]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/smack-setup.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright (C) 2013 Intel Corporation
8 Nathaniel Chen <nathaniel.chen@intel.com>
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published
12 by the Free Software Foundation; either version 2.1 of the License,
13 or (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
32 #include "smack-setup.h"
39 static int write_access2_rules(const char* srcdir
) {
40 _cleanup_close_
int load2_fd
= -1, change_fd
= -1;
41 _cleanup_closedir_
DIR *dir
= NULL
;
47 load2_fd
= open("/sys/fs/smackfs/load2", O_RDWR
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
50 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/load2': %m");
51 return -errno
; /* negative error */
54 change_fd
= open("/sys/fs/smackfs/change-rule", O_RDWR
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
57 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/change-rule': %m");
58 return -errno
; /* negative error */
61 /* write rules to load2 or change-rule from every file in the directory */
62 dir
= opendir(srcdir
);
65 log_warning_errno(errno
, "Failed to opendir '%s': %m", srcdir
);
66 return errno
; /* positive on purpose */
72 FOREACH_DIRENT(entry
, dir
, return 0) {
74 _cleanup_fclose_
FILE *policy
= NULL
;
76 if (!dirent_is_file(entry
))
79 fd
= openat(dfd
, entry
->d_name
, O_RDONLY
|O_CLOEXEC
);
83 log_warning_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
87 policy
= fdopen(fd
, "re");
92 log_error_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
96 /* load2 write rules in the kernel require a line buffered stream */
97 FOREACH_LINE(buf
, policy
,
98 log_error_errno(errno
, "Failed to read line from '%s': %m",
101 _cleanup_free_
char *sbj
= NULL
, *obj
= NULL
, *acc1
= NULL
, *acc2
= NULL
;
103 if (isempty(truncate_nl(buf
)))
106 /* if 3 args -> load rule : subject object access1 */
107 /* if 4 args -> change rule : subject object access1 access2 */
108 if (sscanf(buf
, "%ms %ms %ms %ms", &sbj
, &obj
, &acc1
, &acc2
) < 3) {
109 log_error_errno(errno
, "Failed to parse rule '%s' in '%s', ignoring.", buf
, entry
->d_name
);
113 if (write(isempty(acc2
) ? load2_fd
: change_fd
, buf
, strlen(buf
)) < 0) {
116 log_error_errno(errno
, "Failed to write '%s' to '%s' in '%s'",
117 buf
, isempty(acc2
) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry
->d_name
);
125 static int write_cipso2_rules(const char* srcdir
) {
126 _cleanup_close_
int cipso2_fd
= -1;
127 _cleanup_closedir_
DIR *dir
= NULL
;
128 struct dirent
*entry
;
133 cipso2_fd
= open("/sys/fs/smackfs/cipso2", O_RDWR
|O_CLOEXEC
|O_NONBLOCK
|O_NOCTTY
);
136 log_warning_errno(errno
, "Failed to open '/sys/fs/smackfs/cipso2': %m");
137 return -errno
; /* negative error */
140 /* write rules to cipso2 from every file in the directory */
141 dir
= opendir(srcdir
);
144 log_warning_errno(errno
, "Failed to opendir '%s': %m", srcdir
);
145 return errno
; /* positive on purpose */
151 FOREACH_DIRENT(entry
, dir
, return 0) {
153 _cleanup_fclose_
FILE *policy
= NULL
;
155 if (!dirent_is_file(entry
))
158 fd
= openat(dfd
, entry
->d_name
, O_RDONLY
|O_CLOEXEC
);
162 log_error_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
166 policy
= fdopen(fd
, "re");
171 log_error_errno(errno
, "Failed to open '%s': %m", entry
->d_name
);
175 /* cipso2 write rules in the kernel require a line buffered stream */
176 FOREACH_LINE(buf
, policy
,
177 log_error_errno(errno
, "Failed to read line from '%s': %m",
180 if (isempty(truncate_nl(buf
)))
183 if (write(cipso2_fd
, buf
, strlen(buf
)) < 0) {
186 log_error_errno(errno
, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
198 int mac_smack_setup(bool *loaded_policy
) {
204 assert(loaded_policy
);
206 r
= write_access2_rules("/etc/smack/accesses.d/");
209 log_debug("Smack is not enabled in the kernel.");
212 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
215 log_info("Successfully loaded Smack policies.");
218 log_warning("Failed to load Smack access rules: %s, ignoring.",
223 #ifdef SMACK_RUN_LABEL
224 r
= write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL
, 0);
226 log_warning("Failed to set SMACK label \"%s\" on self: %s",
227 SMACK_RUN_LABEL
, strerror(-r
));
230 r
= write_cipso2_rules("/etc/smack/cipso.d/");
233 log_debug("Smack/CIPSO is not enabled in the kernel.");
236 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
239 log_info("Successfully loaded Smack/CIPSO policies.");
242 log_warning("Failed to load Smack/CIPSO access rules: %s, ignoring.",
247 *loaded_policy
= true;