src/core/smack-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright (C) 2013 Intel Corporation
   7   Authors:
   8         Nathaniel Chen <nathaniel.chen@intel.com>
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published
  12   by the Free Software Foundation; either version 2.1 of the License,
  13   or (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 #include <stdio.h>
  25 #include <errno.h>
  26 #include <string.h>
  27 #include <unistd.h>
  28 #include <stdlib.h>
  29 #include <sys/vfs.h>
  30 #include <fcntl.h>
  31 #include <sys/types.h>
  32 #include <dirent.h>
  33 #include <sys/mount.h>
  34 #include <stdint.h>
  35
  36 #include "macro.h"
  37 #include "smack-setup.h"
  38 #include "util.h"
  39 #include "log.h"
  40 #include "label.h"
  41
  42 #define SMACK_CONFIG "/etc/smack/accesses.d/"
  43 #define CIPSO_CONFIG "/etc/smack/cipso/"
  44
  45 #ifdef HAVE_SMACK
  46
  47 static int write_rules(const char* dstpath, const char* srcdir) {
  48         _cleanup_fclose_ FILE *dst = NULL;
  49         _cleanup_closedir_ DIR *dir = NULL;
  50         struct dirent *entry;
  51         char buf[NAME_MAX];
  52         int dfd = -1;
  53         int r = 0;
  54
  55         dst = fopen(dstpath, "we");
  56         if (!dst)  {
  57                 if (errno != ENOENT)
  58                         log_warning("Failed to open %s: %m", dstpath);
  59                 return -errno; /* negative error */
  60         }
  61
  62         /* write rules to dst from every file in the directory */
  63         dir = opendir(srcdir);
  64         if (!dir) {
  65                 if (errno != ENOENT)
  66                         log_warning("Failed to opendir %s: %m", srcdir);
  67                 return errno; /* positive on purpose */
  68         }
  69
  70         dfd = dirfd(dir);
  71         assert(dfd >= 0);
  72
  73         FOREACH_DIRENT(entry, dir, return 0) {
  74                 int fd;
  75                 _cleanup_fclose_ FILE *policy = NULL;
  76
  77                 fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  78                 if (fd < 0) {
  79                         if (r == 0)
  80                                 r = -errno;
  81                         log_warning("Failed to open %s: %m", entry->d_name);
  82                         continue;
  83                 }
  84
  85                 policy = fdopen(fd, "re");
  86                 if (!policy) {
  87                         if (r == 0)
  88                                 r = -errno;
  89                         close_nointr_nofail(fd);
  90                         log_error("Failed to open %s: %m", entry->d_name);
  91                         continue;
  92                 }
  93
  94                 /* load2 write rules in the kernel require a line buffered stream */
  95                 FOREACH_LINE(buf, policy,
  96                              log_error("Failed to read line from %s: %m",
  97                                        entry->d_name)) {
  98                         if (!fputs(buf, dst)) {
  99                                 if (r == 0)
 100                                         r = -EINVAL;
 101                                 log_error("Failed to write line to %s", dstpath);
 102                                 break;
 103                         }
 104                         if (fflush(dst)) {
 105                                 if (r == 0)
 106                                         r = -errno;
 107                                 log_error("Failed to flush writes to %s: %m", dstpath);
 108                                 break;
 109                         }
 110                 }
 111         }
 112
 113        return r;
 114 }
 115
 116 #endif
 117
 118 int smack_setup(void) {
 119
 120 #ifdef HAVE_SMACK
 121
 122         int r;
 123
 124         r = write_rules("/sys/fs/smackfs/load2", SMACK_CONFIG);
 125         switch(r) {
 126         case -ENOENT:
 127                 log_debug("Smack is not enabled in the kernel.");
 128                 return 0;
 129         case ENOENT:
 130                 log_debug("Smack access rules directory " SMACK_CONFIG " not found");
 131                 return 0;
 132         case 0:
 133                 log_info("Successfully loaded Smack policies.");
 134                 break;
 135         default:
 136                 log_warning("Failed to load Smack access rules: %s, ignoring.",
 137                             strerror(abs(r)));
 138                 return 0;
 139         }
 140
 141         r = write_rules("/sys/fs/smackfs/cipso2", CIPSO_CONFIG);
 142         switch(r) {
 143         case -ENOENT:
 144                 log_debug("Smack/CIPSO is not enabled in the kernel.");
 145                 return 0;
 146         case ENOENT:
 147                 log_debug("Smack/CIPSO access rules directory " CIPSO_CONFIG " not found");
 148                 return 0;
 149         case 0:
 150                 log_info("Successfully loaded Smack/CIPSO policies.");
 151                 return 0;
 152         default:
 153                 log_warning("Failed to load Smack/CIPSO access rules: %s, ignoring.",
 154                             strerror(abs(r)));
 155                 return 0;
 156         }
 157
 158 #endif
 159
 160         return 0;
 161 }