src/core/smack-setup.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright (C) 2013 Intel Corporation
   5   Authors:
   6         Nathaniel Chen <nathaniel.chen@intel.com>
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published
  10   by the Free Software Foundation; either version 2.1 of the License,
  11   or (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <dirent.h>
  23 #include <errno.h>
  24 #include <fcntl.h>
  25 #include <stdio.h>
  26 #include <stdlib.h>
  27 #include <string.h>
  28
  29 #include "alloc-util.h"
  30 #include "dirent-util.h"
  31 #include "fd-util.h"
  32 #include "fileio.h"
  33 #include "log.h"
  34 #include "macro.h"
  35 #include "smack-setup.h"
  36 #include "string-util.h"
  37 #include "util.h"
  38
  39 #if HAVE_SMACK
  40
  41 static int write_access2_rules(const char* srcdir) {
  42         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  43         _cleanup_closedir_ DIR *dir = NULL;
  44         struct dirent *entry;
  45         char buf[NAME_MAX];
  46         int dfd = -1;
  47         int r = 0;
  48
  49         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  50         if (load2_fd < 0)  {
  51                 if (errno != ENOENT)
  52                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  53                 return -errno; /* negative error */
  54         }
  55
  56         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  57         if (change_fd < 0)  {
  58                 if (errno != ENOENT)
  59                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  60                 return -errno; /* negative error */
  61         }
  62
  63         /* write rules to load2 or change-rule from every file in the directory */
  64         dir = opendir(srcdir);
  65         if (!dir) {
  66                 if (errno != ENOENT)
  67                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  68                 return errno; /* positive on purpose */
  69         }
  70
  71         dfd = dirfd(dir);
  72         assert(dfd >= 0);
  73
  74         FOREACH_DIRENT(entry, dir, return 0) {
  75                 int fd;
  76                 _cleanup_fclose_ FILE *policy = NULL;
  77
  78                 if (!dirent_is_file(entry))
  79                         continue;
  80
  81                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  82                 if (fd < 0) {
  83                         if (r == 0)
  84                                 r = -errno;
  85                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  86                         continue;
  87                 }
  88
  89                 policy = fdopen(fd, "re");
  90                 if (!policy) {
  91                         if (r == 0)
  92                                 r = -errno;
  93                         safe_close(fd);
  94                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  95                         continue;
  96                 }
  97
  98                 /* load2 write rules in the kernel require a line buffered stream */
  99                 FOREACH_LINE(buf, policy,
 100                              log_error_errno(errno, "Failed to read line from '%s': %m",
 101                                              entry->d_name)) {
 102
 103                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 104
 105                         if (isempty(truncate_nl(buf)))
 106                                 continue;
 107
 108                         /* if 3 args -> load rule   : subject object access1 */
 109                         /* if 4 args -> change rule : subject object access1 access2 */
 110                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 111                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 112                                 continue;
 113                         }
 114
 115                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 116                                 if (r == 0)
 117                                         r = -errno;
 118                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 119                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 120                         }
 121                 }
 122         }
 123
 124         return r;
 125 }
 126
 127 static int write_cipso2_rules(const char* srcdir) {
 128         _cleanup_close_ int cipso2_fd = -1;
 129         _cleanup_closedir_ DIR *dir = NULL;
 130         struct dirent *entry;
 131         char buf[NAME_MAX];
 132         int dfd = -1;
 133         int r = 0;
 134
 135         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 136         if (cipso2_fd < 0)  {
 137                 if (errno != ENOENT)
 138                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 139                 return -errno; /* negative error */
 140         }
 141
 142         /* write rules to cipso2 from every file in the directory */
 143         dir = opendir(srcdir);
 144         if (!dir) {
 145                 if (errno != ENOENT)
 146                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 147                 return errno; /* positive on purpose */
 148         }
 149
 150         dfd = dirfd(dir);
 151         assert(dfd >= 0);
 152
 153         FOREACH_DIRENT(entry, dir, return 0) {
 154                 int fd;
 155                 _cleanup_fclose_ FILE *policy = NULL;
 156
 157                 if (!dirent_is_file(entry))
 158                         continue;
 159
 160                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 161                 if (fd < 0) {
 162                         if (r == 0)
 163                                 r = -errno;
 164                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 165                         continue;
 166                 }
 167
 168                 policy = fdopen(fd, "re");
 169                 if (!policy) {
 170                         if (r == 0)
 171                                 r = -errno;
 172                         safe_close(fd);
 173                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 174                         continue;
 175                 }
 176
 177                 /* cipso2 write rules in the kernel require a line buffered stream */
 178                 FOREACH_LINE(buf, policy,
 179                              log_error_errno(errno, "Failed to read line from '%s': %m",
 180                                              entry->d_name)) {
 181
 182                         if (isempty(truncate_nl(buf)))
 183                                 continue;
 184
 185                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 186                                 if (r == 0)
 187                                         r = -errno;
 188                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 189                                                 buf, entry->d_name);
 190                                 break;
 191                         }
 192                 }
 193         }
 194
 195         return r;
 196 }
 197
 198 static int write_netlabel_rules(const char* srcdir) {
 199         _cleanup_fclose_ FILE *dst = NULL;
 200         _cleanup_closedir_ DIR *dir = NULL;
 201         struct dirent *entry;
 202         char buf[NAME_MAX];
 203         int dfd = -1;
 204         int r = 0;
 205
 206         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 207         if (!dst)  {
 208                 if (errno != ENOENT)
 209                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 210                 return -errno; /* negative error */
 211         }
 212
 213         /* write rules to dst from every file in the directory */
 214         dir = opendir(srcdir);
 215         if (!dir) {
 216                 if (errno != ENOENT)
 217                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 218                 return errno; /* positive on purpose */
 219         }
 220
 221         dfd = dirfd(dir);
 222         assert(dfd >= 0);
 223
 224         FOREACH_DIRENT(entry, dir, return 0) {
 225                 int fd;
 226                 _cleanup_fclose_ FILE *policy = NULL;
 227
 228                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 229                 if (fd < 0) {
 230                         if (r == 0)
 231                                 r = -errno;
 232                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 233                         continue;
 234                 }
 235
 236                 policy = fdopen(fd, "re");
 237                 if (!policy) {
 238                         if (r == 0)
 239                                 r = -errno;
 240                         safe_close(fd);
 241                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 242                         continue;
 243                 }
 244
 245                 /* load2 write rules in the kernel require a line buffered stream */
 246                 FOREACH_LINE(buf, policy,
 247                              log_error_errno(errno, "Failed to read line from %s: %m",
 248                                        entry->d_name)) {
 249                         if (!fputs_unlocked(buf, dst)) {
 250                                 if (r == 0)
 251                                         r = -EINVAL;
 252                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
 253                                 break;
 254                         }
 255                         if (fflush(dst)) {
 256                                 if (r == 0)
 257                                         r = -errno;
 258                                 log_error_errno(errno, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 259                                 break;
 260                         }
 261                 }
 262         }
 263
 264         return r;
 265 }
 266
 267 static int write_onlycap_list(void) {
 268         _cleanup_close_ int onlycap_fd = -1;
 269         _cleanup_free_ char *list = NULL;
 270         _cleanup_fclose_ FILE *f = NULL;
 271         size_t len = 0, allocated = 0;
 272         char buf[LINE_MAX];
 273         int r;
 274
 275         f = fopen("/etc/smack/onlycap", "re");
 276         if (!f) {
 277                 if (errno != ENOENT)
 278                         log_warning_errno(errno, "Failed to read '/etc/smack/onlycap'");
 279                 return errno == ENOENT ? ENOENT : -errno;
 280         }
 281
 282         FOREACH_LINE(buf, f, return -errno) {
 283                 size_t l;
 284
 285                 if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
 286                         continue;
 287
 288                 l = strlen(buf);
 289                 if (!GREEDY_REALLOC(list, allocated, len + l + 1))
 290                         return log_oom();
 291
 292                 stpcpy(list + len, buf)[0] = ' ';
 293                 len += l + 1;
 294         }
 295
 296         if (!len)
 297                 return 0;
 298
 299         list[len - 1] = 0;
 300
 301         onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 302         if (onlycap_fd < 0) {
 303                 if (errno != ENOENT)
 304                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap'");
 305                 return -errno; /* negative error */
 306         }
 307
 308         r = write(onlycap_fd, list, len);
 309         if (r < 0)
 310                 return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list);
 311
 312         return 0;
 313 }
 314
 315 #endif
 316
 317 int mac_smack_setup(bool *loaded_policy) {
 318
 319 #if HAVE_SMACK
 320
 321         int r;
 322
 323         assert(loaded_policy);
 324
 325         r = write_access2_rules("/etc/smack/accesses.d/");
 326         switch(r) {
 327         case -ENOENT:
 328                 log_debug("Smack is not enabled in the kernel.");
 329                 return 0;
 330         case ENOENT:
 331                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 332                 return 0;
 333         case 0:
 334                 log_info("Successfully loaded Smack policies.");
 335                 break;
 336         default:
 337                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 338                 return 0;
 339         }
 340
 341 #ifdef SMACK_RUN_LABEL
 342         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 343         if (r < 0)
 344                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 345         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 346         if (r < 0)
 347                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 348         r = write_string_file("/sys/fs/smackfs/netlabel",
 349                               "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 350         if (r < 0)
 351                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 352         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 353         if (r < 0)
 354                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 355 #endif
 356
 357         r = write_cipso2_rules("/etc/smack/cipso.d/");
 358         switch(r) {
 359         case -ENOENT:
 360                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 361                 return 0;
 362         case ENOENT:
 363                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 364                 break;
 365         case 0:
 366                 log_info("Successfully loaded Smack/CIPSO policies.");
 367                 break;
 368         default:
 369                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 370                 break;
 371         }
 372
 373         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 374         switch(r) {
 375         case -ENOENT:
 376                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 377                 return 0;
 378         case ENOENT:
 379                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 380                 break;
 381         case 0:
 382                 log_info("Successfully loaded Smack network host rules.");
 383                 break;
 384         default:
 385                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 386                 break;
 387         }
 388
 389         r = write_onlycap_list();
 390         switch(r) {
 391         case -ENOENT:
 392                 log_debug("Smack is not enabled in the kernel.");
 393                 break;
 394         case ENOENT:
 395                 log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
 396                 break;
 397         case 0:
 398                 log_info("Successfully wrote Smack onlycap list.");
 399                 break;
 400         default:
 401                 log_emergency_errno(r, "Failed to write Smack onlycap list.");
 402                 return r;
 403         }
 404
 405         *loaded_policy = true;
 406
 407 #endif
 408
 409         return 0;
 410 }