src/core/smack-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright (C) 2013 Intel Corporation
   7   Authors:
   8         Nathaniel Chen <nathaniel.chen@intel.com>
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published
  12   by the Free Software Foundation; either version 2.1 of the License,
  13   or (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 #include <dirent.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30
  31 #include "fd-util.h"
  32 #include "fileio.h"
  33 #include "log.h"
  34 #include "macro.h"
  35 #include "smack-setup.h"
  36 #include "string-util.h"
  37 #include "util.h"
  38
  39 #ifdef HAVE_SMACK
  40
  41 static int write_access2_rules(const char* srcdir) {
  42         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  43         _cleanup_closedir_ DIR *dir = NULL;
  44         struct dirent *entry;
  45         char buf[NAME_MAX];
  46         int dfd = -1;
  47         int r = 0;
  48
  49         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  50         if (load2_fd < 0)  {
  51                 if (errno != ENOENT)
  52                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  53                 return -errno; /* negative error */
  54         }
  55
  56         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  57         if (change_fd < 0)  {
  58                 if (errno != ENOENT)
  59                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  60                 return -errno; /* negative error */
  61         }
  62
  63         /* write rules to load2 or change-rule from every file in the directory */
  64         dir = opendir(srcdir);
  65         if (!dir) {
  66                 if (errno != ENOENT)
  67                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  68                 return errno; /* positive on purpose */
  69         }
  70
  71         dfd = dirfd(dir);
  72         assert(dfd >= 0);
  73
  74         FOREACH_DIRENT(entry, dir, return 0) {
  75                 int fd;
  76                 _cleanup_fclose_ FILE *policy = NULL;
  77
  78                 if (!dirent_is_file(entry))
  79                         continue;
  80
  81                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  82                 if (fd < 0) {
  83                         if (r == 0)
  84                                 r = -errno;
  85                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  86                         continue;
  87                 }
  88
  89                 policy = fdopen(fd, "re");
  90                 if (!policy) {
  91                         if (r == 0)
  92                                 r = -errno;
  93                         safe_close(fd);
  94                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  95                         continue;
  96                 }
  97
  98                 /* load2 write rules in the kernel require a line buffered stream */
  99                 FOREACH_LINE(buf, policy,
 100                              log_error_errno(errno, "Failed to read line from '%s': %m",
 101                                              entry->d_name)) {
 102
 103                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 104
 105                         if (isempty(truncate_nl(buf)))
 106                                 continue;
 107
 108                         /* if 3 args -> load rule   : subject object access1 */
 109                         /* if 4 args -> change rule : subject object access1 access2 */
 110                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 111                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 112                                 continue;
 113                         }
 114
 115                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 116                                 if (r == 0)
 117                                         r = -errno;
 118                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 119                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 120                         }
 121                 }
 122         }
 123
 124         return r;
 125 }
 126
 127 static int write_cipso2_rules(const char* srcdir) {
 128         _cleanup_close_ int cipso2_fd = -1;
 129         _cleanup_closedir_ DIR *dir = NULL;
 130         struct dirent *entry;
 131         char buf[NAME_MAX];
 132         int dfd = -1;
 133         int r = 0;
 134
 135         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 136         if (cipso2_fd < 0)  {
 137                 if (errno != ENOENT)
 138                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 139                 return -errno; /* negative error */
 140         }
 141
 142         /* write rules to cipso2 from every file in the directory */
 143         dir = opendir(srcdir);
 144         if (!dir) {
 145                 if (errno != ENOENT)
 146                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 147                 return errno; /* positive on purpose */
 148         }
 149
 150         dfd = dirfd(dir);
 151         assert(dfd >= 0);
 152
 153         FOREACH_DIRENT(entry, dir, return 0) {
 154                 int fd;
 155                 _cleanup_fclose_ FILE *policy = NULL;
 156
 157                 if (!dirent_is_file(entry))
 158                         continue;
 159
 160                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 161                 if (fd < 0) {
 162                         if (r == 0)
 163                                 r = -errno;
 164                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 165                         continue;
 166                 }
 167
 168                 policy = fdopen(fd, "re");
 169                 if (!policy) {
 170                         if (r == 0)
 171                                 r = -errno;
 172                         safe_close(fd);
 173                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 174                         continue;
 175                 }
 176
 177                 /* cipso2 write rules in the kernel require a line buffered stream */
 178                 FOREACH_LINE(buf, policy,
 179                              log_error_errno(errno, "Failed to read line from '%s': %m",
 180                                              entry->d_name)) {
 181
 182                         if (isempty(truncate_nl(buf)))
 183                                 continue;
 184
 185                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 186                                 if (r == 0)
 187                                         r = -errno;
 188                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 189                                                 buf, entry->d_name);
 190                                 break;
 191                         }
 192                 }
 193         }
 194
 195         return r;
 196 }
 197
 198 #endif
 199
 200 int mac_smack_setup(bool *loaded_policy) {
 201
 202 #ifdef HAVE_SMACK
 203
 204         int r;
 205
 206         assert(loaded_policy);
 207
 208         r = write_access2_rules("/etc/smack/accesses.d/");
 209         switch(r) {
 210         case -ENOENT:
 211                 log_debug("Smack is not enabled in the kernel.");
 212                 return 0;
 213         case ENOENT:
 214                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 215                 return 0;
 216         case 0:
 217                 log_info("Successfully loaded Smack policies.");
 218                 break;
 219         default:
 220                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 221                 return 0;
 222         }
 223
 224 #ifdef SMACK_RUN_LABEL
 225         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 226         if (r)
 227                 log_warning_errno(r, "Failed to set SMACK label \"%s\" on self: %m", SMACK_RUN_LABEL);
 228 #endif
 229
 230         r = write_cipso2_rules("/etc/smack/cipso.d/");
 231         switch(r) {
 232         case -ENOENT:
 233                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 234                 return 0;
 235         case ENOENT:
 236                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 237                 return 0;
 238         case 0:
 239                 log_info("Successfully loaded Smack/CIPSO policies.");
 240                 break;
 241         default:
 242                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 243                 return 0;
 244         }
 245
 246         *loaded_policy = true;
 247
 248 #endif
 249
 250         return 0;
 251 }