src/core/smack-setup.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright (C) 2013 Intel Corporation
   5   Authors:
   6         Nathaniel Chen <nathaniel.chen@intel.com>
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published
  10   by the Free Software Foundation; either version 2.1 of the License,
  11   or (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <dirent.h>
  23 #include <errno.h>
  24 #include <fcntl.h>
  25 #include <stdio.h>
  26 #include <stdlib.h>
  27 #include <string.h>
  28
  29 #include "alloc-util.h"
  30 #include "dirent-util.h"
  31 #include "fd-util.h"
  32 #include "fileio.h"
  33 #include "log.h"
  34 #include "macro.h"
  35 #include "smack-setup.h"
  36 #include "string-util.h"
  37 #include "util.h"
  38
  39 #ifdef HAVE_SMACK
  40
  41 static int write_access2_rules(const char* srcdir) {
  42         _cleanup_close_ int load2_fd = -1, change_fd = -1;
  43         _cleanup_closedir_ DIR *dir = NULL;
  44         struct dirent *entry;
  45         char buf[NAME_MAX];
  46         int dfd = -1;
  47         int r = 0;
  48
  49         load2_fd = open("/sys/fs/smackfs/load2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  50         if (load2_fd < 0)  {
  51                 if (errno != ENOENT)
  52                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/load2': %m");
  53                 return -errno; /* negative error */
  54         }
  55
  56         change_fd = open("/sys/fs/smackfs/change-rule", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
  57         if (change_fd < 0)  {
  58                 if (errno != ENOENT)
  59                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/change-rule': %m");
  60                 return -errno; /* negative error */
  61         }
  62
  63         /* write rules to load2 or change-rule from every file in the directory */
  64         dir = opendir(srcdir);
  65         if (!dir) {
  66                 if (errno != ENOENT)
  67                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
  68                 return errno; /* positive on purpose */
  69         }
  70
  71         dfd = dirfd(dir);
  72         assert(dfd >= 0);
  73
  74         FOREACH_DIRENT(entry, dir, return 0) {
  75                 int fd;
  76                 _cleanup_fclose_ FILE *policy = NULL;
  77
  78                 if (!dirent_is_file(entry))
  79                         continue;
  80
  81                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  82                 if (fd < 0) {
  83                         if (r == 0)
  84                                 r = -errno;
  85                         log_warning_errno(errno, "Failed to open '%s': %m", entry->d_name);
  86                         continue;
  87                 }
  88
  89                 policy = fdopen(fd, "re");
  90                 if (!policy) {
  91                         if (r == 0)
  92                                 r = -errno;
  93                         safe_close(fd);
  94                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
  95                         continue;
  96                 }
  97
  98                 /* load2 write rules in the kernel require a line buffered stream */
  99                 FOREACH_LINE(buf, policy,
 100                              log_error_errno(errno, "Failed to read line from '%s': %m",
 101                                              entry->d_name)) {
 102
 103                         _cleanup_free_ char *sbj = NULL, *obj = NULL, *acc1 = NULL, *acc2 = NULL;
 104
 105                         if (isempty(truncate_nl(buf)))
 106                                 continue;
 107
 108                         /* if 3 args -> load rule   : subject object access1 */
 109                         /* if 4 args -> change rule : subject object access1 access2 */
 110                         if (sscanf(buf, "%ms %ms %ms %ms", &sbj, &obj, &acc1, &acc2) < 3) {
 111                                 log_error_errno(errno, "Failed to parse rule '%s' in '%s', ignoring.", buf, entry->d_name);
 112                                 continue;
 113                         }
 114
 115                         if (write(isempty(acc2) ? load2_fd : change_fd, buf, strlen(buf)) < 0) {
 116                                 if (r == 0)
 117                                         r = -errno;
 118                                 log_error_errno(errno, "Failed to write '%s' to '%s' in '%s'",
 119                                                 buf, isempty(acc2) ? "/sys/fs/smackfs/load2" : "/sys/fs/smackfs/change-rule", entry->d_name);
 120                         }
 121                 }
 122         }
 123
 124         return r;
 125 }
 126
 127 static int write_cipso2_rules(const char* srcdir) {
 128         _cleanup_close_ int cipso2_fd = -1;
 129         _cleanup_closedir_ DIR *dir = NULL;
 130         struct dirent *entry;
 131         char buf[NAME_MAX];
 132         int dfd = -1;
 133         int r = 0;
 134
 135         cipso2_fd = open("/sys/fs/smackfs/cipso2", O_RDWR|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 136         if (cipso2_fd < 0)  {
 137                 if (errno != ENOENT)
 138                         log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/cipso2': %m");
 139                 return -errno; /* negative error */
 140         }
 141
 142         /* write rules to cipso2 from every file in the directory */
 143         dir = opendir(srcdir);
 144         if (!dir) {
 145                 if (errno != ENOENT)
 146                         log_warning_errno(errno, "Failed to opendir '%s': %m", srcdir);
 147                 return errno; /* positive on purpose */
 148         }
 149
 150         dfd = dirfd(dir);
 151         assert(dfd >= 0);
 152
 153         FOREACH_DIRENT(entry, dir, return 0) {
 154                 int fd;
 155                 _cleanup_fclose_ FILE *policy = NULL;
 156
 157                 if (!dirent_is_file(entry))
 158                         continue;
 159
 160                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 161                 if (fd < 0) {
 162                         if (r == 0)
 163                                 r = -errno;
 164                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 165                         continue;
 166                 }
 167
 168                 policy = fdopen(fd, "re");
 169                 if (!policy) {
 170                         if (r == 0)
 171                                 r = -errno;
 172                         safe_close(fd);
 173                         log_error_errno(errno, "Failed to open '%s': %m", entry->d_name);
 174                         continue;
 175                 }
 176
 177                 /* cipso2 write rules in the kernel require a line buffered stream */
 178                 FOREACH_LINE(buf, policy,
 179                              log_error_errno(errno, "Failed to read line from '%s': %m",
 180                                              entry->d_name)) {
 181
 182                         if (isempty(truncate_nl(buf)))
 183                                 continue;
 184
 185                         if (write(cipso2_fd, buf, strlen(buf)) < 0) {
 186                                 if (r == 0)
 187                                         r = -errno;
 188                                 log_error_errno(errno, "Failed to write '%s' to '/sys/fs/smackfs/cipso2' in '%s'",
 189                                                 buf, entry->d_name);
 190                                 break;
 191                         }
 192                 }
 193         }
 194
 195         return r;
 196 }
 197
 198 static int write_netlabel_rules(const char* srcdir) {
 199         _cleanup_fclose_ FILE *dst = NULL;
 200         _cleanup_closedir_ DIR *dir = NULL;
 201         struct dirent *entry;
 202         char buf[NAME_MAX];
 203         int dfd = -1;
 204         int r = 0;
 205
 206         dst = fopen("/sys/fs/smackfs/netlabel", "we");
 207         if (!dst)  {
 208                 if (errno != ENOENT)
 209                         log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
 210                 return -errno; /* negative error */
 211         }
 212
 213         /* write rules to dst from every file in the directory */
 214         dir = opendir(srcdir);
 215         if (!dir) {
 216                 if (errno != ENOENT)
 217                         log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
 218                 return errno; /* positive on purpose */
 219         }
 220
 221         dfd = dirfd(dir);
 222         assert(dfd >= 0);
 223
 224         FOREACH_DIRENT(entry, dir, return 0) {
 225                 int fd;
 226                 _cleanup_fclose_ FILE *policy = NULL;
 227
 228                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
 229                 if (fd < 0) {
 230                         if (r == 0)
 231                                 r = -errno;
 232                         log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
 233                         continue;
 234                 }
 235
 236                 policy = fdopen(fd, "re");
 237                 if (!policy) {
 238                         if (r == 0)
 239                                 r = -errno;
 240                         safe_close(fd);
 241                         log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 242                         continue;
 243                 }
 244
 245                 /* load2 write rules in the kernel require a line buffered stream */
 246                 FOREACH_LINE(buf, policy,
 247                              log_error_errno(errno, "Failed to read line from %s: %m",
 248                                        entry->d_name)) {
 249                         if (!fputs(buf, dst)) {
 250                                 if (r == 0)
 251                                         r = -EINVAL;
 252                                 log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
 253                                 break;
 254                         }
 255                         if (fflush(dst)) {
 256                                 if (r == 0)
 257                                         r = -errno;
 258                                 log_error_errno(errno, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
 259                                 break;
 260                         }
 261                 }
 262         }
 263
 264         return r;
 265 }
 266
 267 #endif
 268
 269 int mac_smack_setup(bool *loaded_policy) {
 270
 271 #ifdef HAVE_SMACK
 272
 273         int r;
 274
 275         assert(loaded_policy);
 276
 277         r = write_access2_rules("/etc/smack/accesses.d/");
 278         switch(r) {
 279         case -ENOENT:
 280                 log_debug("Smack is not enabled in the kernel.");
 281                 return 0;
 282         case ENOENT:
 283                 log_debug("Smack access rules directory '/etc/smack/accesses.d/' not found");
 284                 return 0;
 285         case 0:
 286                 log_info("Successfully loaded Smack policies.");
 287                 break;
 288         default:
 289                 log_warning_errno(r, "Failed to load Smack access rules, ignoring: %m");
 290                 return 0;
 291         }
 292
 293 #ifdef SMACK_RUN_LABEL
 294         r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
 295         if (r < 0)
 296                 log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
 297         r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 298         if (r < 0)
 299                 log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
 300         r = write_string_file("/sys/fs/smackfs/netlabel",
 301                               "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 302         if (r < 0)
 303                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 304         r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 305         if (r < 0)
 306                 log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
 307 #endif
 308
 309         r = write_cipso2_rules("/etc/smack/cipso.d/");
 310         switch(r) {
 311         case -ENOENT:
 312                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 313                 return 0;
 314         case ENOENT:
 315                 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 316                 break;
 317         case 0:
 318                 log_info("Successfully loaded Smack/CIPSO policies.");
 319                 break;
 320         default:
 321                 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
 322                 break;
 323         }
 324
 325         r = write_netlabel_rules("/etc/smack/netlabel.d/");
 326         switch(r) {
 327         case -ENOENT:
 328                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 329                 return 0;
 330         case ENOENT:
 331                 log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
 332                 break;
 333         case 0:
 334                 log_info("Successfully loaded Smack network host rules.");
 335                 break;
 336         default:
 337                 log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
 338                 break;
 339         }
 340
 341         *loaded_policy = true;
 342
 343 #endif
 344
 345         return 0;
 346 }