262 lines
6.2 KiB
C
262 lines
6.2 KiB
C
#include <unistd.h>
|
|
#include <sys/types.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/mman.h>
|
|
#include <sys/mount.h>
|
|
#include <fcntl.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <ctype.h>
|
|
#include <string.h>
|
|
#include <errno.h>
|
|
#include "selinux_internal.h"
|
|
#include <sepol/sepol.h>
|
|
#include <sepol/policydb.h>
|
|
#include "policy.h"
|
|
#include <limits.h>
|
|
|
|
int security_load_policy(void *data, size_t len)
|
|
{
|
|
char path[PATH_MAX];
|
|
int fd, ret;
|
|
|
|
snprintf(path, sizeof path, "%s/load", selinux_mnt);
|
|
fd = open(path, O_RDWR);
|
|
if (fd < 0)
|
|
return -1;
|
|
|
|
ret = write(fd, data, len);
|
|
close(fd);
|
|
if (ret < 0)
|
|
return -1;
|
|
return 0;
|
|
}
|
|
hidden_def(security_load_policy)
|
|
|
|
int load_setlocaldefs hidden = 1;
|
|
|
|
int selinux_mkload_policy(int preservebools)
|
|
{
|
|
int vers = sepol_policy_kern_vers_max();
|
|
int kernvers = security_policyvers();
|
|
char path[PATH_MAX], **names;
|
|
struct stat sb;
|
|
size_t size;
|
|
void *map, *data;
|
|
int fd, rc = -1, *values, len, i, prot;
|
|
sepol_policydb_t *policydb;
|
|
sepol_policy_file_t *pf;
|
|
|
|
search:
|
|
snprintf(path, sizeof(path), "%s.%d",
|
|
selinux_binary_policy_path(), vers);
|
|
fd = open(path, O_RDONLY);
|
|
while (fd < 0 && errno == ENOENT && --vers >= sepol_policy_kern_vers_min()) {
|
|
/* Check prior versions to see if old policy is available */
|
|
snprintf(path, sizeof(path), "%s.%d",
|
|
selinux_binary_policy_path(), vers);
|
|
fd = open(path, O_RDONLY);
|
|
}
|
|
if (fd < 0)
|
|
return -1;
|
|
|
|
if (fstat(fd, &sb) < 0)
|
|
goto close;
|
|
|
|
prot = PROT_READ;
|
|
if (load_setlocaldefs || preservebools)
|
|
prot |= PROT_WRITE;
|
|
|
|
size = sb.st_size;
|
|
data = map = mmap(NULL, size, prot, MAP_PRIVATE, fd, 0);
|
|
if (map == MAP_FAILED)
|
|
goto close;
|
|
|
|
if (vers > kernvers) {
|
|
/* Need to downgrade to kernel-supported version. */
|
|
if (sepol_policy_file_create(&pf))
|
|
goto unmap;
|
|
if (sepol_policydb_create(&policydb)) {
|
|
sepol_policy_file_free(pf);
|
|
goto unmap;
|
|
}
|
|
sepol_policy_file_set_mem(pf, data, size);
|
|
if (sepol_policydb_read(policydb, pf)) {
|
|
sepol_policy_file_free(pf);
|
|
sepol_policydb_free(policydb);
|
|
goto unmap;
|
|
}
|
|
if (sepol_policydb_set_vers(policydb, kernvers) ||
|
|
sepol_policydb_to_image(policydb, &data, &size)) {
|
|
/* Downgrade failed, keep searching. */
|
|
sepol_policy_file_free(pf);
|
|
sepol_policydb_free(policydb);
|
|
munmap(map, sb.st_size);
|
|
close(fd);
|
|
vers--;
|
|
goto search;
|
|
}
|
|
sepol_policy_file_free(pf);
|
|
sepol_policydb_free(policydb);
|
|
}
|
|
|
|
if (load_setlocaldefs) {
|
|
void *olddata = data;
|
|
size_t oldsize = size;
|
|
rc = sepol_genusers(olddata, oldsize, selinux_users_path(), &data, &size);
|
|
if (rc < 0) {
|
|
/* Fall back to the prior image if genusers failed. */
|
|
data = olddata;
|
|
size = oldsize;
|
|
rc = 0;
|
|
} else {
|
|
if (olddata != map)
|
|
free(olddata);
|
|
}
|
|
}
|
|
|
|
if (preservebools) {
|
|
rc = security_get_boolean_names(&names, &len);
|
|
if (!rc) {
|
|
values = malloc(sizeof(int)*len);
|
|
if (!values)
|
|
goto unmap;
|
|
for (i = 0; i < len; i++)
|
|
values[i] = security_get_boolean_active(names[i]);
|
|
(void) sepol_genbools_array(data, size, names, values, len);
|
|
free(values);
|
|
for (i = 0; i < len; i++)
|
|
free(names[i]);
|
|
free(names);
|
|
}
|
|
} else if (load_setlocaldefs) {
|
|
(void) sepol_genbools(data, size, (char*)selinux_booleans_path());
|
|
}
|
|
|
|
rc = security_load_policy(data, size);
|
|
|
|
unmap:
|
|
if (data != map)
|
|
free(data);
|
|
munmap(map, sb.st_size);
|
|
close:
|
|
close(fd);
|
|
return rc;
|
|
}
|
|
hidden_def(selinux_mkload_policy)
|
|
|
|
/*
|
|
* Mount point for selinuxfs.
|
|
* This definition is private to the function below.
|
|
* Everything else uses the location determined during
|
|
* libselinux startup via /proc/mounts (see init_selinuxmnt).
|
|
* We only need the hardcoded definition for the initial mount
|
|
* required for the initial policy load.
|
|
*/
|
|
#define SELINUXMNT "/selinux/"
|
|
|
|
int selinux_init_load_policy(int *enforce)
|
|
{
|
|
int rc = 0, orig_enforce = 0, seconfig = -2, secmdline = -1;
|
|
FILE *cfg;
|
|
char buf[4096];
|
|
|
|
/*
|
|
* Get desired mode (disabled, permissive, enforcing) from
|
|
* /etc/selinux/config.
|
|
*/
|
|
selinux_getenforcemode(&seconfig);
|
|
|
|
/* Check for an override of the mode via the kernel command line. */
|
|
rc = mount("none", "/proc", "proc", 0, 0);
|
|
cfg = fopen("/proc/cmdline", "r");
|
|
if (cfg) {
|
|
char *tmp;
|
|
if (fgets(buf, 4096, cfg) &&
|
|
(tmp = strstr(buf,"enforcing="))) {
|
|
if (tmp == buf || isspace(*(tmp-1))) {
|
|
secmdline = atoi(tmp+sizeof("enforcing=")-1);
|
|
}
|
|
}
|
|
fclose(cfg);
|
|
}
|
|
#define MNT_DETACH 2
|
|
if (rc == 0)
|
|
umount2("/proc", MNT_DETACH);
|
|
|
|
/*
|
|
* Determine the final desired mode.
|
|
* Command line argument takes precedence, then config file.
|
|
*/
|
|
if (secmdline >= 0)
|
|
*enforce = secmdline;
|
|
else if (seconfig >= 0)
|
|
*enforce = seconfig;
|
|
else
|
|
*enforce = 0; /* unspecified or disabled */
|
|
|
|
/*
|
|
* Check for the existence of SELinux via selinuxfs, and
|
|
* mount it if present for use in the calls below.
|
|
*/
|
|
if (mount("none", SELINUXMNT, "selinuxfs", 0, 0) < 0) {
|
|
if (errno == ENODEV) {
|
|
/*
|
|
* SELinux was disabled in the kernel, either
|
|
* omitted entirely or disabled at boot via selinux=0.
|
|
* This takes precedence over any config or
|
|
* commandline enforcing setting.
|
|
*/
|
|
*enforce = 0;
|
|
}
|
|
goto noload;
|
|
}
|
|
set_selinuxmnt(SELINUXMNT);
|
|
|
|
/*
|
|
* Note: The following code depends on having selinuxfs
|
|
* already mounted and selinuxmnt set above.
|
|
*/
|
|
|
|
if (seconfig == -1) {
|
|
/* Runtime disable of SELinux. */
|
|
rc = security_disable();
|
|
if (rc == 0) {
|
|
/* Successfully disabled, so umount selinuxfs too. */
|
|
umount(SELINUXMNT);
|
|
}
|
|
/*
|
|
* If we failed to disable, SELinux will still be
|
|
* effectively permissive, because no policy is loaded.
|
|
* No need to call security_setenforce(0) here.
|
|
*/
|
|
goto noload;
|
|
}
|
|
|
|
/*
|
|
* If necessary, change the kernel enforcing status to match
|
|
* the desired mode.
|
|
*/
|
|
orig_enforce = rc = security_getenforce();
|
|
if (rc < 0)
|
|
goto noload;
|
|
if (orig_enforce != *enforce) {
|
|
rc = security_setenforce(*enforce);
|
|
if (rc < 0)
|
|
goto noload;
|
|
}
|
|
|
|
/* Load the policy. */
|
|
return selinux_mkload_policy(0);
|
|
|
|
noload:
|
|
/*
|
|
* Only return 0 on a successful completion of policy load.
|
|
* In any other case, we want to return an error so that init
|
|
* knows not to proceed with the re-exec for the domain transition.
|
|
* Depending on the *enforce setting, init will halt (> 0) or proceed
|
|
* normally (otherwise).
|
|
*/
|
|
return -1;
|
|
}
|