1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2012 Dan Walsh
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
22 #include "selinux-access.h"
30 #include <selinux/selinux.h>
31 #include <selinux/avc.h>
32 #include <sys/socket.h>
42 #include "selinux-util.h"
46 static bool initialized = false;
55 Any time an access gets denied this callback will be called
56 with the audit data. We then need to just copy the audit data into the msgbuf.
58 static int audit_callback(
64 const struct audit_info *audit = auditdata;
65 uid_t uid = 0, login_uid = 0;
67 char login_uid_buf[DECIMAL_STR_MAX(uid_t)] = "n/a";
68 char uid_buf[DECIMAL_STR_MAX(uid_t)] = "n/a";
69 char gid_buf[DECIMAL_STR_MAX(gid_t)] = "n/a";
71 if (sd_bus_creds_get_audit_login_uid(audit->creds, &login_uid) >= 0)
72 snprintf(login_uid_buf, sizeof(login_uid_buf), UID_FMT, login_uid);
73 if (sd_bus_creds_get_uid(audit->creds, &uid) >= 0)
74 snprintf(uid_buf, sizeof(uid_buf), UID_FMT, uid);
75 if (sd_bus_creds_get_gid(audit->creds, &gid) >= 0)
76 snprintf(gid_buf, sizeof(gid_buf), GID_FMT, gid);
78 snprintf(msgbuf, msgbufsize,
79 "auid=%s uid=%s gid=%s%s%s%s%s%s%s",
80 login_uid_buf, uid_buf, gid_buf,
81 audit->path ? " path=\"" : "", strempty(audit->path), audit->path ? "\"" : "",
82 audit->cmdline ? " cmdline=\"" : "", strempty(audit->cmdline), audit->cmdline ? "\"" : "");
84 msgbuf[msgbufsize-1] = 0;
90 Any time an access gets denied this callback will be called
91 code copied from dbus. If audit is turned on the messages will go as
92 user_avc's into the /var/log/audit/audit.log, otherwise they will be
95 _printf_(2, 3) static int log_callback(int type, const char *fmt, ...) {
99 if (get_audit_fd() >= 0) {
100 _cleanup_free_ char *buf = NULL;
104 r = vasprintf(&buf, fmt, ap);
108 audit_log_user_avc_message(get_audit_fd(), AUDIT_USER_AVC, buf, NULL, NULL, NULL, 0);
115 log_metav(LOG_USER | LOG_INFO, __FILE__, __LINE__, __FUNCTION__, fmt, ap);
122 Function must be called once to initialize the SELinux AVC environment.
124 If you want to cleanup memory you should need to call selinux_access_finish.
126 static int access_init(void) {
129 if (avc_open(NULL, 0)) {
130 log_error("avc_open() failed: %m");
134 selinux_set_callback(SELINUX_CB_AUDIT, (union selinux_callback) audit_callback);
135 selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) log_callback);
137 if (security_getenforce() < 0){
145 static int selinux_access_init(sd_bus_error *error) {
151 if (!mac_selinux_use())
156 return sd_bus_error_set(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to initialize SELinux.");
162 void selinux_access_free(void) {
172 This function communicates with the kernel to check whether or not it should
174 If the machine is in permissive mode it will return ok. Audit messages will
175 still be generated if the access would be denied in enforcing mode.
177 int selinux_generic_access_check(
178 sd_bus_message *message,
180 const char *permission,
181 sd_bus_error *error) {
183 _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL;
184 const char *tclass = NULL, *scon = NULL;
185 struct audit_info audit_info = {};
186 _cleanup_free_ char *cl = NULL;
187 security_context_t fcon = NULL;
188 char **cmdline = NULL;
195 if (!mac_selinux_use())
198 r = selinux_access_init(error);
202 r = sd_bus_query_sender_creds(
204 SD_BUS_CREDS_PID|SD_BUS_CREDS_UID|SD_BUS_CREDS_GID|
205 SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_AUDIT_LOGIN_UID|
206 SD_BUS_CREDS_SELINUX_CONTEXT,
211 r = sd_bus_creds_get_selinux_context(creds, &scon);
216 /* Get the file context of the unit file */
218 r = getfilecon(path, &fcon);
220 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
228 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
235 sd_bus_creds_get_cmdline(creds, &cmdline);
236 cl = strv_join(cmdline, " ");
238 audit_info.creds = creds;
239 audit_info.path = path;
240 audit_info.cmdline = cl;
242 r = selinux_check_access((security_context_t) scon, fcon, tclass, permission, &audit_info);
244 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "SELinux policy denies access.");
246 log_debug("SELinux access check scon=%s tcon=%s tclass=%s perm=%s path=%s cmdline=%s: %i", scon, fcon, tclass, permission, path, cl, r);
251 if (r < 0 && security_getenforce() != 1) {
252 sd_bus_error_free(error);
259 int selinux_unit_access_check_strv(char **units,
260 sd_bus_message *message,
262 const char *permission,
263 sd_bus_error *error) {
268 STRV_FOREACH(i, units) {
269 u = manager_get_unit(m, *i);
271 r = selinux_unit_access_check(u, message, permission, error);
282 int selinux_generic_access_check(
283 sd_bus_message *message,
285 const char *permission,
286 sd_bus_error *error) {
291 void selinux_access_free(void) {
294 int selinux_unit_access_check_strv(char **units,
295 sd_bus_message *message,
297 const char *permission,
298 sd_bus_error *error) {