src/core/smack-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright (C) 2013 Intel Corporation
   7   Authors:
   8         Nathaniel Chen <nathaniel.chen@intel.com>
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published
  12   by the Free Software Foundation; either version 2.1 of the License,
  13   or (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 #include <dirent.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30
  31 #include "alloc-util.h"
  32 #include "dirent-util.h"
  33 #include "fd-util.h"
  34 #include "fileio.h"
  35 #include "log.h"
  36 #include "macro.h"
  37 #include "smack-setup.h"
  38 #include "string-util.h"
  39 #include "util.h"
  40
  41 #ifdef HAVE_SMACK
  42
  43 static int write_access2_rules(const char* srcdir) {
  44         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  45         _cleanup_closedir_ DIR *dir = NULL;
  46         struct dirent *entry;
  47         char buf[NAME_MAX];
  48         int dfd = -1;
  49         int r = 0;
  50
  51         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  52         if (load2_fd < 0)  {
  53                 if (errno != ENOENT)
  54                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  55                 return -errno; /* negative error */
  56         }
  57
  58         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  59         if (change_fd < 0)  {
  60                 if (errno != ENOENT)
  61                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  62                 return -errno; /* negative error */
  63         }
  64
  65         /* write rules to load2 or change-rule from every file in the directory */
  66         dir = opendir(srcdir);
  67         if (!dir) {
  68                 if (errno != ENOENT)
  69                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  70                 return errno; /* positive on purpose */
  71         }
  72
  73         dfd = dirfd(dir);
  74         assert(dfd >= 0);
  75
  76         FOREACH_DIRENT(entry, dir, return 0) {
  77                 int fd;
  78                 _cleanup_fclose_ FILE *policy = NULL;
  79
  80                 if (!dirent_is_file(entry))
  81                         continue;
  82
  83                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  84                 if (fd < 0) {
  85                         if (r == 0)
  86                                 r = -errno;
  87                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  88                         continue;
  89                 }
  90
  91                 policy = fdopen(fd, "re");
  92                 if (!policy) {
  93                         if (r == 0)
  94                                 r = -errno;
  95                         safe_close(fd);
  96                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  97                         continue;
  98                 }
  99
 100                 /* load2 write rules in the kernel require a line buffered stream */
 101                 FOREACH_LINE(buf, policy,
 102                              log_error_errno(errno, "Failed to read line from '%s': %m",
 103                                              entry->d_name)) {
 104
 105                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 106
 107                         if (isempty(truncate_nl(buf)))
 108                                 continue;
 109
 110                         /* if 3 args -> load rule   : subject object access1 */
 111                         /* if 4 args -> change rule : subject object access1 access2 */
 112                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 113                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 114                                 continue;
 115                         }
 116
 117                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 118                                 if (r == 0)
 119                                         r = -errno;
 120                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 121                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 122                         }
 123                 }
 124         }
 125
 126         return r;
 127 }
 128
 129 static int write_cipso2_rules(const char* srcdir) {
 130         _cleanup_close_ int cipso2_fd = -1;
 131         _cleanup_closedir_ DIR *dir = NULL;
 132         struct dirent *entry;
 133         char buf[NAME_MAX];
 134         int dfd = -1;
 135         int r = 0;
 136
 137         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 138         if (cipso2_fd < 0)  {
 139                 if (errno != ENOENT)
 140                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 141                 return -errno; /* negative error */
 142         }
 143
 144         /* write rules to cipso2 from every file in the directory */
 145         dir = opendir(srcdir);
 146         if (!dir) {
 147                 if (errno != ENOENT)
 148                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 149                 return errno; /* positive on purpose */
 150         }
 151
 152         dfd = dirfd(dir);
 153         assert(dfd >= 0);
 154
 155         FOREACH_DIRENT(entry, dir, return 0) {
 156                 int fd;
 157                 _cleanup_fclose_ FILE *policy = NULL;
 158
 159                 if (!dirent_is_file(entry))
 160                         continue;
 161
 162                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 163                 if (fd < 0) {
 164                         if (r == 0)
 165                                 r = -errno;
 166                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 167                         continue;
 168                 }
 169
 170                 policy = fdopen(fd, "re");
 171                 if (!policy) {
 172                         if (r == 0)
 173                                 r = -errno;
 174                         safe_close(fd);
 175                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 176                         continue;
 177                 }
 178
 179                 /* cipso2 write rules in the kernel require a line buffered stream */
 180                 FOREACH_LINE(buf, policy,
 181                              log_error_errno(errno, "Failed to read line from '%s': %m",
 182                                              entry->d_name)) {
 183
 184                         if (isempty(truncate_nl(buf)))
 185                                 continue;
 186
 187                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 188                                 if (r == 0)
 189                                         r = -errno;
 190                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 191                                                 buf, entry->d_name);
 192                                 break;
 193                         }
 194                 }
 195         }
 196
 197         return r;
 198 }
 199
 200 #endif
 201
 202 int mac_smack_setup(bool *loaded_policy) {
 203
 204 #ifdef HAVE_SMACK
 205
 206         int r;
 207
 208         assert(loaded_policy);
 209
 210         r = write_access2_rules("/etc/smack/accesses.d/");
 211         switch(r) {
 212         case -ENOENT:
 213                 log_debug("Smack is not enabled in the kernel.");
 214                 return 0;
 215         case ENOENT:
 216                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 217                 return 0;
 218         case 0:
 219                 log_info("Successfully loaded Smack policies.");
 220                 break;
 221         default:
 222                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 223                 return 0;
 224         }
 225
 226 #ifdef SMACK_RUN_LABEL
 227         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 228         if (r)
 229                 log_warning_errno(r, "Failed to set SMACK label \"%s\" on self: %m", SMACK_RUN_LABEL);
 230 #endif
 231
 232         r = write_cipso2_rules("/etc/smack/cipso.d/");
 233         switch(r) {
 234         case -ENOENT:
 235                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 236                 return 0;
 237         case ENOENT:
 238                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 239                 return 0;
 240         case 0:
 241                 log_info("Successfully loaded Smack/CIPSO policies.");
 242                 break;
 243         default:
 244                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 245                 return 0;
 246         }
 247
 248         *loaded_policy = true;
 249
 250 #endif
 251
 252         return 0;
 253 }