src/core/smack-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright (C) 2013 Intel Corporation
   6   Authors:
   7         Nathaniel Chen <nathaniel.chen@intel.com>
   8
   9   systemd is free software; you can redistribute it and/or modify it
  10   under the terms of the GNU Lesser General Public License as published
  11   by the Free Software Foundation; either version 2.1 of the License,
  12   or (at your option) any later version.
  13
  14   systemd is distributed in the hope that it will be useful, but
  15   WITHOUT ANY WARRANTY; without even the implied warranty of
  16   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  17   Lesser General Public License for more details.
  18
  19   You should have received a copy of the GNU Lesser General Public License
  20   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  21 ***/
  22
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <stdio.h>
  27 #include <stdio_ext.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30
  31 #include "alloc-util.h"
  32 #include "dirent-util.h"
  33 #include "fd-util.h"
  34 #include "fileio.h"
  35 #include "log.h"
  36 #include "macro.h"
  37 #include "smack-setup.h"
  38 #include "string-util.h"
  39 #include "util.h"
  40
  41 #if ENABLE_SMACK
  42
  43 static int write_access2_rules(const char* srcdir) {
  44         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  45         _cleanup_closedir_ DIR *dir = NULL;
  46         struct dirent *entry;
  47         char buf[NAME_MAX];
  48         int dfd = -1;
  49         int r = 0;
  50
  51         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  52         if (load2_fd < 0)  {
  53                 if (errno != ENOENT)
  54                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  55                 return -errno; /* negative error */
  56         }
  57
  58         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  59         if (change_fd < 0)  {
  60                 if (errno != ENOENT)
  61                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  62                 return -errno; /* negative error */
  63         }
  64
  65         /* write rules to load2 or change-rule from every file in the directory */
  66         dir = opendir(srcdir);
  67         if (!dir) {
  68                 if (errno != ENOENT)
  69                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  70                 return errno; /* positive on purpose */
  71         }
  72
  73         dfd = dirfd(dir);
  74         assert(dfd >= 0);
  75
  76         FOREACH_DIRENT(entry, dir, return 0) {
  77                 int fd;
  78                 _cleanup_fclose_ FILE *policy = NULL;
  79
  80                 if (!dirent_is_file(entry))
  81                         continue;
  82
  83                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  84                 if (fd < 0) {
  85                         if (r == 0)
  86                                 r = -errno;
  87                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  88                         continue;
  89                 }
  90
  91                 policy = fdopen(fd, "re");
  92                 if (!policy) {
  93                         if (r == 0)
  94                                 r = -errno;
  95                         safe_close(fd);
  96                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  97                         continue;
  98                 }
  99
 100                 /* load2 write rules in the kernel require a line buffered stream */
 101                 FOREACH_LINE(buf, policy,
 102                              log_error_errno(errno, "Failed to read line from '%s': %m",
 103                                              entry->d_name)) {
 104
 105                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 106
 107                         if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
 108                                 continue;
 109
 110                         /* if 3 args -> load rule   : subject object access1 */
 111                         /* if 4 args -> change rule : subject object access1 access2 */
 112                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 113                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 114                                 continue;
 115                         }
 116
 117                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 118                                 if (r == 0)
 119                                         r = -errno;
 120                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 121                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 122                         }
 123                 }
 124         }
 125
 126         return r;
 127 }
 128
 129 static int write_cipso2_rules(const char* srcdir) {
 130         _cleanup_close_ int cipso2_fd = -1;
 131         _cleanup_closedir_ DIR *dir = NULL;
 132         struct dirent *entry;
 133         char buf[NAME_MAX];
 134         int dfd = -1;
 135         int r = 0;
 136
 137         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 138         if (cipso2_fd < 0)  {
 139                 if (errno != ENOENT)
 140                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 141                 return -errno; /* negative error */
 142         }
 143
 144         /* write rules to cipso2 from every file in the directory */
 145         dir = opendir(srcdir);
 146         if (!dir) {
 147                 if (errno != ENOENT)
 148                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 149                 return errno; /* positive on purpose */
 150         }
 151
 152         dfd = dirfd(dir);
 153         assert(dfd >= 0);
 154
 155         FOREACH_DIRENT(entry, dir, return 0) {
 156                 int fd;
 157                 _cleanup_fclose_ FILE *policy = NULL;
 158
 159                 if (!dirent_is_file(entry))
 160                         continue;
 161
 162                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 163                 if (fd < 0) {
 164                         if (r == 0)
 165                                 r = -errno;
 166                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 167                         continue;
 168                 }
 169
 170                 policy = fdopen(fd, "re");
 171                 if (!policy) {
 172                         if (r == 0)
 173                                 r = -errno;
 174                         safe_close(fd);
 175                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 176                         continue;
 177                 }
 178
 179                 /* cipso2 write rules in the kernel require a line buffered stream */
 180                 FOREACH_LINE(buf, policy,
 181                              log_error_errno(errno, "Failed to read line from '%s': %m",
 182                                              entry->d_name)) {
 183
 184                         if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
 185                                 continue;
 186
 187                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 188                                 if (r == 0)
 189                                         r = -errno;
 190                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 191                                                 buf, entry->d_name);
 192                                 break;
 193                         }
 194                 }
 195         }
 196
 197         return r;
 198 }
 199
 200 static int write_netlabel_rules(const char* srcdir) {
 201         _cleanup_fclose_ FILE *dst = NULL;
 202         _cleanup_closedir_ DIR *dir = NULL;
 203         struct dirent *entry;
 204         char buf[NAME_MAX];
 205         int dfd = -1;
 206         int r = 0;
 207
 208         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 209         if (!dst)  {
 210                 if (errno != ENOENT)
 211                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 212                 return -errno; /* negative error */
 213         }
 214
 215         /* write rules to dst from every file in the directory */
 216         dir = opendir(srcdir);
 217         if (!dir) {
 218                 if (errno != ENOENT)
 219                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 220                 return errno; /* positive on purpose */
 221         }
 222
 223         dfd = dirfd(dir);
 224         assert(dfd >= 0);
 225
 226         FOREACH_DIRENT(entry, dir, return 0) {
 227                 int fd;
 228                 _cleanup_fclose_ FILE *policy = NULL;
 229
 230                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 231                 if (fd < 0) {
 232                         if (r == 0)
 233                                 r = -errno;
 234                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 235                         continue;
 236                 }
 237
 238                 policy = fdopen(fd, "re");
 239                 if (!policy) {
 240                         if (r == 0)
 241                                 r = -errno;
 242                         safe_close(fd);
 243                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 244                         continue;
 245                 }
 246
 247                 (void) __fsetlocking(policy, FSETLOCKING_BYCALLER);
 248
 249                 /* load2 write rules in the kernel require a line buffered stream */
 250                 FOREACH_LINE(buf, policy,
 251                              log_error_errno(errno, "Failed to read line from %s: %m", entry->d_name)) {
 252
 253                         int q;
 254
 255                         if (!fputs(buf, dst)) {
 256                                 if (r == 0)
 257                                         r = -EINVAL;
 258                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
 259                                 break;
 260                         }
 261                         q = fflush_and_check(dst);
 262                         if (q < 0) {
 263                                 if (r == 0)
 264                                         r = q;
 265                                 log_error_errno(q, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 266                                 break;
 267                         }
 268                 }
 269         }
 270
 271         return r;
 272 }
 273
 274 static int write_onlycap_list(void) {
 275         _cleanup_close_ int onlycap_fd = -1;
 276         _cleanup_free_ char *list = NULL;
 277         _cleanup_fclose_ FILE *f = NULL;
 278         size_t len = 0, allocated = 0;
 279         char buf[LINE_MAX];
 280         int r;
 281
 282         f = fopen("/etc/smack/onlycap", "re");
 283         if (!f) {
 284                 if (errno != ENOENT)
 285                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap'");
 286                 return errno == ENOENT ? ENOENT : -errno;
 287         }
 288
 289         FOREACH_LINE(buf, f, return -errno) {
 290                 size_t l;
 291
 292                 if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
 293                         continue;
 294
 295                 l = strlen(buf);
 296                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 297                         return log_oom();
 298
 299                 stpcpy(list + len, buf)[0] = ' ';
 300                 len += l + 1;
 301         }
 302
 303         if (!len)
 304                 return 0;
 305
 306         list[len - 1] = 0;
 307
 308         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 309         if (onlycap_fd < 0) {
 310                 if (errno != ENOENT)
 311                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap'");
 312                 return -errno; /* negative error */
 313         }
 314
 315         r = write(onlycap_fd, list, len);
 316         if (r < 0)
 317                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list);
 318
 319         return 0;
 320 }
 321
 322 #endif
 323
 324 int mac_smack_setup(bool *loaded_policy) {
 325
 326 #if ENABLE_SMACK
 327
 328         int r;
 329
 330         assert(loaded_policy);
 331
 332         r = write_access2_rules("/etc/smack/accesses.d/");
 333         switch(r) {
 334         case -ENOENT:
 335                 log_debug("Smack is not enabled in the kernel.");
 336                 return 0;
 337         case ENOENT:
 338                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 339                 return 0;
 340         case 0:
 341                 log_info("Successfully loaded Smack policies.");
 342                 break;
 343         default:
 344                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 345                 return 0;
 346         }
 347
 348 #ifdef SMACK_RUN_LABEL
 349         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 350         if (r < 0)
 351                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 352         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 353         if (r < 0)
 354                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 355         r = write_string_file("/sys/fs/smackfs/netlabel",
 356                               "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 357         if (r < 0)
 358                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 359         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 360         if (r < 0)
 361                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 362 #endif
 363
 364         r = write_cipso2_rules("/etc/smack/cipso.d/");
 365         switch(r) {
 366         case -ENOENT:
 367                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 368                 return 0;
 369         case ENOENT:
 370                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 371                 break;
 372         case 0:
 373                 log_info("Successfully loaded Smack/CIPSO policies.");
 374                 break;
 375         default:
 376                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 377                 break;
 378         }
 379
 380         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 381         switch(r) {
 382         case -ENOENT:
 383                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 384                 return 0;
 385         case ENOENT:
 386                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 387                 break;
 388         case 0:
 389                 log_info("Successfully loaded Smack network host rules.");
 390                 break;
 391         default:
 392                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 393                 break;
 394         }
 395
 396         r = write_onlycap_list();
 397         switch(r) {
 398         case -ENOENT:
 399                 log_debug("Smack is not enabled in the kernel.");
 400                 break;
 401         case ENOENT:
 402                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 403                 break;
 404         case 0:
 405                 log_info("Successfully wrote Smack onlycap list.");
 406                 break;
 407         default:
 408                 log_emergency_errno(r, "Failed to write Smack onlycap list.");
 409                 return r;
 410         }
 411
 412         *loaded_policy = true;
 413
 414 #endif
 415
 416         return 0;
 417 }