |
55 | return 0; | |
56 | } | |
57 | ||
58 | r = aa_features_new_from_kernel(&features); | |
59 | if (r < 0) { | |
60 | log_warning_errno(errno, "Failed to get the AppArmor feature set from the kernel, ignoring: %m"); | |
61 | return 0; | |
62 | } | |
63 | cache_dir_path = aa_policy_cache_dir_path_preview(features, AT_FDCWD, "/etc/apparmor/earlypolicy"); | |
64 | if (!cache_dir_path) { | |
65 | log_debug_errno(errno, "Failed to get the path of the early AppArmor policy cache directory."); | |
66 | return 0; | |
67 | } | |
68 | ||
69 | /* aa_policy_cache_new will internally use the same path as aa_policy_cache_dir_path_preview has returned. */ | |
70 | r = aa_policy_cache_new(&policy_cache, features, AT_FDCWD, "/etc/apparmor/earlypolicy", 0); | |
71 | if (r < 0) { | |
72 | if (errno == ENOENT) { | |
73 | log_debug_errno(errno, "The early AppArmor policy cache directory %s does not exist.", cache_dir_path); | |
74 | return 0; | |
75 | } | |
76 | log_warning_errno(errno, "Failed to create a new AppArmor policy cache, ignoring: %m"); | |
77 | return 0; | |
78 | } | |
79 | r = aa_policy_cache_replace_all(policy_cache, NULL); | |
80 | if (r < 0) { | |
81 | log_warning_errno(errno, "Failed to load the profiles from the early AppArmor policy cache directory %s, ignoring: %m", cache_dir_path); | |
82 | return 0; | |
83 | } | |
84 | ||
85 | log_info("Successfully loaded all binary profiles from AppArmor early policy cache at %s.", cache_dir_path); | |
86 | ||
87 | r = aa_change_profile("systemd"); | |
88 | if (r < 0) { | |
89 | if (errno == ENOENT) | |
90 | log_debug_errno(errno, "Failed to change to AppArmor profile 'systemd'. Please ensure that one of the binary profile files in policy cache directory %s contains a profile with that name.", cache_dir_path); | |
91 | else | |
92 | log_error_errno(errno, "Failed to change to AppArmor profile 'systemd': %m"); | |
93 | return 0; | |
94 | } | |
95 | ||
96 | log_info("Changed to AppArmor profile systemd."); | |
97 | #endif | |
98 | return 0; | |
99 | } |