#include <stdio.h>
#include <errno.h>
#include <string.h>
-#include <unistd.h>
#include <stdlib.h>
-#include <sys/vfs.h>
#include <fcntl.h>
-#include <sys/types.h>
#include <dirent.h>
-#include <sys/mount.h>
-#include <stdint.h>
#include "macro.h"
#include "smack-setup.h"
#include "util.h"
+#include "fileio.h"
#include "log.h"
-#include "label.h"
#define SMACK_CONFIG "/etc/smack/accesses.d/"
-#define CIPSO_CONFIG "/etc/smack/cipso/"
+#define CIPSO_CONFIG "/etc/smack/cipso.d/"
+
+#ifdef HAVE_SMACK
static int write_rules(const char* dstpath, const char* srcdir) {
_cleanup_fclose_ FILE *dst = NULL;
dst = fopen(dstpath, "we");
if (!dst) {
if (errno != ENOENT)
- log_warning("Failed to open %s: %m", dstpath);
+ log_warning_errno(errno, "Failed to open %s: %m", dstpath);
return -errno; /* negative error */
}
dir = opendir(srcdir);
if (!dir) {
if (errno != ENOENT)
- log_warning("Failed to opendir %s: %m", srcdir);
+ log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
return errno; /* positive on purpose */
}
if (fd < 0) {
if (r == 0)
r = -errno;
- log_warning("Failed to open %s: %m", entry->d_name);
+ log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
continue;
}
if (!policy) {
if (r == 0)
r = -errno;
- close_nointr_nofail(fd);
- log_error("Failed to open %s: %m", entry->d_name);
+ safe_close(fd);
+ log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
continue;
}
/* load2 write rules in the kernel require a line buffered stream */
FOREACH_LINE(buf, policy,
- log_error("Failed to read line from %s: %m",
+ log_error_errno(errno, "Failed to read line from %s: %m",
entry->d_name)) {
if (!fputs(buf, dst)) {
if (r == 0)
if (fflush(dst)) {
if (r == 0)
r = -errno;
- log_error("Failed to flush writes to %s: %m", dstpath);
+ log_error_errno(errno, "Failed to flush writes to %s: %m", dstpath);
break;
}
}
return r;
}
+#endif
+
+int mac_smack_setup(bool *loaded_policy) {
+
+#ifdef HAVE_SMACK
-int smack_setup(void) {
int r;
+ assert(loaded_policy);
+
r = write_rules("/sys/fs/smackfs/load2", SMACK_CONFIG);
switch(r) {
case -ENOENT:
return 0;
}
+#ifdef SMACK_RUN_LABEL
+ r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL);
+ if (r)
+ log_warning("Failed to set SMACK label \"%s\" on self: %s",
+ SMACK_RUN_LABEL, strerror(-r));
+#endif
+
r = write_rules("/sys/fs/smackfs/cipso2", CIPSO_CONFIG);
switch(r) {
case -ENOENT:
return 0;
case 0:
log_info("Successfully loaded Smack/CIPSO policies.");
- return 0;
+ break;
default:
log_warning("Failed to load Smack/CIPSO access rules: %s, ignoring.",
strerror(abs(r)));
return 0;
}
+
+ *loaded_policy = true;
+
+#endif
+
+ return 0;
}