[thirdparty/systemd.git] / src / core / smack-setup.c

/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/

/***
  This file is part of systemd.

  Copyright (C) 2013 Intel Corporation
  Authors:
        Nathaniel Chen <nathaniel.chen@intel.com>

  systemd is free software; you can redistribute it and/or modify it
  under the terms of the GNU Lesser General Public License as published
  by the Free Software Foundation; either version 2.1 of the License,
  or (at your option) any later version.

  systemd is distributed in the hope that it will be useful, but
  WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  Lesser General Public License for more details.

  You should have received a copy of the GNU Lesser General Public License
  along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/

#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "fd-util.h"
#include "fileio.h"
#include "log.h"
#include "macro.h"
#include "smack-setup.h"
#include "string-util.h"
#include "util.h"

#ifdef HAVE_SMACK

static int write_access2_rules(const char* srcdir) {
        _cleanup_close_ int load2_fd = -1, change_fd = -1;
        _cleanup_closedir_ DIR *dir = NULL;
        struct dirent *entry;
        char buf[NAME_MAX];
        int dfd = -1;
        int r = 0;

        load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (load2_fd < 0)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
                return -errno; /* negative error */
        }

        change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (change_fd < 0)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
                return -errno; /* negative error */
        }

        /* write rules to load2 or change-rule from every file in the directory */
        dir = opendir(srcdir);
        if (!dir) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
                return errno; /* positive on purpose */
        }

        dfd = dirfd(dir);
        assert(dfd >= 0);

        FOREACH_DIRENT(entry, dir, return 0) {
                int fd;
                _cleanup_fclose_ FILE *policy = NULL;

                if (!dirent_is_file(entry))
                        continue;

                fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
                if (fd < 0) {
                        if (r == 0)
                                r = -errno;
                        log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                policy = fdopen(fd, "re");
                if (!policy) {
                        if (r == 0)
                                r = -errno;
                        safe_close(fd);
                        log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                /* load2 write rules in the kernel require a line buffered stream */
                FOREACH_LINE(buf, policy,
                             log_error_errno(errno, "Failed to read line from '%s': %m",
                                             entry->d_name)) {

                        _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;

                        if (isempty(truncate_nl(buf)))
                                continue;

                        /* if 3 args -> load rule   : subject object access1 */
                        /* if 4 args -> change rule : subject object access1 access2 */
                        if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
                                log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
                                continue;
                        }

                        if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
                                if (r == 0)
                                        r = -errno;
                                log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
                                                buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
                        }
                }
        }

        return r;
}

static int write_cipso2_rules(const char* srcdir) {
        _cleanup_close_ int cipso2_fd = -1;
        _cleanup_closedir_ DIR *dir = NULL;
        struct dirent *entry;
        char buf[NAME_MAX];
        int dfd = -1;
        int r = 0;

        cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
        if (cipso2_fd < 0)  {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
                return -errno; /* negative error */
        }

        /* write rules to cipso2 from every file in the directory */
        dir = opendir(srcdir);
        if (!dir) {
                if (errno != ENOENT)
                        log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
                return errno; /* positive on purpose */
        }

        dfd = dirfd(dir);
        assert(dfd >= 0);

        FOREACH_DIRENT(entry, dir, return 0) {
                int fd;
                _cleanup_fclose_ FILE *policy = NULL;

                if (!dirent_is_file(entry))
                        continue;

                fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
                if (fd < 0) {
                        if (r == 0)
                                r = -errno;
                        log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                policy = fdopen(fd, "re");
                if (!policy) {
                        if (r == 0)
                                r = -errno;
                        safe_close(fd);
                        log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
                        continue;
                }

                /* cipso2 write rules in the kernel require a line buffered stream */
                FOREACH_LINE(buf, policy,
                             log_error_errno(errno, "Failed to read line from '%s': %m",
                                             entry->d_name)) {

                        if (isempty(truncate_nl(buf)))
                                continue;

                        if (write(cipso2_fd, buf, strlen(buf)) < 0) {
                                if (r == 0)
                                        r = -errno;
                                log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
                                                buf, entry->d_name);
                                break;
                        }
                }
        }

        return r;
}

#endif

int mac_smack_setup(bool *loaded_policy) {

#ifdef HAVE_SMACK

        int r;

        assert(loaded_policy);

        r = write_access2_rules("/etc/smack/accesses.d/");
        switch(r) {
        case -ENOENT:
                log_debug("Smack is not enabled in the kernel.");
                return 0;
        case ENOENT:
                log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
                return 0;
        case 0:
                log_info("Successfully loaded Smack policies.");
                break;
        default:
                log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
                return 0;
        }

#ifdef SMACK_RUN_LABEL
        r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
        if (r)
                log_warning_errno(r, "Failed to set SMACK label \"%s\" on self: %m", SMACK_RUN_LABEL);
#endif

        r = write_cipso2_rules("/etc/smack/cipso.d/");
        switch(r) {
        case -ENOENT:
                log_debug("Smack/CIPSO is not enabled in the kernel.");
                return 0;
        case ENOENT:
                log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
                return 0;
        case 0:
                log_info("Successfully loaded Smack/CIPSO policies.");
                break;
        default:
                log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
                return 0;
        }

        *loaded_policy = true;

#endif

        return 0;
}
Commit	Line	Data
ffbd2c4d NC	1	/-- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil --/
	2
	3	/***
	4	This file is part of systemd.
	5
	6	Copyright (C) 2013 Intel Corporation
	7	Authors:
	8	Nathaniel Chen <nathaniel.chen@intel.com>
	9
	10	systemd is free software; you can redistribute it and/or modify it
	11	under the terms of the GNU Lesser General Public License as published
	12	by the Free Software Foundation; either version 2.1 of the License,
	13	or (at your option) any later version.
	14
	15	systemd is distributed in the hope that it will be useful, but
	16	WITHOUT ANY WARRANTY; without even the implied warranty of
	17	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	18	Lesser General Public License for more details.
	19
	20	You should have received a copy of the GNU Lesser General Public License
	21	along with systemd; If not, see <http://www.gnu.org/licenses/>.
	22	***/
	23
07630cea	24	#include <dirent.h>
ffbd2c4d	25	#include <errno.h>
ffbd2c4d	26	#include <fcntl.h>
07630cea LP	27	#include <stdio.h>
	28	#include <stdlib.h>
	29	#include <string.h>
ffbd2c4d	30
3ffd4af2	31	#include "fd-util.h"
8b197c3a	32	#include "fileio.h"
ffbd2c4d	33	#include "log.h"
07630cea	34	#include "macro.h"
3ffd4af2	35	#include "smack-setup.h"
07630cea LP	36	#include "string-util.h"
07630cea LP	37	#include "util.h"
ffbd2c4d	38
2b3e18de KL	39	#ifdef HAVE_SMACK
2b3e18de KL	40
6656aefb WC	41	static int write_access2_rules(const char* srcdir) {
6656aefb WC	42	_cleanup_close_ int load2_fd = -1, change_fd = -1;
ffbd2c4d NC	43	_cleanup_closedir_ DIR *dir = NULL;
	44	struct dirent *entry;
	45	char buf[NAME_MAX];
	46	int dfd = -1;
a4783bd1	47	int r = 0;
ffbd2c4d	48
6656aefb WC	49	load2_fd = open("/sys/fs/smackfs/load2", O_RDWR\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	50	if (load2_fd < 0) {
	51	if (errno != ENOENT)
	52	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
	53	return -errno; /* negative error */
	54	}
	55
	56	change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	57	if (change_fd < 0) {
a4783bd1	58	if (errno != ENOENT)
6656aefb	59	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
a4783bd1	60	return -errno; /* negative error */
ffbd2c4d NC	61	}
ffbd2c4d NC	62
6656aefb	63	/* write rules to load2 or change-rule from every file in the directory */
a4783bd1	64	dir = opendir(srcdir);
ffbd2c4d	65	if (!dir) {
a4783bd1	66	if (errno != ENOENT)
6656aefb	67	log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
a4783bd1	68	return errno; /* positive on purpose */
ffbd2c4d NC	69	}
	70
	71	dfd = dirfd(dir);
fea7838e	72	assert(dfd >= 0);
ffbd2c4d NC	73
ffbd2c4d NC	74	FOREACH_DIRENT(entry, dir, return 0) {
a4783bd1	75	int fd;
ffbd2c4d	76	_cleanup_fclose_ FILE *policy = NULL;
ffbd2c4d	77
6656aefb WC	78	if (!dirent_is_file(entry))
	79	continue;
	80
a4783bd1 ZJS	81	fd = openat(dfd, entry->d_name, O_RDONLY\|O_CLOEXEC);
	82	if (fd < 0) {
	83	if (r == 0)
	84	r = -errno;
6656aefb	85	log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
ffbd2c4d NC	86	continue;
	87	}
	88
a4783bd1	89	policy = fdopen(fd, "re");
ffbd2c4d	90	if (!policy) {
a4783bd1 ZJS	91	if (r == 0)
a4783bd1 ZJS	92	r = -errno;
03e334a1	93	safe_close(fd);
6656aefb	94	log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
ffbd2c4d NC	95	continue;
	96	}
	97
ffbd2c4d	98	/* load2 write rules in the kernel require a line buffered stream */
fea7838e	99	FOREACH_LINE(buf, policy,
6656aefb WC	100	log_error_errno(errno, "Failed to read line from '%s': %m",
	101	entry->d_name)) {
	102
	103	_cleanup_free_ char sbj = NULL, obj = NULL, acc1 = NULL, acc2 = NULL;
	104
	105	if (isempty(truncate_nl(buf)))
	106	continue;
	107
	108	/* if 3 args -> load rule : subject object access1 */
	109	/* if 4 args -> change rule : subject object access1 access2 */
	110	if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
	111	log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
	112	continue;
	113	}
	114
	115	if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
a4783bd1	116	if (r == 0)
6656aefb WC	117	r = -errno;
	118	log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
	119	buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
a4783bd1	120	}
6656aefb WC	121	}
	122	}
	123
	124	return r;
	125	}
	126
	127	static int write_cipso2_rules(const char* srcdir) {
	128	_cleanup_close_ int cipso2_fd = -1;
	129	_cleanup_closedir_ DIR *dir = NULL;
	130	struct dirent *entry;
	131	char buf[NAME_MAX];
	132	int dfd = -1;
	133	int r = 0;
	134
	135	cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR\|O_CLOEXEC\|O_NONBLOCK\|O_NOCTTY);
	136	if (cipso2_fd < 0) {
	137	if (errno != ENOENT)
	138	log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
	139	return -errno; /* negative error */
	140	}
	141
	142	/* write rules to cipso2 from every file in the directory */
	143	dir = opendir(srcdir);
	144	if (!dir) {
	145	if (errno != ENOENT)
	146	log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
	147	return errno; /* positive on purpose */
	148	}
	149
	150	dfd = dirfd(dir);
	151	assert(dfd >= 0);
	152
	153	FOREACH_DIRENT(entry, dir, return 0) {
	154	int fd;
	155	_cleanup_fclose_ FILE *policy = NULL;
	156
	157	if (!dirent_is_file(entry))
	158	continue;
	159
	160	fd = openat(dfd, entry->d_name, O_RDONLY\|O_CLOEXEC);
	161	if (fd < 0) {
	162	if (r == 0)
	163	r = -errno;
	164	log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
	165	continue;
	166	}
	167
	168	policy = fdopen(fd, "re");
	169	if (!policy) {
	170	if (r == 0)
	171	r = -errno;
	172	safe_close(fd);
	173	log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
	174	continue;
	175	}
	176
	177	/* cipso2 write rules in the kernel require a line buffered stream */
	178	FOREACH_LINE(buf, policy,
	179	log_error_errno(errno, "Failed to read line from '%s': %m",
	180	entry->d_name)) {
	181
	182	if (isempty(truncate_nl(buf)))
	183	continue;
	184
185	if (write(cipso2_fd, buf, strlen(buf)) < 0) {
a4783bd1 ZJS	186	if (r == 0)
a4783bd1 ZJS	187	r = -errno;
6656aefb WC	188	log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
6656aefb WC	189	buf, entry->d_name);
a4783bd1 ZJS	190	break;
a4783bd1 ZJS	191	}
ffbd2c4d NC	192	}
	193	}
	194
6656aefb	195	return r;
a4783bd1 ZJS	196	}
a4783bd1 ZJS	197
2b3e18de	198	#endif
ffbd2c4d	199
8a188de9	200	int mac_smack_setup(bool *loaded_policy) {
2b3e18de KL	201
	202	#ifdef HAVE_SMACK
	203
a4783bd1 ZJS	204	int r;
a4783bd1 ZJS	205
e49d3c01 ŁS	206	assert(loaded_policy);
e49d3c01 ŁS	207
6656aefb	208	r = write_access2_rules("/etc/smack/accesses.d/");
a4783bd1 ZJS	209	switch(r) {
	210	case -ENOENT:
	211	log_debug("Smack is not enabled in the kernel.");
	212	return 0;
	213	case ENOENT:
6656aefb	214	log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
a4783bd1 ZJS	215	return 0;
	216	case 0:
	217	log_info("Successfully loaded Smack policies.");
abbacb1d NC	218	break;
abbacb1d NC	219	default:
e53fc357	220	log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
abbacb1d NC	221	return 0;
	222	}
	223
8b197c3a	224	#ifdef SMACK_RUN_LABEL
4c1fc3e4	225	r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
8b197c3a	226	if (r)
23446f01	227	log_warning_errno(r, "Failed to set SMACK label \"%s\" on self: %m", SMACK_RUN_LABEL);
8b197c3a AK	228	#endif
8b197c3a AK	229
6656aefb	230	r = write_cipso2_rules("/etc/smack/cipso.d/");
abbacb1d NC	231	switch(r) {
	232	case -ENOENT:
	233	log_debug("Smack/CIPSO is not enabled in the kernel.");
	234	return 0;
	235	case ENOENT:
6656aefb	236	log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
abbacb1d NC	237	return 0;
	238	case 0:
	239	log_info("Successfully loaded Smack/CIPSO policies.");
b9289d4c	240	break;
a4783bd1	241	default:
e53fc357	242	log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
a4783bd1 ZJS	243	return 0;
a4783bd1 ZJS	244	}
2b3e18de	245
e49d3c01 ŁS	246	*loaded_policy = true;
e49d3c01 ŁS	247
2b3e18de KL	248	#endif
	249
	250	return 0;
ffbd2c4d	251	}