src/label.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 2 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <errno.h>
  23 #include <sys/stat.h>
  24 #include <unistd.h>
  25 #include <malloc.h>
  26 #include <sys/socket.h>
  27 #include <sys/un.h>
  28
  29 #include "label.h"
  30 #include "util.h"
  31
  32 #ifdef HAVE_SELINUX
  33 #include <selinux/selinux.h>
  34 #include <selinux/label.h>
  35
  36 static struct selabel_handle *label_hnd = NULL;
  37
  38 static int use_selinux_cached = -1;
  39
  40 static inline bool use_selinux(void) {
  41
  42         if (use_selinux_cached < 0)
  43                 use_selinux_cached = is_selinux_enabled() > 0;
  44
  45         return use_selinux_cached;
  46 }
  47
  48 void label_retest_selinux(void) {
  49         use_selinux_cached = -1;
  50 }
  51
  52 #endif
  53
  54 int label_init(void) {
  55         int r = 0;
  56
  57 #ifdef HAVE_SELINUX
  58         usec_t before_timestamp, after_timestamp;
  59         struct mallinfo before_mallinfo, after_mallinfo;
  60
  61         if (!use_selinux())
  62                 return 0;
  63
  64         if (label_hnd)
  65                 return 0;
  66
  67         before_mallinfo = mallinfo();
  68         before_timestamp = now(CLOCK_MONOTONIC);
  69
  70         label_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
  71         if (!label_hnd) {
  72                 log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
  73                          "Failed to initialize SELinux context: %m");
  74                 r = security_getenforce() == 1 ? -errno : 0;
  75         } else  {
  76                 char timespan[FORMAT_TIMESPAN_MAX];
  77                 int l;
  78
  79                 after_timestamp = now(CLOCK_MONOTONIC);
  80                 after_mallinfo = mallinfo();
  81
  82                 l = after_mallinfo.uordblks > before_mallinfo.uordblks ? after_mallinfo.uordblks - before_mallinfo.uordblks : 0;
  83
  84                 log_info("Successfully loaded SELinux database in %s, size on heap is %iK.",
  85                          format_timespan(timespan, sizeof(timespan), after_timestamp - before_timestamp),
  86                          (l+1023)/1024);
  87         }
  88 #endif
  89
  90         return r;
  91 }
  92
  93 int label_fix(const char *path, bool ignore_enoent) {
  94         int r = 0;
  95
  96 #ifdef HAVE_SELINUX
  97         struct stat st;
  98         security_context_t fcon;
  99
 100         if (!use_selinux() || !label_hnd)
 101                 return 0;
 102
 103         r = lstat(path, &st);
 104         if (r == 0) {
 105                 r = selabel_lookup_raw(label_hnd, &fcon, path, st.st_mode);
 106
 107                 /* If there's no label to set, then exit without warning */
 108                 if (r < 0 && errno == ENOENT)
 109                         return 0;
 110
 111                 if (r == 0) {
 112                         r = lsetfilecon(path, fcon);
 113                         freecon(fcon);
 114
 115                         /* If the FS doesn't support labels, then exit without warning */
 116                         if (r < 0 && errno == ENOTSUP)
 117                                 return 0;
 118                 }
 119         }
 120
 121         if (r < 0) {
 122                 /* Ignore ENOENT in some cases */
 123                 if (ignore_enoent && errno == ENOENT)
 124                         return 0;
 125
 126                 log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
 127                          "Unable to fix label of %s: %m", path);
 128                 r = security_getenforce() == 1 ? -errno : 0;
 129         }
 130 #endif
 131
 132         return r;
 133 }
 134
 135 void label_finish(void) {
 136
 137 #ifdef HAVE_SELINUX
 138         if (use_selinux() && label_hnd)
 139                 selabel_close(label_hnd);
 140 #endif
 141 }
 142
 143 int label_get_create_label_from_exe(const char *exe, char **label) {
 144
 145         int r = 0;
 146
 147 #ifdef HAVE_SELINUX
 148         security_context_t mycon = NULL, fcon = NULL;
 149         security_class_t sclass;
 150
 151         if (!use_selinux()) {
 152                 *label = NULL;
 153                 return 0;
 154         }
 155
 156         r = getcon(&mycon);
 157         if (r < 0)
 158                 goto fail;
 159
 160         r = getfilecon(exe, &fcon);
 161         if (r < 0)
 162                 goto fail;
 163
 164         sclass = string_to_security_class("process");
 165         r = security_compute_create(mycon, fcon, sclass, (security_context_t *) label);
 166         if (r == 0)
 167                 log_debug("SELinux Socket context for %s will be set to %s", exe, *label);
 168
 169 fail:
 170         if (r < 0 && security_getenforce() == 1)
 171                 r = -errno;
 172
 173         freecon(mycon);
 174         freecon(fcon);
 175 #endif
 176
 177         return r;
 178 }
 179
 180 int label_fifofile_set(const char *path) {
 181         int r = 0;
 182
 183 #ifdef HAVE_SELINUX
 184         security_context_t filecon = NULL;
 185
 186         if (!use_selinux() || !label_hnd)
 187                 return 0;
 188
 189         r = selabel_lookup_raw(label_hnd, &filecon, path, S_IFIFO);
 190         if (r < 0)
 191                 r = -errno;
 192         else if (r == 0) {
 193                 r = setfscreatecon(filecon);
 194                 if (r < 0) {
 195                         log_error("Failed to set SELinux file context on %s: %m", path);
 196                         r = -errno;
 197                 }
 198
 199                 freecon(filecon);
 200         }
 201
 202         if (r < 0 && security_getenforce() == 0)
 203                 r = 0;
 204 #endif
 205
 206         return r;
 207 }
 208
 209 int label_symlinkfile_set(const char *path) {
 210         int r = 0;
 211
 212 #ifdef HAVE_SELINUX
 213         security_context_t filecon = NULL;
 214
 215         if (!use_selinux() || !label_hnd)
 216                 return 0;
 217
 218         r = selabel_lookup_raw(label_hnd, &filecon, path, S_IFLNK);
 219         if (r < 0)
 220                 r = -errno;
 221         else if (r == 0) {
 222                 r = setfscreatecon(filecon);
 223                 if (r < 0) {
 224                         log_error("Failed to set SELinux file context on %s: %m", path);
 225                         r = -errno;
 226                 }
 227
 228                 freecon(filecon);
 229         }
 230
 231         if (r < 0 && security_getenforce() == 0)
 232                 r = 0;
 233 #endif
 234
 235         return r;
 236 }
 237
 238 int label_socket_set(const char *label) {
 239
 240 #ifdef HAVE_SELINUX
 241         if (!use_selinux())
 242                 return 0;
 243
 244         if (setsockcreatecon((security_context_t) label) < 0) {
 245                 log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
 246                          "Failed to set SELinux context (%s) on socket: %m", label);
 247
 248                 if (security_getenforce() == 1)
 249                         return -errno;
 250         }
 251 #endif
 252
 253         return 0;
 254 }
 255
 256 void label_file_clear(void) {
 257
 258 #ifdef HAVE_SELINUX
 259         if (!use_selinux())
 260                 return;
 261
 262         setfscreatecon(NULL);
 263 #endif
 264 }
 265
 266 void label_socket_clear(void) {
 267
 268 #ifdef HAVE_SELINUX
 269         if (!use_selinux())
 270                 return;
 271
 272         setsockcreatecon(NULL);
 273 #endif
 274 }
 275
 276 void label_free(const char *label) {
 277
 278 #ifdef HAVE_SELINUX
 279         if (!use_selinux())
 280                 return;
 281
 282         freecon((security_context_t) label);
 283 #endif
 284 }
 285
 286 int label_mkdir(const char *path, mode_t mode) {
 287
 288         /* Creates a directory and labels it according to the SELinux policy */
 289
 290 #ifdef HAVE_SELINUX
 291         int r;
 292         security_context_t fcon = NULL;
 293
 294         if (!use_selinux() || !label_hnd)
 295                 goto skipped;
 296
 297         if (path_is_absolute(path))
 298                 r = selabel_lookup_raw(label_hnd, &fcon, path, S_IFDIR);
 299         else {
 300                 char *newpath;
 301
 302                 newpath = path_make_absolute_cwd(path);
 303                 if (!newpath)
 304                         return -ENOMEM;
 305
 306                 r = selabel_lookup_raw(label_hnd, &fcon, newpath, S_IFDIR);
 307                 free(newpath);
 308         }
 309
 310         if (r == 0)
 311                 r = setfscreatecon(fcon);
 312
 313         if (r < 0 && errno != ENOENT) {
 314                 log_error("Failed to set security context %s for %s: %m", fcon, path);
 315
 316                 if (security_getenforce() == 1) {
 317                         r = -errno;
 318                         goto finish;
 319                 }
 320         }
 321
 322         r = mkdir(path, mode);
 323         if (r < 0)
 324                 r = -errno;
 325
 326 finish:
 327         setfscreatecon(NULL);
 328         freecon(fcon);
 329
 330         return r;
 331
 332 skipped:
 333 #endif
 334         return mkdir(path, mode) < 0 ? -errno : 0;
 335 }
 336
 337 int label_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
 338
 339         /* Binds a socket and label its file system object according to the SELinux policy */
 340
 341 #ifdef HAVE_SELINUX
 342         int r;
 343         security_context_t fcon = NULL;
 344         const struct sockaddr_un *un;
 345         char *path = NULL;
 346
 347         assert(fd >= 0);
 348         assert(addr);
 349         assert(addrlen >= sizeof(sa_family_t));
 350
 351         if (!use_selinux() || !label_hnd)
 352                 goto skipped;
 353
 354         /* Filter out non-local sockets */
 355         if (addr->sa_family != AF_UNIX)
 356                 goto skipped;
 357
 358         /* Filter out anonymous sockets */
 359         if (addrlen < sizeof(sa_family_t) + 1)
 360                 goto skipped;
 361
 362         /* Filter out abstract namespace sockets */
 363         un = (const struct sockaddr_un*) addr;
 364         if (un->sun_path[0] == 0)
 365                 goto skipped;
 366
 367         path = strndup(un->sun_path, addrlen - offsetof(struct sockaddr_un, sun_path));
 368         if (!path)
 369                 return -ENOMEM;
 370
 371         if (path_is_absolute(path))
 372                 r = selabel_lookup_raw(label_hnd, &fcon, path, S_IFSOCK);
 373         else {
 374                 char *newpath;
 375
 376                 newpath = path_make_absolute_cwd(path);
 377
 378                 if (!newpath) {
 379                         free(path);
 380                         return -ENOMEM;
 381                 }
 382
 383                 r = selabel_lookup_raw(label_hnd, &fcon, newpath, S_IFSOCK);
 384                 free(newpath);
 385         }
 386
 387         if (r == 0)
 388                 r = setfscreatecon(fcon);
 389
 390         if (r < 0 && errno != ENOENT) {
 391                 log_error("Failed to set security context %s for %s: %m", fcon, path);
 392
 393                 if (security_getenforce() == 1) {
 394                         r = -errno;
 395                         goto finish;
 396                 }
 397         }
 398
 399         r = bind(fd, addr, addrlen);
 400         if (r < 0)
 401                 r = -errno;
 402
 403 finish:
 404         setfscreatecon(NULL);
 405         freecon(fcon);
 406         free(path);
 407
 408         return r;
 409
 410 skipped:
 411 #endif
 412         return bind(fd, addr, addrlen) < 0 ? -errno : 0;
 413 }