src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright (C) 2013 Intel Corporation
   4   Authors:
   5         Nathaniel Chen <nathaniel.chen@intel.com>
   6 ***/
   7
   8 #include <dirent.h>
   9 #include <errno.h>
  10 #include <fcntl.h>
  11 #include <stdio.h>
  12 #include <stdio_ext.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15
  16 #include "alloc-util.h"
  17 #include "dirent-util.h"
  18 #include "fd-util.h"
  19 #include "fileio.h"
  20 #include "log.h"
  21 #include "macro.h"
  22 #include "smack-setup.h"
  23 #include "string-util.h"
  24 #include "util.h"
  25
  26 #if ENABLE_SMACK
  27
  28 static int write_access2_rules(const char* srcdir) {
  29         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  30         _cleanup_closedir_ DIR *dir = NULL;
  31         struct dirent *entry;
  32         char buf[NAME_MAX];
  33         int dfd = -1;
  34         int r = 0;
  35
  36         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  37         if (load2_fd < 0)  {
  38                 if (errno != ENOENT)
  39                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  40                 return -errno; /* negative error */
  41         }
  42
  43         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  44         if (change_fd < 0)  {
  45                 if (errno != ENOENT)
  46                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  47                 return -errno; /* negative error */
  48         }
  49
  50         /* write rules to load2 or change-rule from every file in the directory */
  51         dir = opendir(srcdir);
  52         if (!dir) {
  53                 if (errno != ENOENT)
  54                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  55                 return errno; /* positive on purpose */
  56         }
  57
  58         dfd = dirfd(dir);
  59         assert(dfd >= 0);
  60
  61         FOREACH_DIRENT(entry, dir, return 0) {
  62                 int fd;
  63                 _cleanup_fclose_ FILE *policy = NULL;
  64
  65                 if (!dirent_is_file(entry))
  66                         continue;
  67
  68                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  69                 if (fd < 0) {
  70                         if (r == 0)
  71                                 r = -errno;
  72                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  73                         continue;
  74                 }
  75
  76                 policy = fdopen(fd, "re");
  77                 if (!policy) {
  78                         if (r == 0)
  79                                 r = -errno;
  80                         safe_close(fd);
  81                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  82                         continue;
  83                 }
  84
  85                 /* load2 write rules in the kernel require a line buffered stream */
  86                 FOREACH_LINE(buf, policy,
  87                              log_error_errno(errno, "Failed to read line from '%s': %m",
  88                                              entry->d_name)) {
  89
  90                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
  91
  92                         if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
  93                                 continue;
  94
  95                         /* if 3 args -> load rule   : subject object access1 */
  96                         /* if 4 args -> change rule : subject object access1 access2 */
  97                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
  98                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
  99                                 continue;
 100                         }
 101
 102                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 103                                 if (r == 0)
 104                                         r = -errno;
 105                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 106                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 107                         }
 108                 }
 109         }
 110
 111         return r;
 112 }
 113
 114 static int write_cipso2_rules(const char* srcdir) {
 115         _cleanup_close_ int cipso2_fd = -1;
 116         _cleanup_closedir_ DIR *dir = NULL;
 117         struct dirent *entry;
 118         char buf[NAME_MAX];
 119         int dfd = -1;
 120         int r = 0;
 121
 122         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 123         if (cipso2_fd < 0)  {
 124                 if (errno != ENOENT)
 125                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 126                 return -errno; /* negative error */
 127         }
 128
 129         /* write rules to cipso2 from every file in the directory */
 130         dir = opendir(srcdir);
 131         if (!dir) {
 132                 if (errno != ENOENT)
 133                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 134                 return errno; /* positive on purpose */
 135         }
 136
 137         dfd = dirfd(dir);
 138         assert(dfd >= 0);
 139
 140         FOREACH_DIRENT(entry, dir, return 0) {
 141                 int fd;
 142                 _cleanup_fclose_ FILE *policy = NULL;
 143
 144                 if (!dirent_is_file(entry))
 145                         continue;
 146
 147                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 148                 if (fd < 0) {
 149                         if (r == 0)
 150                                 r = -errno;
 151                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 152                         continue;
 153                 }
 154
 155                 policy = fdopen(fd, "re");
 156                 if (!policy) {
 157                         if (r == 0)
 158                                 r = -errno;
 159                         safe_close(fd);
 160                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 161                         continue;
 162                 }
 163
 164                 /* cipso2 write rules in the kernel require a line buffered stream */
 165                 FOREACH_LINE(buf, policy,
 166                              log_error_errno(errno, "Failed to read line from '%s': %m",
 167                                              entry->d_name)) {
 168
 169                         if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
 170                                 continue;
 171
 172                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 173                                 if (r == 0)
 174                                         r = -errno;
 175                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 176                                                 buf, entry->d_name);
 177                                 break;
 178                         }
 179                 }
 180         }
 181
 182         return r;
 183 }
 184
 185 static int write_netlabel_rules(const char* srcdir) {
 186         _cleanup_fclose_ FILE *dst = NULL;
 187         _cleanup_closedir_ DIR *dir = NULL;
 188         struct dirent *entry;
 189         char buf[NAME_MAX];
 190         int dfd = -1;
 191         int r = 0;
 192
 193         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 194         if (!dst)  {
 195                 if (errno != ENOENT)
 196                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 197                 return -errno; /* negative error */
 198         }
 199
 200         /* write rules to dst from every file in the directory */
 201         dir = opendir(srcdir);
 202         if (!dir) {
 203                 if (errno != ENOENT)
 204                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 205                 return errno; /* positive on purpose */
 206         }
 207
 208         dfd = dirfd(dir);
 209         assert(dfd >= 0);
 210
 211         FOREACH_DIRENT(entry, dir, return 0) {
 212                 int fd;
 213                 _cleanup_fclose_ FILE *policy = NULL;
 214
 215                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 216                 if (fd < 0) {
 217                         if (r == 0)
 218                                 r = -errno;
 219                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 220                         continue;
 221                 }
 222
 223                 policy = fdopen(fd, "re");
 224                 if (!policy) {
 225                         if (r == 0)
 226                                 r = -errno;
 227                         safe_close(fd);
 228                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 229                         continue;
 230                 }
 231
 232                 (void) __fsetlocking(policy, FSETLOCKING_BYCALLER);
 233
 234                 /* load2 write rules in the kernel require a line buffered stream */
 235                 FOREACH_LINE(buf, policy,
 236                              log_error_errno(errno, "Failed to read line from %s: %m", entry->d_name)) {
 237
 238                         int q;
 239
 240                         if (!fputs(buf, dst)) {
 241                                 if (r == 0)
 242                                         r = -EINVAL;
 243                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
 244                                 break;
 245                         }
 246                         q = fflush_and_check(dst);
 247                         if (q < 0) {
 248                                 if (r == 0)
 249                                         r = q;
 250                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 251                                 break;
 252                         }
 253                 }
 254         }
 255
 256         return r;
 257 }
 258
 259 static int write_onlycap_list(void) {
 260         _cleanup_close_ int onlycap_fd = -1;
 261         _cleanup_free_ char *list = NULL;
 262         _cleanup_fclose_ FILE *f = NULL;
 263         size_t len = 0, allocated = 0;
 264         char buf[LINE_MAX];
 265         int r;
 266
 267         f = fopen("/etc/smack/onlycap", "re");
 268         if (!f) {
 269                 if (errno != ENOENT)
 270                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap'");
 271                 return errno == ENOENT ? ENOENT : -errno;
 272         }
 273
 274         FOREACH_LINE(buf, f, return -errno) {
 275                 size_t l;
 276
 277                 if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
 278                         continue;
 279
 280                 l = strlen(buf);
 281                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 282                         return log_oom();
 283
 284                 stpcpy(list + len, buf)[0] = ' ';
 285                 len += l + 1;
 286         }
 287
 288         if (!len)
 289                 return 0;
 290
 291         list[len - 1] = 0;
 292
 293         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 294         if (onlycap_fd < 0) {
 295                 if (errno != ENOENT)
 296                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap'");
 297                 return -errno; /* negative error */
 298         }
 299
 300         r = write(onlycap_fd, list, len);
 301         if (r < 0)
 302                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list);
 303
 304         return 0;
 305 }
 306
 307 #endif
 308
 309 int mac_smack_setup(bool *loaded_policy) {
 310
 311 #if ENABLE_SMACK
 312
 313         int r;
 314
 315         assert(loaded_policy);
 316
 317         r = write_access2_rules("/etc/smack/accesses.d/");
 318         switch(r) {
 319         case -ENOENT:
 320                 log_debug("Smack is not enabled in the kernel.");
 321                 return 0;
 322         case ENOENT:
 323                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 324                 return 0;
 325         case 0:
 326                 log_info("Successfully loaded Smack policies.");
 327                 break;
 328         default:
 329                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 330                 return 0;
 331         }
 332
 333 #ifdef SMACK_RUN_LABEL
 334         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 335         if (r < 0)
 336                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 337         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 338         if (r < 0)
 339                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 340         r = write_string_file("/sys/fs/smackfs/netlabel",
 341                               "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 342         if (r < 0)
 343                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 344         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 345         if (r < 0)
 346                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 347 #endif
 348
 349         r = write_cipso2_rules("/etc/smack/cipso.d/");
 350         switch(r) {
 351         case -ENOENT:
 352                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 353                 return 0;
 354         case ENOENT:
 355                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 356                 break;
 357         case 0:
 358                 log_info("Successfully loaded Smack/CIPSO policies.");
 359                 break;
 360         default:
 361                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 362                 break;
 363         }
 364
 365         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 366         switch(r) {
 367         case -ENOENT:
 368                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 369                 return 0;
 370         case ENOENT:
 371                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 372                 break;
 373         case 0:
 374                 log_info("Successfully loaded Smack network host rules.");
 375                 break;
 376         default:
 377                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 378                 break;
 379         }
 380
 381         r = write_onlycap_list();
 382         switch(r) {
 383         case -ENOENT:
 384                 log_debug("Smack is not enabled in the kernel.");
 385                 break;
 386         case ENOENT:
 387                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 388                 break;
 389         case 0:
 390                 log_info("Successfully wrote Smack onlycap list.");
 391                 break;
 392         default:
 393                 log_emergency_errno(r, "Failed to write Smack onlycap list.");
 394                 return r;
 395         }
 396
 397         *loaded_policy = true;
 398
 399 #endif
 400
 401         return 0;
 402 }