1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2012 Dan Walsh
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
22 #include "selinux-access.h"
30 #include <selinux/selinux.h>
31 #include <selinux/avc.h>
32 #include <sys/socket.h>
42 #include "selinux-util.h"
46 static bool initialized = false;
55 Any time an access gets denied this callback will be called
56 with the aduit data. We then need to just copy the audit data into the msgbuf.
58 static int audit_callback(
64 const struct audit_info *audit = auditdata;
65 uid_t uid = 0, login_uid = 0;
68 sd_bus_creds_get_audit_login_uid(audit->creds, &login_uid);
69 sd_bus_creds_get_uid(audit->creds, &uid);
70 sd_bus_creds_get_gid(audit->creds, &gid);
72 snprintf(msgbuf, msgbufsize,
73 "auid=%d uid=%d gid=%d%s%s%s%s%s%s",
75 audit->path ? " path=\"" : "", strempty(audit->path), audit->path ? "\"" : "",
76 audit->cmdline ? " cmdline=\"" : "", strempty(audit->cmdline), audit->cmdline ? "\"" : "");
78 msgbuf[msgbufsize-1] = 0;
84 Any time an access gets denied this callback will be called
85 code copied from dbus. If audit is turned on the messages will go as
86 user_avc's into the /var/log/audit/audit.log, otherwise they will be
89 _printf_(2, 3) static int log_callback(int type, const char *fmt, ...) {
93 if (get_audit_fd() >= 0) {
94 _cleanup_free_ char *buf = NULL;
98 r = vasprintf(&buf, fmt, ap);
102 audit_log_user_avc_message(get_audit_fd(), AUDIT_USER_AVC, buf, NULL, NULL, NULL, 0);
109 log_metav(LOG_USER | LOG_INFO, __FILE__, __LINE__, __FUNCTION__, fmt, ap);
116 Function must be called once to initialize the SELinux AVC environment.
118 If you want to cleanup memory you should need to call selinux_access_finish.
120 static int access_init(void) {
123 if (avc_open(NULL, 0)) {
124 log_error("avc_open() failed: %m");
128 selinux_set_callback(SELINUX_CB_AUDIT, (union selinux_callback) audit_callback);
129 selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) log_callback);
131 if (security_getenforce() < 0){
139 static int selinux_access_init(sd_bus_error *error) {
150 return sd_bus_error_set(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to initialize SELinux.");
156 void selinux_access_free(void) {
166 This function communicates with the kernel to check whether or not it should
168 If the machine is in permissive mode it will return ok. Audit messages will
169 still be generated if the access would be denied in enforcing mode.
171 int selinux_generic_access_check(
172 sd_bus_message *message,
174 const char *permission,
175 sd_bus_error *error) {
177 _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL;
178 const char *tclass = NULL, *scon = NULL;
179 struct audit_info audit_info = {};
180 _cleanup_free_ char *cl = NULL;
181 security_context_t fcon = NULL;
182 char **cmdline = NULL;
192 r = selinux_access_init(error);
196 r = sd_bus_query_sender_creds(
198 SD_BUS_CREDS_PID|SD_BUS_CREDS_UID|SD_BUS_CREDS_GID|
199 SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_AUDIT_LOGIN_UID|
200 SD_BUS_CREDS_SELINUX_CONTEXT,
205 r = sd_bus_creds_get_selinux_context(creds, &scon);
210 /* Get the file context of the unit file */
212 r = getfilecon(path, &fcon);
214 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
222 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
229 sd_bus_creds_get_cmdline(creds, &cmdline);
230 cl = strv_join(cmdline, " ");
232 audit_info.creds = creds;
233 audit_info.path = path;
234 audit_info.cmdline = cl;
236 r = selinux_check_access((security_context_t) scon, fcon, tclass, permission, &audit_info);
238 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "SELinux policy denies access.");
240 log_debug("SELinux access check scon=%s tcon=%s tclass=%s perm=%s path=%s cmdline=%s: %i", scon, fcon, tclass, permission, path, cl, r);
245 if (r < 0 && security_getenforce() != 1) {
246 sd_bus_error_free(error);
255 int selinux_generic_access_check(
256 sd_bus_message *message,
258 const char *permission,
259 sd_bus_error *error) {
264 void selinux_access_free(void) {