src/core/smack-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright (C) 2013 Intel Corporation
   7   Authors:
   8         Nathaniel Chen <nathaniel.chen@intel.com>
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published
  12   by the Free Software Foundation; either version 2.1 of the License,
  13   or (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 #include <dirent.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30
  31 #include "alloc-util.h"
  32 #include "dirent-util.h"
  33 #include "fd-util.h"
  34 #include "fileio.h"
  35 #include "log.h"
  36 #include "macro.h"
  37 #include "smack-setup.h"
  38 #include "string-util.h"
  39 #include "util.h"
  40
  41 #ifdef HAVE_SMACK
  42
  43 static int write_access2_rules(const char* srcdir) {
  44         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  45         _cleanup_closedir_ DIR *dir = NULL;
  46         struct dirent *entry;
  47         char buf[NAME_MAX];
  48         int dfd = -1;
  49         int r = 0;
  50
  51         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  52         if (load2_fd < 0)  {
  53                 if (errno != ENOENT)
  54                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  55                 return -errno; /* negative error */
  56         }
  57
  58         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  59         if (change_fd < 0)  {
  60                 if (errno != ENOENT)
  61                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  62                 return -errno; /* negative error */
  63         }
  64
  65         /* write rules to load2 or change-rule from every file in the directory */
  66         dir = opendir(srcdir);
  67         if (!dir) {
  68                 if (errno != ENOENT)
  69                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  70                 return errno; /* positive on purpose */
  71         }
  72
  73         dfd = dirfd(dir);
  74         assert(dfd >= 0);
  75
  76         FOREACH_DIRENT(entry, dir, return 0) {
  77                 int fd;
  78                 _cleanup_fclose_ FILE *policy = NULL;
  79
  80                 if (!dirent_is_file(entry))
  81                         continue;
  82
  83                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  84                 if (fd < 0) {
  85                         if (r == 0)
  86                                 r = -errno;
  87                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  88                         continue;
  89                 }
  90
  91                 policy = fdopen(fd, "re");
  92                 if (!policy) {
  93                         if (r == 0)
  94                                 r = -errno;
  95                         safe_close(fd);
  96                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  97                         continue;
  98                 }
  99
 100                 /* load2 write rules in the kernel require a line buffered stream */
 101                 FOREACH_LINE(buf, policy,
 102                              log_error_errno(errno, "Failed to read line from '%s': %m",
 103                                              entry->d_name)) {
 104
 105                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 106
 107                         if (isempty(truncate_nl(buf)))
 108                                 continue;
 109
 110                         /* if 3 args -> load rule   : subject object access1 */
 111                         /* if 4 args -> change rule : subject object access1 access2 */
 112                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 113                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 114                                 continue;
 115                         }
 116
 117                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 118                                 if (r == 0)
 119                                         r = -errno;
 120                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 121                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 122                         }
 123                 }
 124         }
 125
 126         return r;
 127 }
 128
 129 static int write_cipso2_rules(const char* srcdir) {
 130         _cleanup_close_ int cipso2_fd = -1;
 131         _cleanup_closedir_ DIR *dir = NULL;
 132         struct dirent *entry;
 133         char buf[NAME_MAX];
 134         int dfd = -1;
 135         int r = 0;
 136
 137         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 138         if (cipso2_fd < 0)  {
 139                 if (errno != ENOENT)
 140                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 141                 return -errno; /* negative error */
 142         }
 143
 144         /* write rules to cipso2 from every file in the directory */
 145         dir = opendir(srcdir);
 146         if (!dir) {
 147                 if (errno != ENOENT)
 148                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 149                 return errno; /* positive on purpose */
 150         }
 151
 152         dfd = dirfd(dir);
 153         assert(dfd >= 0);
 154
 155         FOREACH_DIRENT(entry, dir, return 0) {
 156                 int fd;
 157                 _cleanup_fclose_ FILE *policy = NULL;
 158
 159                 if (!dirent_is_file(entry))
 160                         continue;
 161
 162                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 163                 if (fd < 0) {
 164                         if (r == 0)
 165                                 r = -errno;
 166                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 167                         continue;
 168                 }
 169
 170                 policy = fdopen(fd, "re");
 171                 if (!policy) {
 172                         if (r == 0)
 173                                 r = -errno;
 174                         safe_close(fd);
 175                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 176                         continue;
 177                 }
 178
 179                 /* cipso2 write rules in the kernel require a line buffered stream */
 180                 FOREACH_LINE(buf, policy,
 181                              log_error_errno(errno, "Failed to read line from '%s': %m",
 182                                              entry->d_name)) {
 183
 184                         if (isempty(truncate_nl(buf)))
 185                                 continue;
 186
 187                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 188                                 if (r == 0)
 189                                         r = -errno;
 190                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 191                                                 buf, entry->d_name);
 192                                 break;
 193                         }
 194                 }
 195         }
 196
 197         return r;
 198 }
 199
 200 static int write_netlabel_rules(const char* srcdir) {
 201         _cleanup_fclose_ FILE *dst = NULL;
 202         _cleanup_closedir_ DIR *dir = NULL;
 203         struct dirent *entry;
 204         char buf[NAME_MAX];
 205         int dfd = -1;
 206         int r = 0;
 207
 208         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 209         if (!dst)  {
 210                 if (errno != ENOENT)
 211                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 212                 return -errno; /* negative error */
 213         }
 214
 215         /* write rules to dst from every file in the directory */
 216         dir = opendir(srcdir);
 217         if (!dir) {
 218                 if (errno != ENOENT)
 219                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 220                 return errno; /* positive on purpose */
 221         }
 222
 223         dfd = dirfd(dir);
 224         assert(dfd >= 0);
 225
 226         FOREACH_DIRENT(entry, dir, return 0) {
 227                 int fd;
 228                 _cleanup_fclose_ FILE *policy = NULL;
 229
 230                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 231                 if (fd < 0) {
 232                         if (r == 0)
 233                                 r = -errno;
 234                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 235                         continue;
 236                 }
 237
 238                 policy = fdopen(fd, "re");
 239                 if (!policy) {
 240                         if (r == 0)
 241                                 r = -errno;
 242                         safe_close(fd);
 243                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 244                         continue;
 245                 }
 246
 247                 /* load2 write rules in the kernel require a line buffered stream */
 248                 FOREACH_LINE(buf, policy,
 249                              log_error_errno(errno, "Failed to read line from %s: %m",
 250                                        entry->d_name)) {
 251                         if (!fputs(buf, dst)) {
 252                                 if (r == 0)
 253                                         r = -EINVAL;
 254                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
 255                                 break;
 256                         }
 257                         if (fflush(dst)) {
 258                                 if (r == 0)
 259                                         r = -errno;
 260                                 log_error_errno(errno, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 261                                 break;
 262                         }
 263                 }
 264         }
 265
 266        return r;
 267 }
 268
 269 #endif
 270
 271 int mac_smack_setup(bool *loaded_policy) {
 272
 273 #ifdef HAVE_SMACK
 274
 275         int r;
 276
 277         assert(loaded_policy);
 278
 279         r = write_access2_rules("/etc/smack/accesses.d/");
 280         switch(r) {
 281         case -ENOENT:
 282                 log_debug("Smack is not enabled in the kernel.");
 283                 return 0;
 284         case ENOENT:
 285                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 286                 return 0;
 287         case 0:
 288                 log_info("Successfully loaded Smack policies.");
 289                 break;
 290         default:
 291                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 292                 return 0;
 293         }
 294
 295 #ifdef SMACK_RUN_LABEL
 296         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 297         if (r < 0)
 298                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 299         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 300         if (r < 0)
 301                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 302         r = write_string_file("/sys/fs/smackfs/netlabel",
 303                               "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 304         if (r < 0)
 305                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 306         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 307         if (r < 0)
 308                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 309 #endif
 310
 311         r = write_cipso2_rules("/etc/smack/cipso.d/");
 312         switch(r) {
 313         case -ENOENT:
 314                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 315                 return 0;
 316         case ENOENT:
 317                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 318                 break;
 319         case 0:
 320                 log_info("Successfully loaded Smack/CIPSO policies.");
 321                 break;
 322         default:
 323                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 324                 break;
 325         }
 326
 327         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 328         switch(r) {
 329         case -ENOENT:
 330                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 331                 return 0;
 332         case ENOENT:
 333                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 334                 break;
 335         case 0:
 336                 log_info("Successfully loaded Smack network host rules.");
 337                 break;
 338         default:
 339                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 340                 break;
 341         }
 342
 343         *loaded_policy = true;
 344
 345 #endif
 346
 347         return 0;
 348 }