smack-setup.c revision 03e334a1c7dc8c20c38902aa039440763acc9b17
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen/***
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen This file is part of systemd.
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen Copyright (C) 2013 Intel Corporation
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen Authors:
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen Nathaniel Chen <nathaniel.chen@intel.com>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen systemd is free software; you can redistribute it and/or modify it
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen under the terms of the GNU Lesser General Public License as published
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen by the Free Software Foundation; either version 2.1 of the License,
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen or (at your option) any later version.
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen systemd is distributed in the hope that it will be useful, but
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen WITHOUT ANY WARRANTY; without even the implied warranty of
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen Lesser General Public License for more details.
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen You should have received a copy of the GNU Lesser General Public License
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen along with systemd; If not, see <http://www.gnu.org/licenses/>.
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen***/
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <stdio.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <errno.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <string.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <unistd.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <stdlib.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <sys/vfs.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <fcntl.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <sys/types.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <dirent.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <sys/mount.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include <stdint.h>
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include "macro.h"
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include "smack-setup.h"
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include "util.h"
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok#include "fileio.h"
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include "log.h"
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen#include "label.h"
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek#define SMACK_CONFIG "/etc/smack/accesses.d/"
a1c9563cced72abe337e423b2a5ad19e0ed81325Patrick McCarty#define CIPSO_CONFIG "/etc/smack/cipso.d/"
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski#ifdef HAVE_SMACK
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmekstatic int write_rules(const char* dstpath, const char* srcdir) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek _cleanup_fclose_ FILE *dst = NULL;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen _cleanup_closedir_ DIR *dir = NULL;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen struct dirent *entry;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen char buf[NAME_MAX];
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen int dfd = -1;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek int r = 0;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek dst = fopen(dstpath, "we");
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (!dst) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (errno != ENOENT)
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_warning("Failed to open %s: %m", dstpath);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return -errno; /* negative error */
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek /* write rules to dst from every file in the directory */
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek dir = opendir(srcdir);
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen if (!dir) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (errno != ENOENT)
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_warning("Failed to opendir %s: %m", srcdir);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return errno; /* positive on purpose */
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen dfd = dirfd(dir);
fea7838e7e0b2724f5e0bc028121a08b42995045Zbigniew Jędrzejewski-Szmek assert(dfd >= 0);
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen FOREACH_DIRENT(entry, dir, return 0) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek int fd;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen _cleanup_fclose_ FILE *policy = NULL;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (fd < 0) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (r == 0)
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek r = -errno;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_warning("Failed to open %s: %m", entry->d_name);
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen continue;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek policy = fdopen(fd, "re");
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen if (!policy) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (r == 0)
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek r = -errno;
03e334a1c7dc8c20c38902aa039440763acc9b17Lennart Poettering safe_close(fd);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_error("Failed to open %s: %m", entry->d_name);
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen continue;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen /* load2 write rules in the kernel require a line buffered stream */
fea7838e7e0b2724f5e0bc028121a08b42995045Zbigniew Jędrzejewski-Szmek FOREACH_LINE(buf, policy,
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_error("Failed to read line from %s: %m",
fea7838e7e0b2724f5e0bc028121a08b42995045Zbigniew Jędrzejewski-Szmek entry->d_name)) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (!fputs(buf, dst)) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (r == 0)
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek r = -EINVAL;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_error("Failed to write line to %s", dstpath);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek break;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek }
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (fflush(dst)) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek if (r == 0)
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek r = -errno;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_error("Failed to flush writes to %s: %m", dstpath);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek break;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen }
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return r;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek}
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski#endif
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen
e49d3c016751c03e544697656e8e596af8a664d7Łukasz Stelmachint smack_setup(bool *loaded_policy) {
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski#ifdef HAVE_SMACK
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek int r;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek
e49d3c016751c03e544697656e8e596af8a664d7Łukasz Stelmach assert(loaded_policy);
e49d3c016751c03e544697656e8e596af8a664d7Łukasz Stelmach
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek r = write_rules("/sys/fs/smackfs/load2", SMACK_CONFIG);
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek switch(r) {
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek case -ENOENT:
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_debug("Smack is not enabled in the kernel.");
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return 0;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek case ENOENT:
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_debug("Smack access rules directory " SMACK_CONFIG " not found");
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return 0;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek case 0:
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek log_info("Successfully loaded Smack policies.");
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen break;
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen default:
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen log_warning("Failed to load Smack access rules: %s, ignoring.",
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen strerror(abs(r)));
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen return 0;
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen }
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok#ifdef SMACK_RUN_LABEL
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL);
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok if (r)
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok log_warning("Failed to set SMACK label \"%s\" on self: %s",
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok SMACK_RUN_LABEL, strerror(-r));
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok#endif
8b197c3a8a57c3f7c231b39e5660856fd9580c80Auke Kok
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen r = write_rules("/sys/fs/smackfs/cipso2", CIPSO_CONFIG);
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen switch(r) {
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen case -ENOENT:
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen log_debug("Smack/CIPSO is not enabled in the kernel.");
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen return 0;
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen case ENOENT:
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen log_debug("Smack/CIPSO access rules directory " CIPSO_CONFIG " not found");
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen return 0;
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen case 0:
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen log_info("Successfully loaded Smack/CIPSO policies.");
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return 0;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek default:
abbacb1defaaecb8d2477685f7bb3fabcf58585bNathaniel Chen log_warning("Failed to load Smack/CIPSO access rules: %s, ignoring.",
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek strerror(abs(r)));
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek return 0;
a4783bd17ad96f55b0fe83a50959da13555292bfZbigniew Jędrzejewski-Szmek }
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski
e49d3c016751c03e544697656e8e596af8a664d7Łukasz Stelmach *loaded_policy = true;
e49d3c016751c03e544697656e8e596af8a664d7Łukasz Stelmach
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski#endif
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski
2b3e18de74ca89b374dd4f7a2c30e5731d347841Karol Lewandowski return 0;
ffbd2c4d45787ba5ba85a32db6551efba66a1ee6Nathaniel Chen}