meta-security/recipes-core/systemd/systemd/0005-tizen-smack-Handling-network-v225.patch

   1 From 513a8d943538643fabf0d31f1eed261677dfbddc Mon Sep 17 00:00:00 2001
   2 From: Casey Schaufler <casey@schaufler-ca.com>
   3 Date: Fri, 8 Nov 2013 09:42:26 -0800
   4 Subject: [PATCH] tizen-smack: Handling network
   5
   6 - Set Smack ambient to match run label
   7 - Set Smack netlabel host rules
   8
   9 Set Smack ambient to match run label
  10 ------------------------------------
  11 Set the Smack networking ambient label to match the
  12 run label of systemd. System services may expect to
  13 communicate with external services over IP. Setting
  14 the ambient label assigns that label to IP packets
  15 that do not include CIPSO headers. This allows systemd
  16 and the services it spawns access to unlabeled IP
  17 packets, and hence external services.
  18
  19 A system may choose to restrict network access to
  20 particular services later in the startup process.
  21 This is easily done by resetting the ambient label
  22 elsewhere.
  23
  24 Set Smack netlabel host rules
  25 -----------------------------
  26 If SMACK_RUN_LABEL is defined set all other hosts to be
  27 single label hosts at the specified label. Set the loopback
  28 address to be a CIPSO host.
  29
  30 If any netlabel host rules are defined in /etc/smack/netlabel.d
  31 install them into the smackfs netlabel interface.
  32
  33 [Patrick Ohly: adapt to write_string_file() change in "fileio: consolidate write_string_file*()"]
  34 [Patrick Ohly: create write_netlabel_rules() based on the original write_rules() that was removed in "smack: support smack access change-rule"]
  35
  36 Upstream-Status: Pending
  37 ---
  38  src/core/smack-setup.c | 109 +++++++++++++++++++++++++++++++++++++++++++++++--
  39  1 file changed, 106 insertions(+), 3 deletions(-)
  40
  41 diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c
  42 index cbe7d0b..b384aa0 100644
  43 --- a/src/core/smack-setup.c
  44 +++ b/src/core/smack-setup.c
  45 @@ -34,6 +34,9 @@
  46  #include "fileio.h"
  47  #include "log.h"
  48
  49 +#define CIPSO_CONFIG "/etc/smack/cipso.d/"
  50 +#define NETLABEL_CONFIG "/etc/smack/netlabel.d/"
  51 +
  52  #ifdef HAVE_SMACK
  53
  54  static int write_access2_rules(const char* srcdir) {
  55 @@ -193,6 +196,76 @@ static int write_cipso2_rules(const char* srcdir) {
  56          return r;
  57  }
  58
  59 +static int write_netlabel_rules(const char* srcdir) {
  60 +        _cleanup_fclose_ FILE *dst = NULL;
  61 +        _cleanup_closedir_ DIR *dir = NULL;
  62 +        struct dirent *entry;
  63 +        char buf[NAME_MAX];
  64 +        int dfd = -1;
  65 +        int r = 0;
  66 +        static const char dstpath[] = "/sys/fs/smackfs/netlabel";
  67 +
  68 +        dst = fopen(dstpath, "we");
  69 +        if (!dst)  {
  70 +                if (errno != ENOENT)
  71 +                        log_warning_errno(errno, "Failed to open %s: %m", dstpath);
  72 +                return -errno; /* negative error */
  73 +        }
  74 +
  75 +        /* write rules to dst from every file in the directory */
  76 +        dir = opendir(srcdir);
  77 +        if (!dir) {
  78 +                if (errno != ENOENT)
  79 +                        log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
  80 +                return errno; /* positive on purpose */
  81 +        }
  82 +
  83 +        dfd = dirfd(dir);
  84 +        assert(dfd >= 0);
  85 +
  86 +        FOREACH_DIRENT(entry, dir, return 0) {
  87 +                int fd;
  88 +                _cleanup_fclose_ FILE *policy = NULL;
  89 +
  90 +                fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
  91 +                if (fd < 0) {
  92 +                        if (r == 0)
  93 +                                r = -errno;
  94 +                        log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
  95 +                        continue;
  96 +                }
  97 +
  98 +                policy = fdopen(fd, "re");
  99 +                if (!policy) {
 100 +                        if (r == 0)
 101 +                                r = -errno;
 102 +                        safe_close(fd);
 103 +                        log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
 104 +                        continue;
 105 +                }
 106 +
 107 +                /* load2 write rules in the kernel require a line buffered stream */
 108 +                FOREACH_LINE(buf, policy,
 109 +                             log_error_errno(errno, "Failed to read line from %s: %m",
 110 +                                       entry->d_name)) {
 111 +                        if (!fputs(buf, dst)) {
 112 +                                if (r == 0)
 113 +                                        r = -EINVAL;
 114 +                                log_error("Failed to write line to %s", dstpath);
 115 +                                break;
 116 +                        }
 117 +                        if (fflush(dst)) {
 118 +                                if (r == 0)
 119 +                                        r = -errno;
 120 +                                log_error_errno(errno, "Failed to flush writes to %s: %m", dstpath);
 121 +                                break;
 122 +                        }
 123 +                }
 124 +        }
 125 +
 126 +       return r;
 127 +}
 128 +
 129  #endif
 130
 131  int mac_smack_setup(bool *loaded_policy) {
 132 @@ -225,23 +298,53 @@ int mac_smack_setup(bool *loaded_policy) {
 133          if (r)
 134                  log_warning("Failed to set SMACK label \"%s\" on self: %s",
 135                              SMACK_RUN_LABEL, strerror(-r));
 136 +        r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
 137 +        if (r)
 138 +                log_warning("Failed to set SMACK ambient label \"%s\": %s",
 139 +                            SMACK_RUN_LABEL, strerror(-r));
 140 +        r = write_string_file("/sys/fs/smackfs/netlabel",
 141 +                              "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
 142 +        if (r)
 143 +                log_warning("Failed to set SMACK netlabel rule \"%s\": %s",
 144 +                            "0.0.0.0/0 " SMACK_RUN_LABEL, strerror(-r));
 145 +        r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
 146 +        if (r)
 147 +                log_warning("Failed to set SMACK netlabel rule \"%s\": %s",
 148 +                            "127.0.0.1 -CIPSO", strerror(-r));
 149  #endif
 150
 151 -        r = write_cipso2_rules("/etc/smack/cipso.d/");
 152 +        r = write_cipso2_rules(CIPSO_CONFIG);
 153          switch(r) {
 154          case -ENOENT:
 155                  log_debug("Smack/CIPSO is not enabled in the kernel.");
 156                  return 0;
 157          case ENOENT:
 158 -                log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
 159 -                return 0;
 160 +                log_debug("Smack/CIPSO access rules directory " CIPSO_CONFIG " not found");
 161 +                break;
 162          case 0:
 163                  log_info("Successfully loaded Smack/CIPSO policies.");
 164                  break;
 165          default:
 166                  log_warning("Failed to load Smack/CIPSO access rules: %s, ignoring.",
 167                              strerror(abs(r)));
 168 +                break;
 169 +        }
 170 +
 171 +        r = write_netlabel_rules(NETLABEL_CONFIG);
 172 +        switch(r) {
 173 +        case -ENOENT:
 174 +                log_debug("Smack/CIPSO is not enabled in the kernel.");
 175                  return 0;
 176 +        case ENOENT:
 177 +                log_debug("Smack network host rules directory " NETLABEL_CONFIG " not found");
 178 +                break;
 179 +        case 0:
 180 +                log_info("Successfully loaded Smack network host rules.");
 181 +                break;
 182 +        default:
 183 +                log_warning("Failed to load Smack network host rules: %s, ignoring.",
 184 +                            strerror(abs(r)));
 185 +                break;
 186          }
 187
 188          *loaded_policy = true;
 189 --
 190 2.1.4
 191