[thirdparty/systemd.git] / src / core / smack-setup.c

/***
  This file is part of systemd.

  Copyright (C) 2013 Intel Corporation
  Authors:
        Nathaniel Chen <nathaniel.chen@intel.com>

  systemd is free software; you can redistribute it and/or modify it
  under the terms of the GNU Lesser General Public License as published
  by the Free Software Foundation; either version 2.1 of the License,
  or (at your option) any later version.

  systemd is distributed in the hope that it will be useful, but
  WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  Lesser General Public License for more details.

  You should have received a copy of the GNU Lesser General Public License
  along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/

#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "alloc-util.h"
#include "dirent-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "log.h"
#include "macro.h"
#include "smack-setup.h"
#include "string-util.h"
#include "util.h"

#if HAVE_SMACK

static int write_access2_rules(const char* srcdir) {
        _cleanup_close_ int load2_fd = -1, change_fd = -1;
        _cleanup_closedir_ DIR *dir = NULL;
        struct dirent *entry;
        char buf[NAME_MAX];
        int dfd = -1;
        int r = 0;

        load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (load2_fd < 0)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
                return -errno; /* negative error */
        }

        change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (change_fd < 0)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
                return -errno; /* negative error */
        }

        /* write rules to load2 or change-rule from every file in the directory */
        dir = opendir(srcdir);
        if (!dir) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
                return errno; /* positive on purpose */
        }

        dfd = dirfd(dir);
        assert(dfd >= 0);

        FOREACH_DIRENT(entry, dir, return 0) {
                int fd;
                _cleanup_fclose_ FILE *policy = NULL;

                if (!dirent_is_file(entry))
                        continue;

                fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
                if (fd < 0) {
                        if (r == 0)
                                r = -errno;
                        log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                policy = fdopen(fd, "re");
                if (!policy) {
                        if (r == 0)
                                r = -errno;
                        safe_close(fd);
                        log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                /* load2 write rules in the kernel require a line buffered stream */
                FOREACH_LINE(buf, policy,
                             log_error_errno(errno, "Failed to read line from '%s': %m",
                                             entry->d_name)) {

                        _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;

                        if (isempty(truncate_nl(buf)))
                                continue;

                        /* if 3 args -> load rule   : subject object access1 */
                        /* if 4 args -> change rule : subject object access1 access2 */
                        if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
                                log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
                                continue;
                        }

                        if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
                                if (r == 0)
                                        r = -errno;
                                log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
                                                buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
                        }
                }
        }

        return r;
}

static int write_cipso2_rules(const char* srcdir) {
        _cleanup_close_ int cipso2_fd = -1;
        _cleanup_closedir_ DIR *dir = NULL;
        struct dirent *entry;
        char buf[NAME_MAX];
        int dfd = -1;
        int r = 0;

        cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (cipso2_fd < 0)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
                return -errno; /* negative error */
        }

        /* write rules to cipso2 from every file in the directory */
        dir = opendir(srcdir);
        if (!dir) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
                return errno; /* positive on purpose */
        }

        dfd = dirfd(dir);
        assert(dfd >= 0);

        FOREACH_DIRENT(entry, dir, return 0) {
                int fd;
                _cleanup_fclose_ FILE *policy = NULL;

                if (!dirent_is_file(entry))
                        continue;

                fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
                if (fd < 0) {
                        if (r == 0)
                                r = -errno;
                        log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                policy = fdopen(fd, "re");
                if (!policy) {
                        if (r == 0)
                                r = -errno;
                        safe_close(fd);
                        log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                /* cipso2 write rules in the kernel require a line buffered stream */
                FOREACH_LINE(buf, policy,
                             log_error_errno(errno, "Failed to read line from '%s': %m",
                                             entry->d_name)) {

                        if (isempty(truncate_nl(buf)))
                                continue;

                        if (write(cipso2_fd, buf, strlen(buf)) < 0) {
                                if (r == 0)
                                        r = -errno;
                                log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
                                                buf, entry->d_name);
                                break;
                        }
                }
        }

        return r;
}

static int write_netlabel_rules(const char* srcdir) {
        _cleanup_fclose_ FILE *dst = NULL;
        _cleanup_closedir_ DIR *dir = NULL;
        struct dirent *entry;
        char buf[NAME_MAX];
        int dfd = -1;
        int r = 0;

        dst = fopen("/sys/fs/smackfs/netlabel", "we");
        if (!dst)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
                return -errno; /* negative error */
        }

        /* write rules to dst from every file in the directory */
        dir = opendir(srcdir);
        if (!dir) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
                return errno; /* positive on purpose */
        }

        dfd = dirfd(dir);
        assert(dfd >= 0);

        FOREACH_DIRENT(entry, dir, return 0) {
                int fd;
                _cleanup_fclose_ FILE *policy = NULL;

                fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
                if (fd < 0) {
                        if (r == 0)
                                r = -errno;
                        log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
                        continue;
                }

                policy = fdopen(fd, "re");
                if (!policy) {
                        if (r == 0)
                                r = -errno;
                        safe_close(fd);
                        log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
                        continue;
                }

                /* load2 write rules in the kernel require a line buffered stream */
                FOREACH_LINE(buf, policy,
                             log_error_errno(errno, "Failed to read line from %s: %m",
                                       entry->d_name)) {
                        if (!fputs_unlocked(buf, dst)) {
                                if (r == 0)
                                        r = -EINVAL;
                                log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
                                break;
                        }
                        if (fflush(dst)) {
                                if (r == 0)
                                        r = -errno;
                                log_error_errno(errno, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
                                break;
                        }
                }
        }

        return r;
}

static int write_onlycap_list(void) {
        _cleanup_close_ int onlycap_fd = -1;
        _cleanup_free_ char *list = NULL;
        _cleanup_fclose_ FILE *f = NULL;
        size_t len = 0, allocated = 0;
        char buf[LINE_MAX];
        int r;

        f = fopen("/etc/smack/onlycap", "re");
        if (!f) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to read '/etc/smack/onlycap'");
                return errno == ENOENT ? ENOENT : -errno;
        }

        FOREACH_LINE(buf, f, return -errno) {
                size_t l;

                if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
                        continue;

                l = strlen(buf);
                if (!GREEDY_REALLOC(list, allocated, len + l + 1))
                        return log_oom();

                stpcpy(list + len, buf)[0] = ' ';
                len += l + 1;
        }

        if (!len)
                return 0;

        list[len - 1] = 0;

        onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (onlycap_fd < 0) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap'");
                return -errno; /* negative error */
        }

        r = write(onlycap_fd, list, len);
        if (r < 0)
                return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list);

        return 0;
}

#endif

int mac_smack_setup(bool *loaded_policy) {

#if HAVE_SMACK

        int r;

        assert(loaded_policy);

        r = write_access2_rules("/etc/smack/accesses.d/");
        switch(r) {
        case -ENOENT:
                log_debug("Smack is not enabled in the kernel.");
                return 0;
        case ENOENT:
                log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
                return 0;
        case 0:
                log_info("Successfully loaded Smack policies.");
                break;
        default:
                log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
                return 0;
        }

#ifdef SMACK_RUN_LABEL
        r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
        if (r < 0)
                log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
        r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
        if (r < 0)
                log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
        r = write_string_file("/sys/fs/smackfs/netlabel",
                              "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
        if (r < 0)
                log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
        r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
        if (r < 0)
                log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
#endif

        r = write_cipso2_rules("/etc/smack/cipso.d/");
        switch(r) {
        case -ENOENT:
                log_debug("Smack/CIPSO is not enabled in the kernel.");
                return 0;
        case ENOENT:
                log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
                break;
        case 0:
                log_info("Successfully loaded Smack/CIPSO policies.");
                break;
        default:
                log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
                break;
        }

        r = write_netlabel_rules("/etc/smack/netlabel.d/");
        switch(r) {
        case -ENOENT:
                log_debug("Smack/CIPSO is not enabled in the kernel.");
                return 0;
        case ENOENT:
                log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
                break;
        case 0:
                log_info("Successfully loaded Smack network host rules.");
                break;
        default:
                log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
                break;
        }

        r = write_onlycap_list();
        switch(r) {
        case -ENOENT:
                log_debug("Smack is not enabled in the kernel.");
                break;
        case ENOENT:
                log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
                break;
        case 0:
                log_info("Successfully wrote Smack onlycap list.");
                break;
        default:
                log_emergency_errno(r, "Failed to write Smack onlycap list.");
                return r;
        }

        *loaded_policy = true;

#endif

        return 0;
}
Commit	Line	Data
ffbd2c4d NC	1	/***
	2	This file is part of systemd.
	3
	4	Copyright (C) 2013 Intel Corporation
	5	Authors:
	6	Nathaniel Chen <nathaniel.chen@intel.com>
	7
	8	systemd is free software; you can redistribute it and/or modify it
	9	under the terms of the GNU Lesser General Public License as published
	10	by the Free Software Foundation; either version 2.1 of the License,
	11	or (at your option) any later version.
	12
	13	systemd is distributed in the hope that it will be useful, but
	14	WITHOUT ANY WARRANTY; without even the implied warranty of
	15	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	16	Lesser General Public License for more details.
	17
	18	You should have received a copy of the GNU Lesser General Public License
	19	along with systemd; If not, see <http://www.gnu.org/licenses/>.
	20	***/
	21
07630cea	22	#include <dirent.h>
ffbd2c4d	23	#include <errno.h>
ffbd2c4d	24	#include <fcntl.h>
07630cea LP	25	#include <stdio.h>
	26	#include <stdlib.h>
	27	#include <string.h>
ffbd2c4d	28
b5efdb8a	29	#include "alloc-util.h"
a0956174	30	#include "dirent-util.h"
3ffd4af2	31	#include "fd-util.h"
8b197c3a	32	#include "fileio.h"
ffbd2c4d	33	#include "log.h"
07630cea	34	#include "macro.h"
3ffd4af2	35	#include "smack-setup.h"
07630cea LP	36	#include "string-util.h"
07630cea LP	37	#include "util.h"
ffbd2c4d	38
349cc4a5	39	#if HAVE_SMACK
2b3e18de	40
6656aefb WC	41	static int write_access2_rules(const char* srcdir) {
6656aefb WC	42	_cleanup_close_ int load2_fd = -1, change_fd = -1;
ffbd2c4d NC	43	_cleanup_closedir_ DIR *dir = NULL;
	44	struct dirent *entry;
	45	char buf[NAME_MAX];
	46	int dfd = -1;
a4783bd1	47	int r = 0;
ffbd2c4d	48
6656aefb WC	49	load2_fd = open("/sys/fs/smackfs/load2", O_RDWR\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	50	if (load2_fd < 0) {
	51	if (errno != ENOENT)
	52	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
	53	return -errno; /* negative error */
	54	}
	55
	56	change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	57	if (change_fd < 0) {
a4783bd1	58	if (errno != ENOENT)
6656aefb	59	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
a4783bd1	60	return -errno; /* negative error */
ffbd2c4d NC	61	}
ffbd2c4d NC	62
6656aefb	63	/* write rules to load2 or change-rule from every file in the directory */
a4783bd1	64	dir = opendir(srcdir);
ffbd2c4d	65	if (!dir) {
a4783bd1	66	if (errno != ENOENT)
6656aefb	67	log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
a4783bd1	68	return errno; /* positive on purpose */
ffbd2c4d NC	69	}
	70
	71	dfd = dirfd(dir);
fea7838e	72	assert(dfd >= 0);
ffbd2c4d NC	73
ffbd2c4d NC	74	FOREACH_DIRENT(entry, dir, return 0) {
a4783bd1	75	int fd;
ffbd2c4d	76	_cleanup_fclose_ FILE *policy = NULL;
ffbd2c4d	77
6656aefb WC	78	if (!dirent_is_file(entry))
	79	continue;
	80
a4783bd1 ZJS	81	fd = openat(dfd, entry->d_name, O_RDONLY\|O_CLOEXEC);
	82	if (fd < 0) {
	83	if (r == 0)
	84	r = -errno;
6656aefb	85	log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
ffbd2c4d NC	86	continue;
	87	}
	88
a4783bd1	89	policy = fdopen(fd, "re");
ffbd2c4d	90	if (!policy) {
a4783bd1 ZJS	91	if (r == 0)
a4783bd1 ZJS	92	r = -errno;
03e334a1	93	safe_close(fd);
6656aefb	94	log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
ffbd2c4d NC	95	continue;
	96	}
	97
ffbd2c4d	98	/* load2 write rules in the kernel require a line buffered stream */
fea7838e	99	FOREACH_LINE(buf, policy,
6656aefb WC	100	log_error_errno(errno, "Failed to read line from '%s': %m",
	101	entry->d_name)) {
	102
	103	_cleanup_free_ char sbj = NULL, obj = NULL, acc1 = NULL, acc2 = NULL;
	104
	105	if (isempty(truncate_nl(buf)))
	106	continue;
	107
	108	/* if 3 args -> load rule : subject object access1 */
	109	/* if 4 args -> change rule : subject object access1 access2 */
	110	if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
	111	log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
	112	continue;
	113	}
	114
	115	if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
a4783bd1	116	if (r == 0)
6656aefb WC	117	r = -errno;
	118	log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
	119	buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
a4783bd1	120	}
6656aefb WC	121	}
	122	}
	123
	124	return r;
	125	}
	126
	127	static int write_cipso2_rules(const char* srcdir) {
	128	_cleanup_close_ int cipso2_fd = -1;
	129	_cleanup_closedir_ DIR *dir = NULL;
	130	struct dirent *entry;
	131	char buf[NAME_MAX];
	132	int dfd = -1;
	133	int r = 0;
	134
	135	cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	136	if (cipso2_fd < 0) {
	137	if (errno != ENOENT)
	138	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
	139	return -errno; /* negative error */
	140	}
	141
	142	/* write rules to cipso2 from every file in the directory */
	143	dir = opendir(srcdir);
	144	if (!dir) {
	145	if (errno != ENOENT)
	146	log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
	147	return errno; /* positive on purpose */
	148	}
	149
	150	dfd = dirfd(dir);
	151	assert(dfd >= 0);
	152
	153	FOREACH_DIRENT(entry, dir, return 0) {
	154	int fd;
	155	_cleanup_fclose_ FILE *policy = NULL;
	156
	157	if (!dirent_is_file(entry))
	158	continue;
	159
	160	fd = openat(dfd, entry->d_name, O_RDONLY\|O_CLOEXEC);
	161	if (fd < 0) {
	162	if (r == 0)
	163	r = -errno;
	164	log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
	165	continue;
	166	}
	167
	168	policy = fdopen(fd, "re");
	169	if (!policy) {
	170	if (r == 0)
	171	r = -errno;
	172	safe_close(fd);
	173	log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
	174	continue;
	175	}
	176
	177	/* cipso2 write rules in the kernel require a line buffered stream */
	178	FOREACH_LINE(buf, policy,
	179	log_error_errno(errno, "Failed to read line from '%s': %m",
	180	entry->d_name)) {
	181
	182	if (isempty(truncate_nl(buf)))
	183	continue;
	184
185	if (write(cipso2_fd, buf, strlen(buf)) < 0) {
a4783bd1 ZJS	186	if (r == 0)
a4783bd1 ZJS	187	r = -errno;
6656aefb WC	188	log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
6656aefb WC	189	buf, entry->d_name);
a4783bd1 ZJS	190	break;
a4783bd1 ZJS	191	}
ffbd2c4d NC	192	}
	193	}
	194
6656aefb	195	return r;
a4783bd1 ZJS	196	}
a4783bd1 ZJS	197
ae176752 CS	198	static int write_netlabel_rules(const char* srcdir) {
	199	_cleanup_fclose_ FILE *dst = NULL;
	200	_cleanup_closedir_ DIR *dir = NULL;
	201	struct dirent *entry;
	202	char buf[NAME_MAX];
	203	int dfd = -1;
	204	int r = 0;
	205
	206	dst = fopen("/sys/fs/smackfs/netlabel", "we");
	207	if (!dst) {
	208	if (errno != ENOENT)
	209	log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
	210	return -errno; /* negative error */
	211	}
	212
	213	/* write rules to dst from every file in the directory */
	214	dir = opendir(srcdir);
	215	if (!dir) {
	216	if (errno != ENOENT)
	217	log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
	218	return errno; /* positive on purpose */
	219	}
	220
	221	dfd = dirfd(dir);
	222	assert(dfd >= 0);
	223
	224	FOREACH_DIRENT(entry, dir, return 0) {
	225	int fd;
	226	_cleanup_fclose_ FILE *policy = NULL;
	227
	228	fd = openat(dfd, entry->d_name, O_RDONLY\|O_CLOEXEC);
	229	if (fd < 0) {
	230	if (r == 0)
	231	r = -errno;
	232	log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
	233	continue;
	234	}
	235
	236	policy = fdopen(fd, "re");
	237	if (!policy) {
	238	if (r == 0)
	239	r = -errno;
	240	safe_close(fd);
	241	log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
	242	continue;
	243	}
	244
	245	/* load2 write rules in the kernel require a line buffered stream */
	246	FOREACH_LINE(buf, policy,
	247	log_error_errno(errno, "Failed to read line from %s: %m",
	248	entry->d_name)) {
4b61c875	249	if (!fputs_unlocked(buf, dst)) {
ae176752 CS	250	if (r == 0)
	251	r = -EINVAL;
	252	log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
	253	break;
	254	}
	255	if (fflush(dst)) {
	256	if (r == 0)
	257	r = -errno;
	258	log_error_errno(errno, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
	259	break;
	260	}
	261	}
	262	}
	263
7f508f2c	264	return r;
ae176752 CS	265	}
ae176752 CS	266
217f95db WC	267	static int write_onlycap_list(void) {
	268	_cleanup_close_ int onlycap_fd = -1;
	269	_cleanup_free_ char *list = NULL;
	270	_cleanup_fclose_ FILE *f = NULL;
	271	size_t len = 0, allocated = 0;
	272	char buf[LINE_MAX];
	273	int r;
	274
	275	f = fopen("/etc/smack/onlycap", "re");
	276	if (!f) {
	277	if (errno != ENOENT)
	278	log_warning_errno(errno, "Failed to read '/etc/smack/onlycap'");
	279	return errno == ENOENT ? ENOENT : -errno;
	280	}
	281
	282	FOREACH_LINE(buf, f, return -errno) {
	283	size_t l;
	284
	285	if (isempty(truncate_nl(buf)) \|\| strchr(COMMENTS, *buf))
	286	continue;
	287
	288	l = strlen(buf);
	289	if (!GREEDY_REALLOC(list, allocated, len + l + 1))
	290	return log_oom();
	291
	292	stpcpy(list + len, buf)[0] = ' ';
	293	len += l + 1;
	294	}
	295
	296	if (!len)
	297	return 0;
	298
	299	list[len - 1] = 0;
	300
	301	onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	302	if (onlycap_fd < 0) {
	303	if (errno != ENOENT)
	304	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap'");
	305	return -errno; /* negative error */
	306	}
	307
	308	r = write(onlycap_fd, list, len);
	309	if (r < 0)
	310	return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list);
	311
	312	return 0;
	313	}
	314
2b3e18de	315	#endif
ffbd2c4d	316
8a188de9	317	int mac_smack_setup(bool *loaded_policy) {
2b3e18de	318
349cc4a5	319	#if HAVE_SMACK
2b3e18de	320
a4783bd1 ZJS	321	int r;
a4783bd1 ZJS	322
e49d3c01 ŁS	323	assert(loaded_policy);
e49d3c01 ŁS	324
6656aefb	325	r = write_access2_rules("/etc/smack/accesses.d/");
a4783bd1 ZJS	326	switch(r) {
	327	case -ENOENT:
	328	log_debug("Smack is not enabled in the kernel.");
	329	return 0;
	330	case ENOENT:
6656aefb	331	log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
a4783bd1 ZJS	332	return 0;
	333	case 0:
	334	log_info("Successfully loaded Smack policies.");
abbacb1d NC	335	break;
abbacb1d NC	336	default:
e53fc357	337	log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
abbacb1d NC	338	return 0;
	339	}
	340
8b197c3a	341	#ifdef SMACK_RUN_LABEL
4c1fc3e4	342	r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
ae176752 CS	343	if (r < 0)
	344	log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
	345	r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
	346	if (r < 0)
	347	log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
	348	r = write_string_file("/sys/fs/smackfs/netlabel",
	349	"0.0.0.0/0 " SMACK_RUN_LABEL, 0);
	350	if (r < 0)
	351	log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
	352	r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
	353	if (r < 0)
	354	log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
8b197c3a AK	355	#endif
8b197c3a AK	356
6656aefb	357	r = write_cipso2_rules("/etc/smack/cipso.d/");
abbacb1d NC	358	switch(r) {
	359	case -ENOENT:
	360	log_debug("Smack/CIPSO is not enabled in the kernel.");
	361	return 0;
	362	case ENOENT:
6656aefb	363	log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
ae176752	364	break;
abbacb1d NC	365	case 0:
abbacb1d NC	366	log_info("Successfully loaded Smack/CIPSO policies.");
b9289d4c	367	break;
a4783bd1	368	default:
e53fc357	369	log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
ae176752 CS	370	break;
	371	}
	372
	373	r = write_netlabel_rules("/etc/smack/netlabel.d/");
	374	switch(r) {
	375	case -ENOENT:
	376	log_debug("Smack/CIPSO is not enabled in the kernel.");
a4783bd1	377	return 0;
ae176752 CS	378	case ENOENT:
	379	log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
	380	break;
	381	case 0:
	382	log_info("Successfully loaded Smack network host rules.");
	383	break;
	384	default:
	385	log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
	386	break;
a4783bd1	387	}
2b3e18de	388
217f95db WC	389	r = write_onlycap_list();
	390	switch(r) {
	391	case -ENOENT:
	392	log_debug("Smack is not enabled in the kernel.");
	393	break;
	394	case ENOENT:
	395	log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
	396	break;
	397	case 0:
	398	log_info("Successfully wrote Smack onlycap list.");
	399	break;
	400	default:
	401	log_emergency_errno(r, "Failed to write Smack onlycap list.");
	402	return r;
	403	}
	404
e49d3c01 ŁS	405	*loaded_policy = true;
e49d3c01 ŁS	406
2b3e18de KL	407	#endif
	408
	409	return 0;
ffbd2c4d	410	}