]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/smack-setup.c
2 This file is part of systemd.
4 Copyright (C) 2013 Intel Corporation
6 Nathaniel Chen <nathaniel.chen@intel.com>
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published
10 by the Free Software Foundation; either version 2.1 of the License,
11 or (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
29 #include "alloc-util.h"
30 #include "dirent-util.h"
35 #include "smack-setup.h"
36 #include "string-util.h"
41 static int write_access2_rules(const char* srcdir
) {
42 _cleanup_close_
int load2_fd
= -1, change_fd
= -1;
43 _cleanup_closedir_
DIR *dir
= NULL
;
49 load2_fd
= open("/sys/fs/smackfs/load2", O_RDWR
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
52 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/load2': %m");
53 return -errno
; /* negative error */
56 change_fd
= open("/sys/fs/smackfs/change-rule", O_RDWR
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
59 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/change-rule': %m");
60 return -errno
; /* negative error */
63 /* write rules to load2 or change-rule from every file in the directory */
64 dir
= opendir(srcdir
);
67 log_warning_errno(errno
, "Failed to opendir '%s': %m", srcdir
);
68 return errno
; /* positive on purpose */
74 FOREACH_DIRENT(entry
, dir
, return 0) {
76 _cleanup_fclose_
FILE *policy
= NULL
;
78 if (!dirent_is_file(entry
))
81 fd
= openat(dfd
, entry
->d_name
, O_RDONLY
|O_CLOEXEC
);
85 log_warning_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
89 policy
= fdopen(fd
, "re");
94 log_error_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
98 /* load2 write rules in the kernel require a line buffered stream */
99 FOREACH_LINE(buf
, policy
,
100 log_error_errno(errno
, "Failed to read line from '%s': %m",
103 _cleanup_free_
char *sbj
= NULL
, *obj
= NULL
, *acc1
= NULL
, *acc2
= NULL
;
105 if (isempty(truncate_nl(buf
)))
108 /* if 3 args -> load rule : subject object access1 */
109 /* if 4 args -> change rule : subject object access1 access2 */
110 if (sscanf(buf
, "%ms %ms %ms %ms", &sbj
, &obj
, &acc1
, &acc2
) < 3) {
111 log_error_errno(errno
, "Failed to parse rule '%s' in '%s', ignoring.", buf
, entry
->d_name
);
115 if (write(isempty(acc2
) ? load2_fd
: change_fd
, buf
, strlen(buf
)) < 0) {
118 log_error_errno(errno
, "Failed to write '%s' to '%s' in '%s'",
119 buf
, isempty(acc2
) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry
->d_name
);
127 static int write_cipso2_rules(const char* srcdir
) {
128 _cleanup_close_
int cipso2_fd
= -1;
129 _cleanup_closedir_
DIR *dir
= NULL
;
130 struct dirent
*entry
;
135 cipso2_fd
= open("/sys/fs/smackfs/cipso2", O_RDWR
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
138 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/cipso2': %m");
139 return -errno
; /* negative error */
142 /* write rules to cipso2 from every file in the directory */
143 dir
= opendir(srcdir
);
146 log_warning_errno(errno
, "Failed to opendir '%s': %m", srcdir
);
147 return errno
; /* positive on purpose */
153 FOREACH_DIRENT(entry
, dir
, return 0) {
155 _cleanup_fclose_
FILE *policy
= NULL
;
157 if (!dirent_is_file(entry
))
160 fd
= openat(dfd
, entry
->d_name
, O_RDONLY
|O_CLOEXEC
);
164 log_error_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
168 policy
= fdopen(fd
, "re");
173 log_error_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
177 /* cipso2 write rules in the kernel require a line buffered stream */
178 FOREACH_LINE(buf
, policy
,
179 log_error_errno(errno
, "Failed to read line from '%s': %m",
182 if (isempty(truncate_nl(buf
)))
185 if (write(cipso2_fd
, buf
, strlen(buf
)) < 0) {
188 log_error_errno(errno
, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
198 static int write_netlabel_rules(const char* srcdir
) {
199 _cleanup_fclose_
FILE *dst
= NULL
;
200 _cleanup_closedir_
DIR *dir
= NULL
;
201 struct dirent
*entry
;
206 dst
= fopen("/sys/fs/smackfs/netlabel", "we");
209 log_warning_errno(errno
, "Failed to open /sys/fs/smackfs/netlabel: %m");
210 return -errno
; /* negative error */
213 /* write rules to dst from every file in the directory */
214 dir
= opendir(srcdir
);
217 log_warning_errno(errno
, "Failed to opendir %s: %m", srcdir
);
218 return errno
; /* positive on purpose */
224 FOREACH_DIRENT(entry
, dir
, return 0) {
226 _cleanup_fclose_
FILE *policy
= NULL
;
228 fd
= openat(dfd
, entry
->d_name
, O_RDONLY
|O_CLOEXEC
);
232 log_warning_errno(errno
, "Failed to open %s: %m", entry
->d_name
);
236 policy
= fdopen(fd
, "re");
241 log_error_errno(errno
, "Failed to open %s: %m", entry
->d_name
);
245 /* load2 write rules in the kernel require a line buffered stream */
246 FOREACH_LINE(buf
, policy
,
247 log_error_errno(errno
, "Failed to read line from %s: %m",
249 if (!fputs_unlocked(buf
, dst
)) {
252 log_error_errno(errno
, "Failed to write line to /sys/fs/smackfs/netlabel");
258 log_error_errno(errno
, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
267 static int write_onlycap_list(void) {
268 _cleanup_close_
int onlycap_fd
= -1;
269 _cleanup_free_
char *list
= NULL
;
270 _cleanup_fclose_
FILE *f
= NULL
;
271 size_t len
= 0, allocated
= 0;
275 f
= fopen("/etc/smack/onlycap", "re");
278 log_warning_errno(errno
, "Failed to read '/etc/smack/onlycap'");
279 return errno
== ENOENT
? ENOENT
: -errno
;
282 FOREACH_LINE(buf
, f
, return -errno
) {
285 if (isempty(truncate_nl(buf
)) || strchr(COMMENTS
, *buf
))
289 if (!GREEDY_REALLOC(list
, allocated
, len
+ l
+ 1))
292 stpcpy(list
+ len
, buf
)[0] = ' ';
301 onlycap_fd
= open("/sys/fs/smackfs/onlycap", O_WRONLY
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
302 if (onlycap_fd
< 0) {
304 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/onlycap'");
305 return -errno
; /* negative error */
308 r
= write(onlycap_fd
, list
, len
);
310 return log_error_errno(errno
, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list
);
317 int mac_smack_setup(bool *loaded_policy
) {
323 assert(loaded_policy
);
325 r
= write_access2_rules("/etc/smack/accesses.d/");
328 log_debug("Smack is not enabled in the kernel.");
331 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
334 log_info("Successfully loaded Smack policies.");
337 log_warning_errno(r
, "Failed to load Smack access rules, ignoring: %m");
341 #ifdef SMACK_RUN_LABEL
342 r
= write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL
, 0);
344 log_warning_errno(r
, "Failed to set SMACK label \"" SMACK_RUN_LABEL
"\" on self: %m");
345 r
= write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL
, 0);
347 log_warning_errno(r
, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL
"\": %m");
348 r
= write_string_file("/sys/fs/smackfs/netlabel",
349 "0.0.0.0/0 " SMACK_RUN_LABEL
, 0);
351 log_warning_errno(r
, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL
"\": %m");
352 r
= write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
354 log_warning_errno(r
, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
357 r
= write_cipso2_rules("/etc/smack/cipso.d/");
360 log_debug("Smack/CIPSO is not enabled in the kernel.");
363 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
366 log_info("Successfully loaded Smack/CIPSO policies.");
369 log_warning_errno(r
, "Failed to load Smack/CIPSO access rules, ignoring: %m");
373 r
= write_netlabel_rules("/etc/smack/netlabel.d/");
376 log_debug("Smack/CIPSO is not enabled in the kernel.");
379 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
382 log_info("Successfully loaded Smack network host rules.");
385 log_warning_errno(r
, "Failed to load Smack network host rules: %m, ignoring.");
389 r
= write_onlycap_list();
392 log_debug("Smack is not enabled in the kernel.");
395 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
398 log_info("Successfully wrote Smack onlycap list.");
401 log_emergency_errno(r
, "Failed to write Smack onlycap list.");
405 *loaded_policy
= true;