src/core/smack-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright (C) 2013 Intel Corporation
   7   Authors:
   8         Nathaniel Chen <nathaniel.chen@intel.com>
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published
  12   by the Free Software Foundation; either version 2.1 of the License,
  13   or (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 #include <dirent.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30
  31 #include "dirent-util.h"
  32 #include "fd-util.h"
  33 #include "fileio.h"
  34 #include "log.h"
  35 #include "macro.h"
  36 #include "smack-setup.h"
  37 #include "string-util.h"
  38 #include "util.h"
  39
  40 #ifdef HAVE_SMACK
  41
  42 static int write_access2_rules(const char* srcdir) {
  43         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  44         _cleanup_closedir_ DIR *dir = NULL;
  45         struct dirent *entry;
  46         char buf[NAME_MAX];
  47         int dfd = -1;
  48         int r = 0;
  49
  50         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  51         if (load2_fd < 0)  {
  52                 if (errno != ENOENT)
  53                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  54                 return -errno; /* negative error */
  55         }
  56
  57         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  58         if (change_fd < 0)  {
  59                 if (errno != ENOENT)
  60                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  61                 return -errno; /* negative error */
  62         }
  63
  64         /* write rules to load2 or change-rule from every file in the directory */
  65         dir = opendir(srcdir);
  66         if (!dir) {
  67                 if (errno != ENOENT)
  68                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  69                 return errno; /* positive on purpose */
  70         }
  71
  72         dfd = dirfd(dir);
  73         assert(dfd >= 0);
  74
  75         FOREACH_DIRENT(entry, dir, return 0) {
  76                 int fd;
  77                 _cleanup_fclose_ FILE *policy = NULL;
  78
  79                 if (!dirent_is_file(entry))
  80                         continue;
  81
  82                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  83                 if (fd < 0) {
  84                         if (r == 0)
  85                                 r = -errno;
  86                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  87                         continue;
  88                 }
  89
  90                 policy = fdopen(fd, "re");
  91                 if (!policy) {
  92                         if (r == 0)
  93                                 r = -errno;
  94                         safe_close(fd);
  95                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  96                         continue;
  97                 }
  98
  99                 /* load2 write rules in the kernel require a line buffered stream */
 100                 FOREACH_LINE(buf, policy,
 101                              log_error_errno(errno, "Failed to read line from '%s': %m",
 102                                              entry->d_name)) {
 103
 104                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 105
 106                         if (isempty(truncate_nl(buf)))
 107                                 continue;
 108
 109                         /* if 3 args -> load rule   : subject object access1 */
 110                         /* if 4 args -> change rule : subject object access1 access2 */
 111                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 112                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 113                                 continue;
 114                         }
 115
 116                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 117                                 if (r == 0)
 118                                         r = -errno;
 119                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 120                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 121                         }
 122                 }
 123         }
 124
 125         return r;
 126 }
 127
 128 static int write_cipso2_rules(const char* srcdir) {
 129         _cleanup_close_ int cipso2_fd = -1;
 130         _cleanup_closedir_ DIR *dir = NULL;
 131         struct dirent *entry;
 132         char buf[NAME_MAX];
 133         int dfd = -1;
 134         int r = 0;
 135
 136         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 137         if (cipso2_fd < 0)  {
 138                 if (errno != ENOENT)
 139                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 140                 return -errno; /* negative error */
 141         }
 142
 143         /* write rules to cipso2 from every file in the directory */
 144         dir = opendir(srcdir);
 145         if (!dir) {
 146                 if (errno != ENOENT)
 147                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 148                 return errno; /* positive on purpose */
 149         }
 150
 151         dfd = dirfd(dir);
 152         assert(dfd >= 0);
 153
 154         FOREACH_DIRENT(entry, dir, return 0) {
 155                 int fd;
 156                 _cleanup_fclose_ FILE *policy = NULL;
 157
 158                 if (!dirent_is_file(entry))
 159                         continue;
 160
 161                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 162                 if (fd < 0) {
 163                         if (r == 0)
 164                                 r = -errno;
 165                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 166                         continue;
 167                 }
 168
 169                 policy = fdopen(fd, "re");
 170                 if (!policy) {
 171                         if (r == 0)
 172                                 r = -errno;
 173                         safe_close(fd);
 174                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 175                         continue;
 176                 }
 177
 178                 /* cipso2 write rules in the kernel require a line buffered stream */
 179                 FOREACH_LINE(buf, policy,
 180                              log_error_errno(errno, "Failed to read line from '%s': %m",
 181                                              entry->d_name)) {
 182
 183                         if (isempty(truncate_nl(buf)))
 184                                 continue;
 185
 186                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 187                                 if (r == 0)
 188                                         r = -errno;
 189                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 190                                                 buf, entry->d_name);
 191                                 break;
 192                         }
 193                 }
 194         }
 195
 196         return r;
 197 }
 198
 199 #endif
 200
 201 int mac_smack_setup(bool *loaded_policy) {
 202
 203 #ifdef HAVE_SMACK
 204
 205         int r;
 206
 207         assert(loaded_policy);
 208
 209         r = write_access2_rules("/etc/smack/accesses.d/");
 210         switch(r) {
 211         case -ENOENT:
 212                 log_debug("Smack is not enabled in the kernel.");
 213                 return 0;
 214         case ENOENT:
 215                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 216                 return 0;
 217         case 0:
 218                 log_info("Successfully loaded Smack policies.");
 219                 break;
 220         default:
 221                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 222                 return 0;
 223         }
 224
 225 #ifdef SMACK_RUN_LABEL
 226         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 227         if (r)
 228                 log_warning_errno(r, "Failed to set SMACK label \"%s\" on self: %m", SMACK_RUN_LABEL);
 229 #endif
 230
 231         r = write_cipso2_rules("/etc/smack/cipso.d/");
 232         switch(r) {
 233         case -ENOENT:
 234                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 235                 return 0;
 236         case ENOENT:
 237                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 238                 return 0;
 239         case 0:
 240                 log_info("Successfully loaded Smack/CIPSO policies.");
 241                 break;
 242         default:
 243                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 244                 return 0;
 245         }
 246
 247         *loaded_policy = true;
 248
 249 #endif
 250
 251         return 0;
 252 }