src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright © 2013 Intel Corporation
   4   Authors:
   5         Nathaniel Chen <nathaniel.chen@intel.com>
   6 ***/
   7
   8 #include <dirent.h>
   9 #include <errno.h>
  10 #include <fcntl.h>
  11 #include <stdio.h>
  12 #include <stdio_ext.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15
  16 #include "alloc-util.h"
  17 #include "dirent-util.h"
  18 #include "fd-util.h"
  19 #include "fileio.h"
  20 #include "log.h"
  21 #include "macro.h"
  22 #include "smack-setup.h"
  23 #include "string-util.h"
  24 #include "util.h"
  25
  26 #if ENABLE_SMACK
  27
  28 static int write_access2_rules(const char* srcdir) {
  29         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  30         _cleanup_closedir_ DIR *dir = NULL;
  31         struct dirent *entry;
  32         int dfd = -1;
  33         int r = 0;
  34
  35         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  36         if (load2_fd < 0)  {
  37                 if (errno != ENOENT)
  38                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  39                 return -errno; /* negative error */
  40         }
  41
  42         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  43         if (change_fd < 0)  {
  44                 if (errno != ENOENT)
  45                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  46                 return -errno; /* negative error */
  47         }
  48
  49         /* write rules to load2 or change-rule from every file in the directory */
  50         dir = opendir(srcdir);
  51         if (!dir) {
  52                 if (errno != ENOENT)
  53                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  54                 return errno; /* positive on purpose */
  55         }
  56
  57         dfd = dirfd(dir);
  58         assert(dfd >= 0);
  59
  60         FOREACH_DIRENT(entry, dir, return 0) {
  61                 int fd;
  62                 _cleanup_fclose_ FILE *policy = NULL;
  63
  64                 if (!dirent_is_file(entry))
  65                         continue;
  66
  67                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  68                 if (fd < 0) {
  69                         if (r == 0)
  70                                 r = -errno;
  71                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  72                         continue;
  73                 }
  74
  75                 policy = fdopen(fd, "r");
  76                 if (!policy) {
  77                         if (r == 0)
  78                                 r = -errno;
  79                         safe_close(fd);
  80                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  81                         continue;
  82                 }
  83
  84                 /* load2 write rules in the kernel require a line buffered stream */
  85                 for (;;) {
  86                         _cleanup_free_ char *buf = NULL, *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
  87                         int q;
  88
  89                         q = read_line(policy, NAME_MAX, &buf);
  90                         if (q < 0)
  91                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
  92                         if (q == 0)
  93                                 break;
  94
  95                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
  96                                 continue;
  97
  98                         /* if 3 args -> load rule   : subject object access1 */
  99                         /* if 4 args -> change rule : subject object access1 access2 */
 100                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 101                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 102                                 continue;
 103                         }
 104
 105                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 106                                 if (r == 0)
 107                                         r = -errno;
 108                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s': %m",
 109                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 110                         }
 111                 }
 112         }
 113
 114         return r;
 115 }
 116
 117 static int write_cipso2_rules(const char* srcdir) {
 118         _cleanup_close_ int cipso2_fd = -1;
 119         _cleanup_closedir_ DIR *dir = NULL;
 120         struct dirent *entry;
 121         int dfd = -1;
 122         int r = 0;
 123
 124         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 125         if (cipso2_fd < 0)  {
 126                 if (errno != ENOENT)
 127                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 128                 return -errno; /* negative error */
 129         }
 130
 131         /* write rules to cipso2 from every file in the directory */
 132         dir = opendir(srcdir);
 133         if (!dir) {
 134                 if (errno != ENOENT)
 135                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 136                 return errno; /* positive on purpose */
 137         }
 138
 139         dfd = dirfd(dir);
 140         assert(dfd >= 0);
 141
 142         FOREACH_DIRENT(entry, dir, return 0) {
 143                 int fd;
 144                 _cleanup_fclose_ FILE *policy = NULL;
 145
 146                 if (!dirent_is_file(entry))
 147                         continue;
 148
 149                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 150                 if (fd < 0) {
 151                         if (r == 0)
 152                                 r = -errno;
 153                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 154                         continue;
 155                 }
 156
 157                 policy = fdopen(fd, "r");
 158                 if (!policy) {
 159                         if (r == 0)
 160                                 r = -errno;
 161                         safe_close(fd);
 162                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 163                         continue;
 164                 }
 165
 166                 /* cipso2 write rules in the kernel require a line buffered stream */
 167                 for (;;) {
 168                         _cleanup_free_ char *buf = NULL;
 169                         int q;
 170
 171                         q = read_line(policy, NAME_MAX, &buf);
 172                         if (q < 0)
 173                                 return log_error_errno(q, "Failed to read line from '%s': %m", entry->d_name);
 174                         if (q == 0)
 175                                 break;
 176
 177                         if (isempty(buf) || strchr(COMMENTS, buf[0]))
 178                                 continue;
 179
 180                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 181                                 if (r == 0)
 182                                         r = -errno;
 183                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s': %m",
 184                                                 buf, entry->d_name);
 185                                 break;
 186                         }
 187                 }
 188         }
 189
 190         return r;
 191 }
 192
 193 static int write_netlabel_rules(const char* srcdir) {
 194         _cleanup_fclose_ FILE *dst = NULL;
 195         _cleanup_closedir_ DIR *dir = NULL;
 196         struct dirent *entry;
 197         int dfd = -1;
 198         int r = 0;
 199
 200         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 201         if (!dst)  {
 202                 if (errno != ENOENT)
 203                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 204                 return -errno; /* negative error */
 205         }
 206
 207         /* write rules to dst from every file in the directory */
 208         dir = opendir(srcdir);
 209         if (!dir) {
 210                 if (errno != ENOENT)
 211                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 212                 return errno; /* positive on purpose */
 213         }
 214
 215         dfd = dirfd(dir);
 216         assert(dfd >= 0);
 217
 218         FOREACH_DIRENT(entry, dir, return 0) {
 219                 int fd;
 220                 _cleanup_fclose_ FILE *policy = NULL;
 221
 222                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 223                 if (fd < 0) {
 224                         if (r == 0)
 225                                 r = -errno;
 226                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 227                         continue;
 228                 }
 229
 230                 policy = fdopen(fd, "r");
 231                 if (!policy) {
 232                         if (r == 0)
 233                                 r = -errno;
 234                         safe_close(fd);
 235                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 236                         continue;
 237                 }
 238
 239                 (void) __fsetlocking(policy, FSETLOCKING_BYCALLER);
 240
 241                 /* load2 write rules in the kernel require a line buffered stream */
 242                 for (;;) {
 243                         _cleanup_free_ char *buf = NULL;
 244                         int q;
 245
 246                         q = read_line(policy, NAME_MAX, &buf);
 247                         if (q < 0)
 248                                 return log_error_errno(q, "Failed to read line from %s: %m", entry->d_name);
 249                         if (q == 0)
 250                                 break;
 251
 252                         if (!fputs(buf, dst)) {
 253                                 if (r == 0)
 254                                         r = -EINVAL;
 255                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel: %m");
 256                                 break;
 257                         }
 258                         q = fflush_and_check(dst);
 259                         if (q < 0) {
 260                                 if (r == 0)
 261                                         r = q;
 262                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 263                                 break;
 264                         }
 265                 }
 266         }
 267
 268         return r;
 269 }
 270
 271 static int write_onlycap_list(void) {
 272         _cleanup_close_ int onlycap_fd = -1;
 273         _cleanup_free_ char *list = NULL;
 274         _cleanup_fclose_ FILE *f = NULL;
 275         size_t len = 0, allocated = 0;
 276         int r;
 277
 278         f = fopen("/etc/smack/onlycap", "re");
 279         if (!f) {
 280                 if (errno != ENOENT)
 281                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap': %m");
 282
 283                 return errno == ENOENT ? ENOENT : -errno;
 284         }
 285
 286         for (;;) {
 287                 _cleanup_free_ char *buf = NULL;
 288                 size_t l;
 289
 290                 r = read_line(f, LONG_LINE_MAX, &buf);
 291                 if (r < 0)
 292                         return log_error_errno(r, "Failed to read line from /etc/smack/onlycap: %m");
 293                 if (r == 0)
 294                         break;
 295
 296                 if (isempty(buf) || strchr(COMMENTS, *buf))
 297                         continue;
 298
 299                 l = strlen(buf);
 300                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 301                         return log_oom();
 302
 303                 stpcpy(list + len, buf)[0] = ' ';
 304                 len += l + 1;
 305         }
 306
 307         if (len == 0)
 308                 return 0;
 309
 310         list[len - 1] = 0;
 311
 312         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 313         if (onlycap_fd < 0) {
 314                 if (errno != ENOENT)
 315                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap': %m");
 316                 return -errno; /* negative error */
 317         }
 318
 319         r = write(onlycap_fd, list, len);
 320         if (r < 0)
 321                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap': %m", list);
 322
 323         return 0;
 324 }
 325
 326 #endif
 327
 328 int mac_smack_setup(bool *loaded_policy) {
 329
 330 #if ENABLE_SMACK
 331
 332         int r;
 333
 334         assert(loaded_policy);
 335
 336         r = write_access2_rules("/etc/smack/accesses.d/");
 337         switch(r) {
 338         case -ENOENT:
 339                 log_debug("Smack is not enabled in the kernel.");
 340                 return 0;
 341         case ENOENT:
 342                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 343                 return 0;
 344         case 0:
 345                 log_info("Successfully loaded Smack policies.");
 346                 break;
 347         default:
 348                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 349                 return 0;
 350         }
 351
 352 #ifdef SMACK_RUN_LABEL
 353         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 354         if (r < 0)
 355                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 356         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 357         if (r < 0)
 358                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 359         r = write_string_file("/sys/fs/smackfs/netlabel",
 360                               "0.0.0.0/0 " SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
 361         if (r < 0)
 362                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 363         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", WRITE_STRING_FILE_DISABLE_BUFFER);
 364         if (r < 0)
 365                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 366 #endif
 367
 368         r = write_cipso2_rules("/etc/smack/cipso.d/");
 369         switch(r) {
 370         case -ENOENT:
 371                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 372                 return 0;
 373         case ENOENT:
 374                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 375                 break;
 376         case 0:
 377                 log_info("Successfully loaded Smack/CIPSO policies.");
 378                 break;
 379         default:
 380                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 381                 break;
 382         }
 383
 384         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 385         switch(r) {
 386         case -ENOENT:
 387                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 388                 return 0;
 389         case ENOENT:
 390                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 391                 break;
 392         case 0:
 393                 log_info("Successfully loaded Smack network host rules.");
 394                 break;
 395         default:
 396                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 397                 break;
 398         }
 399
 400         r = write_onlycap_list();
 401         switch(r) {
 402         case -ENOENT:
 403                 log_debug("Smack is not enabled in the kernel.");
 404                 break;
 405         case ENOENT:
 406                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 407                 break;
 408         case 0:
 409                 log_info("Successfully wrote Smack onlycap list.");
 410                 break;
 411         default:
 412                 log_emergency_errno(r, "Failed to write Smack onlycap list: %m");
 413                 return r;
 414         }
 415
 416         *loaded_policy = true;
 417
 418 #endif
 419
 420         return 0;
 421 }