selinux-access.c revision 03e22642617f360a6b55cb853bcf59604754ea5d
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen This file is part of systemd.
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen Copyright 2012 Dan Walsh
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen systemd is free software; you can redistribute it and/or modify it
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen under the terms of the GNU Lesser General Public License as published by
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen the Free Software Foundation; either version 2.1 of the License, or
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen (at your option) any later version.
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen systemd is distributed in the hope that it will be useful, but
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen WITHOUT ANY WARRANTY; without even the implied warranty of
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen Lesser General Public License for more details.
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen You should have received a copy of the GNU Lesser General Public License
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen along with systemd; If not, see <http://www.gnu.org/licenses/>.
87322b3aee0dc649ff1ae7a403dcc9d7305baba2Tom Gundersenstatic bool initialized = false;
20af7091de0cdf92bf299addfc3f96c3ef805bd8Tom Gundersen _cleanup_dbus_message_unref_ DBusMessage *m = NULL, *reply = NULL;
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen "GetConnectionSELinuxSecurityContext");
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen dbus_set_error_const(error, DBUS_ERROR_NO_MEMORY, NULL);
87322b3aee0dc649ff1ae7a403dcc9d7305baba2Tom Gundersen dbus_set_error_const(error, DBUS_ERROR_NO_MEMORY, NULL);
87322b3aee0dc649ff1ae7a403dcc9d7305baba2Tom Gundersen reply = dbus_connection_send_with_reply_and_block(connection, m, -1, error);
87322b3aee0dc649ff1ae7a403dcc9d7305baba2Tom Gundersen if (dbus_set_error_from_message(error, reply))
87322b3aee0dc649ff1ae7a403dcc9d7305baba2Tom Gundersen if (dbus_message_iter_get_arg_type(&iter) != DBUS_TYPE_ARRAY)
87322b3aee0dc649ff1ae7a403dcc9d7305baba2Tom Gundersen dbus_message_iter_get_fixed_array(&sub, &bytes, &nbytes);
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen pid = bus_get_unix_process_id(connection, name, error);
3bdace9bf779ce051f00c14914b35c3a26164aa9Lennart Poettering r = audit_loginuid_from_pid(pid, &audit->loginuid);
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen r = get_process_cmdline(pid, 0, true, &audit->cmdline);
3a864fe4a894745ac61f1ecabd7cadf04139a284Tom Gundersen Any time an access gets denied this callback will be called
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen with the aduit data. We then need to just copy the audit data into the msgbuf.
20af7091de0cdf92bf299addfc3f96c3ef805bd8Tom Gundersen struct auditstruct *audit = (struct auditstruct *) auditdata;
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen "auid=%d uid=%d gid=%d%s%s%s%s%s%s",
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen Any time an access gets denied this callback will be called
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen code copied from dbus. If audit is turned on the messages will go as
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen user_avc's into the /var/log/audit/audit.log, otherwise they will be
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen sent to syslog.
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen_printf_attr_(2, 3) static int log_callback(int type, const char *fmt, ...) {
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen if (r >= 0) {
b44cd8821087f2afebf85fec5b588f5720a9415cTom Gundersen audit_log_user_avc_message(get_audit_fd(), AUDIT_USER_AVC, buf, NULL, NULL, NULL, 0);
ff734080aa02cd70b13bc0fdeec4a5886166163aTom Gundersen log_metav(LOG_USER | LOG_INFO, __FILE__, __LINE__, __FUNCTION__, fmt, ap);
ff734080aa02cd70b13bc0fdeec4a5886166163aTom Gundersen Function must be called once to initialize the SELinux AVC environment.
ff734080aa02cd70b13bc0fdeec4a5886166163aTom Gundersen Sets up callbacks.
ff734080aa02cd70b13bc0fdeec4a5886166163aTom Gundersen If you want to cleanup memory you should need to call selinux_access_finish.
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersenstatic int access_init(void) {
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen selinux_set_callback(SELINUX_CB_AUDIT, (union selinux_callback) audit_callback);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) log_callback);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersenstatic int selinux_access_init(DBusError *error) {
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen dbus_set_error(error, DBUS_ERROR_ACCESS_DENIED, "Failed to initialize SELinux.");
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen return bus_get_audit_data(connection, sender, audit, error);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen if (!dbus_connection_get_unix_fd(connection, &fd))
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen log_error("Failed to determine peer credentials: %m");
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen r = audit_loginuid_from_pid(ucred.pid, &audit->loginuid);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen r = get_process_cmdline(ucred.pid, 0, true, &audit->cmdline);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen This function returns the security context of the remote end of the dbus
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen connections. Whether it is on the bus or a local connection.
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen If sender exists then
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen if sender is NULL this indicates a local connection. Grab the fd
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen from dbus and do an getpeercon to peers process context
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen r = bus_get_selinux_security_context(connection, sender, scon, error);
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen log_error("bus_get_selinux_security_context failed: %m");
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen if (!dbus_connection_get_unix_fd(connection, &fd)) {
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen log_error("bus_connection_get_unix_fd failed %m");
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen This function communicates with the kernel to check whether or not it should
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen allow the access.
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen If the machine is in permissive mode it will return ok. Audit messages will
969b009d9416806911b9b52e7e7bc619c0c1a931Tom Gundersen still be generated if the access would be denied in enforcing mode.
bd57b45029ff25067704c9538e79f31e71c10045Tom Gundersen r = get_calling_context(connection, message, &scon, error);
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen log_error("Failed to get caller's security context on: %m");
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen /* get the file context of the unit file */
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen dbus_set_error(error, DBUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen log_error("Failed to get security context on %s: %m",path);
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen dbus_set_error(error, DBUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen log_error("Failed to get current process context on: %m");
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen (void) get_audit_data(connection, message, &audit, error);
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen r = selinux_check_access(scon, fcon, tclass, permission, &audit);
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen dbus_set_error(error, DBUS_ERROR_ACCESS_DENIED, "SELinux policy denies access.");
4dc355680460fdc8e0d590d8572dff1b6a257d88Tom Gundersen log_debug("SELinux access check scon=%s tcon=%s tclass=%s perm=%s path=%s cmdline=%s: %i", scon, fcon, tclass, permission, path, audit.cmdline, r);