src/selinux.c

   1 /* selinux - core functions for maintaining SELinux labeling
   2    Copyright (C) 2012-2013 Red Hat, Inc.
   3
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation, either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  16
  17 /* Written by Daniel Walsh <dwalsh@redhat.com> */
  18
  19 #include <config.h>
  20 #include <selinux/selinux.h>
  21 #include <selinux/context.h>
  22 #include <sys/types.h>
  23
  24 #include "error.h"
  25 #include "system.h"
  26 #include "canonicalize.h"
  27 #include "dosname.h"
  28 #include "xfts.h"
  29 #include "quote.h"
  30 #include "selinux.h"
  31
  32 #if HAVE_SELINUX_SELINUX_H
  33
  34 # if ! HAVE_MODE_TO_SECURITY_CLASS
  35 /*
  36   This function has been added to libselinux-2.1.12-5, but is here
  37   for support with older versions of SELinux
  38
  39   Translates a mode into an Internal SELinux security_class definition.
  40   Returns 0 on failure, with errno set to EINVAL.
  41 */
  42 static security_class_t
  43 mode_to_security_class (mode_t m)
  44 {
  45
  46   if (S_ISREG (m))
  47     return string_to_security_class ("file");
  48   if (S_ISDIR (m))
  49     return string_to_security_class ("dir");
  50   if (S_ISCHR (m))
  51     return string_to_security_class ("chr_file");
  52   if (S_ISBLK (m))
  53     return string_to_security_class ("blk_file");
  54   if (S_ISFIFO (m))
  55     return string_to_security_class ("fifo_file");
  56   if (S_ISLNK (m))
  57     return string_to_security_class ("lnk_file");
  58   if (S_ISSOCK (m))
  59     return string_to_security_class ("sock_file");
  60
  61   errno = EINVAL;
  62   return 0;
  63 }
  64 # endif
  65
  66 /*
  67   This function takes a PATH and a MODE and then asks SELinux what the label
  68   of the path object would be if the current process label created it.
  69   It then returns the label.
  70
  71   Returns -1 on failure.  errno will be set appropriately.
  72 */
  73
  74 static int
  75 computecon (char const *path, mode_t mode, security_context_t * con)
  76 {
  77   security_context_t scon = NULL;
  78   security_context_t tcon = NULL;
  79   security_class_t tclass;
  80   int rc = -1;
  81
  82   char *dir = dir_name (path);
  83   if (!dir)
  84     goto quit;
  85   if (getcon (&scon) < 0)
  86     goto quit;
  87   if (getfilecon (dir, &tcon) < 0)
  88     goto quit;
  89   tclass = mode_to_security_class (mode);
  90   if (!tclass)
  91     goto quit;
  92   rc = security_compute_create (scon, tcon, tclass, con);
  93
  94 quit:
  95   free (dir);
  96   freecon (scon);
  97   freecon (tcon);
  98   return rc;
  99 }
 100
 101 /*
 102   This function takes a path and a mode, it calls computecon to get the
 103   label of the path object if the current process created it, then it calls
 104   matchpathcon to get the default type for the object.  It substitutes the
 105   default type into label.  It tells the SELinux Kernel to label all new file
 106   system objects created by the current process with this label.
 107
 108   Returns -1 on failure.  errno will be set appropriately.
 109 */
 110 int
 111 defaultcon (char const *path, mode_t mode)
 112 {
 113   int rc = -1;
 114   security_context_t scon = NULL, tcon = NULL;
 115   context_t scontext = 0, tcontext = 0;
 116   const char *contype;
 117   char *constr;
 118   char *newpath = NULL;
 119
 120   if (! IS_ABSOLUTE_FILE_NAME (path))
 121     {
 122       /* Generate absolute path as required by subsequent matchpathcon(),
 123          with libselinux < 2.1.5 2011-0826.  */
 124       newpath = canonicalize_filename_mode (path, CAN_MISSING);
 125       if (! newpath)
 126         error (EXIT_FAILURE, errno, _("error canonicalizing %s"),
 127                quote (path));
 128       path = newpath;
 129     }
 130
 131   if (matchpathcon (path, mode, &scon) < 0)
 132     {
 133       /* "No such file or directory" is a confusing error,
 134          when processing files, when in fact it was the
 135          associated default context that was not found.
 136          Therefore map the error to something more appropriate
 137          to the context in which we're using matchpathcon().  */
 138       if (errno == ENOENT)
 139         errno = ENODATA;
 140       goto quit;
 141     }
 142   if (computecon (path, mode, &tcon) < 0)
 143     goto quit;
 144   if (!(scontext = context_new (scon)))
 145     goto quit;
 146   if (!(tcontext = context_new (tcon)))
 147     goto quit;
 148
 149   if (!(contype = context_type_get (scontext)))
 150     goto quit;
 151   if (context_type_set (tcontext, contype))
 152     goto quit;
 153   if (!(constr = context_str (tcontext)))
 154     goto quit;
 155
 156   rc = setfscreatecon (constr);
 157
 158 quit:
 159   context_free (scontext);
 160   context_free (tcontext);
 161   freecon (scon);
 162   freecon (tcon);
 163   free (newpath);
 164   return rc;
 165 }
 166
 167 /*
 168   This function takes a PATH of an existing file system object, and a LOCAL
 169   boolean that indicates whether the function should set the object's label
 170   to the default for the local process, or one using system wide settings.
 171   If LOCAL == true, it will ask the SELinux Kernel what the default label
 172   for all objects created should be and then sets the label on the object.
 173   Otherwise it calls matchpathcon on the object to ask the system what the
 174   default label should be, extracts the type field and then modifies the file
 175   system object.  Note only the type field is updated, thus preserving MLS
 176   levels and user identity etc. of the PATH.
 177
 178   Returns -1 on failure.  errno will be set appropriately.
 179 */
 180 static int
 181 restorecon_private (char const *path, bool local)
 182 {
 183   int rc = -1;
 184   struct stat sb;
 185   security_context_t scon = NULL, tcon = NULL;
 186   context_t scontext = 0, tcontext = 0;
 187   const char *contype;
 188   char *constr;
 189   int fd;
 190
 191   if (local)
 192     {
 193       if (getfscreatecon (&tcon) < 0)
 194         return rc;
 195       rc = lsetfilecon (path, tcon);
 196       freecon (tcon);
 197       return rc;
 198     }
 199
 200   fd = open (path, O_RDONLY | O_NOFOLLOW);
 201   if (fd == -1 && (errno != ELOOP))
 202     goto quit;
 203
 204   if (fd != -1)
 205     {
 206       if (fstat (fd, &sb) < 0)
 207         goto quit;
 208     }
 209   else
 210     {
 211       if (lstat (path, &sb) < 0)
 212         goto quit;
 213     }
 214
 215   if (matchpathcon (path, sb.st_mode, &scon) < 0)
 216     {
 217       /* "No such file or directory" is a confusing error,
 218          when processing files, when in fact it was the
 219          associated default context that was not found.
 220          Therefore map the error to something more appropriate
 221          to the context in which we're using matchpathcon().  */
 222       if (errno == ENOENT)
 223         errno = ENODATA;
 224       goto quit;
 225     }
 226   if (!(scontext = context_new (scon)))
 227     goto quit;
 228
 229   if (fd != -1)
 230     {
 231       if (fgetfilecon (fd, &tcon) < 0)
 232         goto quit;
 233     }
 234   else
 235     {
 236       if (lgetfilecon (path, &tcon) < 0)
 237         goto quit;
 238     }
 239
 240   if (!(tcontext = context_new (tcon)))
 241     goto quit;
 242
 243   if (!(contype = context_type_get (scontext)))
 244     goto quit;
 245   if (context_type_set (tcontext, contype))
 246     goto quit;
 247   if (!(constr = context_str (tcontext)))
 248     goto quit;
 249
 250   if (fd != -1)
 251     rc = fsetfilecon (fd, constr);
 252   else
 253     rc = lsetfilecon (path, constr);
 254
 255 quit:
 256   if (fd != -1)
 257     close (fd);
 258   context_free (scontext);
 259   context_free (tcontext);
 260   freecon (scon);
 261   freecon (tcon);
 262   return rc;
 263 }
 264
 265 /*
 266   This function takes three parameters:
 267
 268   PATH of an existing file system object.
 269
 270   A RECURSE boolean which if the file system object is a directory, will
 271   call restorecon_private on every file system object in the directory.
 272
 273   A LOCAL boolean that indicates whether the function should set object labels
 274   to the default for the local process, or use system wide settings.
 275
 276   Returns false on failure.  errno will be set appropriately.
 277 */
 278 bool
 279 restorecon (char const *path, bool recurse, bool local)
 280 {
 281   char *newpath = NULL;
 282   FTS *fts;
 283   bool ok = true;
 284
 285   if (! IS_ABSOLUTE_FILE_NAME (path) && ! local)
 286     {
 287       /* Generate absolute path as required by subsequent matchpathcon(),
 288          with libselinux < 2.1.5 2011-0826.  Also generating the absolute
 289          path before the fts walk, will generate absolute paths in the
 290          fts entries, which may be quicker to process in any case.  */
 291       newpath = canonicalize_filename_mode (path, CAN_MISSING);
 292       if (! newpath)
 293         error (EXIT_FAILURE, errno, _("error canonicalizing %s"),
 294                quote (path));
 295     }
 296
 297   const char *ftspath[2] = { newpath ? newpath : path, NULL };
 298
 299   if (! recurse)
 300     {
 301       ok = restorecon_private (*ftspath, local) != -1;
 302       free (newpath);
 303       return ok;
 304     }
 305
 306   fts = xfts_open ((char *const *) ftspath, FTS_PHYSICAL, NULL);
 307   while (1)
 308     {
 309       FTSENT *ent;
 310
 311       ent = fts_read (fts);
 312       if (ent == NULL)
 313         {
 314           if (errno != 0)
 315             {
 316               error (0, errno, _("fts_read failed"));
 317               ok = false;
 318             }
 319           break;
 320         }
 321
 322       ok &= restorecon_private (fts->fts_path, local) != -1;
 323     }
 324
 325   if (fts_close (fts) != 0)
 326     {
 327       error (0, errno, _("fts_close failed"));
 328       ok = false;
 329     }
 330
 331   free (newpath);
 332   return ok;
 333 }
 334 #endif