]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/apparmor-setup.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
5 # include <sys/apparmor.h>
9 #include "apparmor-setup.h"
10 #include "apparmor-util.h"
15 #include "string-util.h"
19 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL ( aa_policy_cache
*, aa_policy_cache_unref
, NULL
);
20 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL ( aa_features
*, aa_features_unref
, NULL
);
23 int mac_apparmor_setup ( void ) {
25 _cleanup_ ( aa_policy_cache_unrefp
) aa_policy_cache
* policy_cache
= NULL
;
26 _cleanup_ ( aa_features_unrefp
) aa_features
* features
= NULL
;
27 _cleanup_free_
char * current_profile
= NULL
, * cache_dir_path
= NULL
;
30 if (! mac_apparmor_use ()) {
31 log_debug ( "AppArmor either not supported by the kernel or disabled." );
35 /* To enable LSM stacking a patch to the kernel is proposed to create a
36 * per-LSM subdirectory to distinguish between the LSMs. Therefore, we
37 * read the file from the LSM specific directory first and only if that
38 * fails the one from the generic directory.
40 FOREACH_STRING ( current_file
, "/proc/self/attr/apparmor/current" , "/proc/self/attr/current" ) {
41 r
= read_one_line_file ( current_file
, & current_profile
);
45 log_warning_errno ( r
, "Failed to read current AppArmor profile from file %s, ignoring: %m" , current_file
);
49 if (! current_profile
) {
50 log_warning ( "Failed to get the current AppArmor profile of systemd from /proc/self/attr/apparmor/current or /proc/self/attr/current, ignoring." );
53 if (! streq ( current_profile
, "unconfined" )) {
54 log_debug ( "We are already confined in an AppArmor profile." );
58 r
= aa_features_new_from_kernel (& features
);
60 log_warning_errno ( errno
, "Failed to get the AppArmor feature set from the kernel, ignoring: %m" );
63 cache_dir_path
= aa_policy_cache_dir_path_preview ( features
, AT_FDCWD
, "/etc/apparmor/earlypolicy" );
64 if (! cache_dir_path
) {
65 log_debug_errno ( errno
, "Failed to get the path of the early AppArmor policy cache directory." );
69 /* aa_policy_cache_new will internally use the same path as aa_policy_cache_dir_path_preview has returned. */
70 r
= aa_policy_cache_new (& policy_cache
, features
, AT_FDCWD
, "/etc/apparmor/earlypolicy" , 0 );
72 if ( errno
== ENOENT
) {
73 log_debug_errno ( errno
, "The early AppArmor policy cache directory %s does not exist." , cache_dir_path
);
76 log_warning_errno ( errno
, "Failed to create a new AppArmor policy cache, ignoring: %m" );
79 r
= aa_policy_cache_replace_all ( policy_cache
, NULL
);
81 log_warning_errno ( errno
, "Failed to load the profiles from the early AppArmor policy cache directory %s, ignoring: %m" , cache_dir_path
);
85 log_info ( "Successfully loaded all binary profiles from AppArmor early policy cache at %s." , cache_dir_path
);
87 r
= aa_change_profile ( "systemd" );
90 log_debug_errno ( errno
, "Failed to change to AppArmor profile 'systemd'. Please ensure that one of the binary profile files in policy cache directory %s contains a profile with that name." , cache_dir_path
);
92 log_error_errno ( errno
, "Failed to change to AppArmor profile 'systemd': %m" );
96 log_info ( "Changed to AppArmor profile systemd." );