meta-security/recipes-core/systemd/systemd/0005-tizen-smack-Handling-network-v216.patch

   1 From c257eade1a39ea00d26c4c297efd654b6ad4edb4 Mon Sep 17 00:00:00 2001
   2 From: Casey Schaufler <casey@schaufler-ca.com>
   3 Date: Fri, 8 Nov 2013 09:42:26 -0800
   4 Subject: [PATCH 5/9] tizen-smack: Handling network
   5
   6 - Set Smack ambient to match run label
   7 - Set Smack netlabel host rules
   8
   9 Set Smack ambient to match run label
  10 ------------------------------------
  11 Set the Smack networking ambient label to match the
  12 run label of systemd. System services may expect to
  13 communicate with external services over IP. Setting
  14 the ambient label assigns that label to IP packets
  15 that do not include CIPSO headers. This allows systemd
  16 and the services it spawns access to unlabeled IP
  17 packets, and hence external services.
  18
  19 A system may choose to restrict network access to
  20 particular services later in the startup process.
  21 This is easily done by resetting the ambient label
  22 elsewhere.
  23
  24 Set Smack netlabel host rules
  25 -----------------------------
  26 If SMACK_RUN_LABEL is defined set all other hosts to be
  27 single label hosts at the specified label. Set the loopback
  28 address to be a CIPSO host.
  29
  30 If any netlabel host rules are defined in /etc/smack/netlabel.d
  31 install them into the smackfs netlabel interface.
  32
  33 Upstream-Status: Pending
  34
  35 ---
  36  src/core/smack-setup.c | 33 ++++++++++++++++++++++++++++++++-
  37  1 file changed, 32 insertions(+), 1 deletion(-)
  38
  39 diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c
  40 index 59f6832..33dc1ca 100644
  41 --- a/src/core/smack-setup.c
  42 +++ b/src/core/smack-setup.c
  43 @@ -42,6 +42,7 @@
  44
  45  #define SMACK_CONFIG "/etc/smack/accesses.d/"
  46  #define CIPSO_CONFIG "/etc/smack/cipso.d/"
  47 +#define NETLABEL_CONFIG "/etc/smack/netlabel.d/"
  48
  49  #ifdef HAVE_SMACK
  50
  51 @@ -146,6 +147,19 @@ int smack_setup(bool *loaded_policy) {
  52          if (r)
  53                  log_warning("Failed to set SMACK label \"%s\" on self: %s",
  54                              SMACK_RUN_LABEL, strerror(-r));
  55 +        r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL);
  56 +        if (r)
  57 +                log_warning("Failed to set SMACK ambient label \"%s\": %s",
  58 +                            SMACK_RUN_LABEL, strerror(-r));
  59 +        r = write_string_file("/sys/fs/smackfs/netlabel",
  60 +                            "0.0.0.0/0 " SMACK_RUN_LABEL);
  61 +        if (r)
  62 +                log_warning("Failed to set SMACK netlabel rule \"%s\": %s",
  63 +                            "0.0.0.0/0 " SMACK_RUN_LABEL, strerror(-r));
  64 +        r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO");
  65 +        if (r)
  66 +                log_warning("Failed to set SMACK netlabel rule \"%s\": %s",
  67 +                            "127.0.0.1 -CIPSO", strerror(-r));
  68  #endif
  69
  70          r = write_rules("/sys/fs/smackfs/cipso2", CIPSO_CONFIG);
  71 @@ -155,14 +169,31 @@ int smack_setup(bool *loaded_policy) {
  72                  return 0;
  73          case ENOENT:
  74                  log_debug("Smack/CIPSO access rules directory " CIPSO_CONFIG " not found");
  75 -                return 0;
  76 +                break;
  77          case 0:
  78                  log_info("Successfully loaded Smack/CIPSO policies.");
  79 -                return 0;
  80 +                break;
  81          default:
  82                  log_warning("Failed to load Smack/CIPSO access rules: %s, ignoring.",
  83                              strerror(abs(r)));
  84 +                break;
  85 +        }
  86 +
  87 +        r = write_rules("/sys/fs/smackfs/netlabel", NETLABEL_CONFIG);
  88 +        switch(r) {
  89 +        case -ENOENT:
  90 +                log_debug("Smack/CIPSO is not enabled in the kernel.");
  91                  return 0;
  92 +        case ENOENT:
  93 +                log_debug("Smack network host rules directory " NETLABEL_CONFIG " not found");
  94 +                break;
  95 +        case 0:
  96 +                log_info("Successfully loaded Smack network host rules.");
  97 +                break;
  98 +        default:
  99 +                log_warning("Failed to load Smack network host rules: %s, ignoring.",
 100 +                            strerror(abs(r)));
 101 +                break;
 102          }
 103
 104          *loaded_policy = true;
 105 --
 106 1.8.4.5
 107