src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 /***
   3   Copyright © 2013 Intel Corporation
   4   Authors:
   5         Nathaniel Chen <nathaniel.chen@intel.com>
   6 ***/
   7
   8 #include <errno.h>
   9 #include <fcntl.h>
  10 #include <stdio.h>
  11 #include <stdlib.h>
  12 #include <unistd.h>
  13
  14 #include "alloc-util.h"
  15 #include "dirent-util.h"
  16 #include "fd-util.h"
  17 #include "fileio.h"
  18 #include "log.h"
  19 #include "macro.h"
  20 #include "smack-setup.h"
  21 #include "string-util.h"
  22 #include "util.h"
  23
  24 #if ENABLE_SMACK
  25
  26 static int fdopen_unlocked_at(int dfd, const char *dir, const char *name, int *status, FILE **ret_file) {
  27         int fd, r;
  28         FILE *f;
  29
  30         fd = openat(dfd, name, O_RDONLY|O_CLOEXEC);
  31         if (fd < 0) {
  32                 if (*status == 0)
  33                         *status = -errno;
  34
  35                 return log_warning_errno(errno, "Failed to open \"%s/%s\": %m", dir, name);
  36         }
  37
  38         r = fdopen_unlocked(fd, "r", &f);
  39         if (r < 0) {
  40                 if (*status == 0)
  41                         *status = r;
  42
  43                 safe_close(fd);
  44                 return log_error_errno(r, "Failed to open \"%s/%s\": %m", dir, name);
  45         }
  46
  47         *ret_file = f;
  48         return 0;
  49 }
  50
  51 static int write_access2_rules(const char *srcdir) {
  52         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  53         _cleanup_closedir_ DIR *dir = NULL;
  54         int dfd = -1, r = 0;
  55
  56         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  57         if (load2_fd < 0)  {
  58                 if (errno != ENOENT)
  59                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  60                 return -errno; /* negative error */
  61         }
  62
  63         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  64         if (change_fd < 0)  {
  65                 if (errno != ENOENT)
  66                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  67                 return -errno; /* negative error */
  68         }
  69
  70         /* write rules to load2 or change-rule from every file in the directory */
  71         dir = opendir(srcdir);
  72         if (!dir) {
  73                 if (errno != ENOENT)
  74                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  75                 return errno; /* positive on purpose */
  76         }
  77
  78         dfd = dirfd(dir);
  79         assert(dfd >= 0);
  80
  81         FOREACH_DIRENT(entry, dir, return 0) {
  82                 _cleanup_fclose_ FILE *policy = NULL;
  83
  84                 if (!dirent_is_file(entry))
  85                         continue;
  86
  87                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
  88                         continue;
  89
  90                 /* load2 write rules in the kernel require a line buffered stream */
  91                 for (;;) {
  92                         _cleanup_free_ char *buf = NULL, *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
  93                         int q;
  94
  95                         q = read_line(policy, NAME_MAX, &buf);
  96                         if (q < 0)
  97                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
  98                         if (q == 0)
  99                                 break;
 100
 101                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 102                                 continue;
 103
 104                         /* if 3 args -> load rule   : subject object access1 */
 105                         /* if 4 args -> change rule : subject object access1 access2 */
 106                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 107                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 108                                 continue;
 109                         }
 110
 111                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 112                                 if (r == 0)
 113                                         r = -errno;
 114                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s': %m",
 115                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 116                         }
 117                 }
 118         }
 119
 120         return r;
 121 }
 122
 123 static int write_cipso2_rules(const char *srcdir) {
 124         _cleanup_close_ int cipso2_fd = -1;
 125         _cleanup_closedir_ DIR *dir = NULL;
 126         int dfd = -1, r = 0;
 127
 128         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 129         if (cipso2_fd < 0)  {
 130                 if (errno != ENOENT)
 131                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 132                 return -errno; /* negative error */
 133         }
 134
 135         /* write rules to cipso2 from every file in the directory */
 136         dir = opendir(srcdir);
 137         if (!dir) {
 138                 if (errno != ENOENT)
 139                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 140                 return errno; /* positive on purpose */
 141         }
 142
 143         dfd = dirfd(dir);
 144         assert(dfd >= 0);
 145
 146         FOREACH_DIRENT(entry, dir, return 0) {
 147                 _cleanup_fclose_ FILE *policy = NULL;
 148
 149                 if (!dirent_is_file(entry))
 150                         continue;
 151
 152                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
 153                         continue;
 154
 155                 /* cipso2 write rules in the kernel require a line buffered stream */
 156                 for (;;) {
 157                         _cleanup_free_ char *buf = NULL;
 158                         int q;
 159
 160                         q = read_line(policy, NAME_MAX, &buf);
 161                         if (q < 0)
 162                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 163                         if (q == 0)
 164                                 break;
 165
 166                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 167                                 continue;
 168
 169                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 170                                 if (r == 0)
 171                                         r = -errno;
 172                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s': %m",
 173                                                 buf, entry->d_name);
 174                                 break;
 175                         }
 176                 }
 177         }
 178
 179         return r;
 180 }
 181
 182 static int write_netlabel_rules(const char *srcdir) {
 183         _cleanup_fclose_ FILE *dst = NULL;
 184         _cleanup_closedir_ DIR *dir = NULL;
 185         int dfd = -1, r = 0;
 186
 187         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 188         if (!dst)  {
 189                 if (errno != ENOENT)
 190                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 191                 return -errno; /* negative error */
 192         }
 193
 194         /* write rules to dst from every file in the directory */
 195         dir = opendir(srcdir);
 196         if (!dir) {
 197                 if (errno != ENOENT)
 198                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 199                 return errno; /* positive on purpose */
 200         }
 201
 202         dfd = dirfd(dir);
 203         assert(dfd >= 0);
 204
 205         FOREACH_DIRENT(entry, dir, return 0) {
 206                 _cleanup_fclose_ FILE *policy = NULL;
 207
 208                 if (fdopen_unlocked_at(dfd, srcdir, entry->d_name, &r, &policy) < 0)
 209                         continue;
 210
 211                 /* load2 write rules in the kernel require a line buffered stream */
 212                 for (;;) {
 213                         _cleanup_free_ char *buf = NULL;
 214                         int q;
 215
 216                         q = read_line(policy, NAME_MAX, &buf);
 217                         if (q < 0)
 218                                 return log_error_errno(q, "Failed to read line from %s: %m", entry->d_name);
 219                         if (q == 0)
 220                                 break;
 221
 222                         if (!fputs(buf, dst)) {
 223                                 if (r == 0)
 224                                         r = -EINVAL;
 225                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel: %m");
 226                                 break;
 227                         }
 228                         q = fflush_and_check(dst);
 229                         if (q < 0) {
 230                                 if (r == 0)
 231                                         r = q;
 232                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 233                                 break;
 234                         }
 235                 }
 236         }
 237
 238         return r;
 239 }
 240
 241 static int write_onlycap_list(void) {
 242         _cleanup_close_ int onlycap_fd = -1;
 243         _cleanup_free_ char *list = NULL;
 244         _cleanup_fclose_ FILE *f = NULL;
 245         size_t len = 0;
 246         int r;
 247
 248         f = fopen("/etc/smack/onlycap", "re");
 249         if (!f) {
 250                 if (errno != ENOENT)
 251                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap': %m");
 252
 253                 return errno == ENOENT ? ENOENT : -errno;
 254         }
 255
 256         for (;;) {
 257                 _cleanup_free_ char *buf = NULL;
 258                 size_t l;
 259
 260                 r = read_line(f, LONG_LINE_MAX, &buf);
 261                 if (r < 0)
 262                         return log_error_errno(r, "Failed to read line from /etc/smack/onlycap: %m");
 263                 if (r == 0)
 264                         break;
 265
 266                 if (isempty(buf) || strchr(COMMENTS, *buf))
 267                         continue;
 268
 269                 l = strlen(buf);
 270                 if (!GREEDY_REALLOC(list, len + l + 1))
 271                         return log_oom();
 272
 273                 stpcpy(list + len, buf)[0] = ' ';
 274                 len += l + 1;
 275         }
 276
 277         if (len == 0)
 278                 return 0;
 279
 280         list[len - 1] = 0;
 281
 282         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 283         if (onlycap_fd < 0) {
 284                 if (errno != ENOENT)
 285                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap': %m");
 286                 return -errno; /* negative error */
 287         }
 288
 289         r = write(onlycap_fd, list, len);
 290         if (r < 0)
 291                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap': %m", list);
 292
 293         return 0;
 294 }
 295
 296 #endif
 297
 298 int mac_smack_setup(bool *loaded_policy) {
 299
 300 #if ENABLE_SMACK
 301
 302         int r;
 303
 304         assert(loaded_policy);
 305
 306         r = write_access2_rules("/etc/smack/accesses.d/");
 307         switch(r) {
 308         case -ENOENT:
 309                 log_debug("Smack is not enabled in the kernel.");
 310                 return 0;
 311         case ENOENT:
 312                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 313                 return 0;
 314         case 0:
 315                 log_info("Successfully loaded Smack policies.");
 316                 break;
 317         default:
 318                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 319                 return 0;
 320         }
 321
 322 #if HAVE_SMACK_RUN_LABEL
 323         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 324         if (r < 0)
 325                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 326         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 327         if (r < 0)
 328                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 329         r = write_string_file("/sys/fs/smackfs/netlabel",
 330                               "0.0.0.0/0 " SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 331         if (r < 0)
 332                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 333         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", WRITE_STRING_FILE_DISABLE_BUFFER);
 334         if (r < 0)
 335                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 336 #endif
 337
 338         r = write_cipso2_rules("/etc/smack/cipso.d/");
 339         switch(r) {
 340         case -ENOENT:
 341                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 342                 return 0;
 343         case ENOENT:
 344                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 345                 break;
 346         case 0:
 347                 log_info("Successfully loaded Smack/CIPSO policies.");
 348                 break;
 349         default:
 350                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 351                 break;
 352         }
 353
 354         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 355         switch(r) {
 356         case -ENOENT:
 357                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 358                 return 0;
 359         case ENOENT:
 360                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 361                 break;
 362         case 0:
 363                 log_info("Successfully loaded Smack network host rules.");
 364                 break;
 365         default:
 366                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 367                 break;
 368         }
 369
 370         r = write_onlycap_list();
 371         switch(r) {
 372         case -ENOENT:
 373                 log_debug("Smack is not enabled in the kernel.");
 374                 break;
 375         case ENOENT:
 376                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 377                 break;
 378         case 0:
 379                 log_info("Successfully wrote Smack onlycap list.");
 380                 break;
 381         default:
 382                 return log_emergency_errno(r, "Failed to write Smack onlycap list: %m");
 383         }
 384
 385         *loaded_policy = true;
 386
 387 #endif
 388
 389         return 0;
 390 }