1 From e714327016fb65a0bf977588efaecbaf41ac3cfc Mon Sep 17 00:00:00 2001
2 From: Casey Schaufler <casey@schaufler-ca.com>
3 Date: Fri, 8 Nov 2013 09:42:26 -0800
4 Subject: [PATCH 4/6] tizen-smack: Handling network
6 - Set Smack ambient to match run label
7 - Set Smack netlabel host rules
9 Set Smack ambient to match run label
10 ------------------------------------
11 Set the Smack networking ambient label to match the
12 run label of systemd. System services may expect to
13 communicate with external services over IP. Setting
14 the ambient label assigns that label to IP packets
15 that do not include CIPSO headers. This allows systemd
16 and the services it spawns access to unlabeled IP
17 packets, and hence external services.
19 A system may choose to restrict network access to
20 particular services later in the startup process.
21 This is easily done by resetting the ambient label
24 Set Smack netlabel host rules
25 -----------------------------
26 If SMACK_RUN_LABEL is defined set all other hosts to be
27 single label hosts at the specified label. Set the loopback
28 address to be a CIPSO host.
30 If any netlabel host rules are defined in /etc/smack/netlabel.d
31 install them into the smackfs netlabel interface.
33 [Patrick Ohly: copied from https://review.tizen.org/git/?p=platform/upstream/systemd.git;a=commit;h=db4f6c9a074644aa2bf]
34 [Patrick Ohly: adapt to write_string_file() change in "fileio: consolidate write_string_file*()"]
35 [Patrick Ohly: create write_netlabel_rules() based on the original write_rules() that was removed in "smack: support smack access change-rule"]
36 [Patrick Ohly: adapted to upstream code review feedback: error logging, string constants]
38 Upstream-Status: Accepted [https://github.com/systemd/systemd/pull/2262]
40 %% original patch: 0005-tizen-smack-Handling-network-v225.patch
42 src/core/smack-setup.c | 101 +++++++++++++++++++++++++++++++++++++++++++++++--
43 1 file changed, 98 insertions(+), 3 deletions(-)
45 diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c
46 index 0661ff9..c9374ca 100644
47 --- a/src/core/smack-setup.c
48 +++ b/src/core/smack-setup.c
49 @@ -197,6 +197,75 @@ static int write_cipso2_rules(const char* srcdir) {
53 +static int write_netlabel_rules(const char* srcdir) {
54 + _cleanup_fclose_ FILE *dst = NULL;
55 + _cleanup_closedir_ DIR *dir = NULL;
56 + struct dirent *entry;
61 + dst = fopen("/sys/fs/smackfs/netlabel", "we");
63 + if (errno != ENOENT)
64 + log_warning_errno(errno, "Failed to open /sys/fs/smackfs/netlabel: %m");
65 + return -errno; /* negative error */
68 + /* write rules to dst from every file in the directory */
69 + dir = opendir(srcdir);
71 + if (errno != ENOENT)
72 + log_warning_errno(errno, "Failed to opendir %s: %m", srcdir);
73 + return errno; /* positive on purpose */
79 + FOREACH_DIRENT(entry, dir, return 0) {
81 + _cleanup_fclose_ FILE *policy = NULL;
83 + fd = openat(dfd, entry->d_name, O_RDONLY|O_CLOEXEC);
87 + log_warning_errno(errno, "Failed to open %s: %m", entry->d_name);
91 + policy = fdopen(fd, "re");
96 + log_error_errno(errno, "Failed to open %s: %m", entry->d_name);
100 + /* load2 write rules in the kernel require a line buffered stream */
101 + FOREACH_LINE(buf, policy,
102 + log_error_errno(errno, "Failed to read line from %s: %m",
104 + if (!fputs(buf, dst)) {
107 + log_error_errno(errno, "Failed to write line to /sys/fs/smackfs/netlabel");
113 + log_error_errno(errno, "Failed to flush writes to /sys/fs/smackfs/netlabel: %m");
124 int mac_smack_setup(bool *loaded_policy) {
125 @@ -225,8 +294,18 @@ int mac_smack_setup(bool *loaded_policy) {
127 #ifdef SMACK_RUN_LABEL
128 r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, 0);
130 - log_warning_errno(r, "Failed to set SMACK label \"%s\" on self: %m", SMACK_RUN_LABEL);
132 + log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
133 + r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, 0);
135 + log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
136 + r = write_string_file("/sys/fs/smackfs/netlabel",
137 + "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
139 + log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
140 + r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", 0);
142 + log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
145 r = write_cipso2_rules("/etc/smack/cipso.d/");
146 @@ -236,13 +315,29 @@ int mac_smack_setup(bool *loaded_policy) {
149 log_debug("Smack/CIPSO access rules directory '/etc/smack/cipso.d/' not found");
153 log_info("Successfully loaded Smack/CIPSO policies.");
156 log_warning_errno(r, "Failed to load Smack/CIPSO access rules, ignoring: %m");
160 + r = write_netlabel_rules("/etc/smack/netlabel.d/");
163 + log_debug("Smack/CIPSO is not enabled in the kernel.");
166 + log_debug("Smack network host rules directory '/etc/smack/netlabel.d/' not found");
169 + log_info("Successfully loaded Smack network host rules.");
172 + log_warning_errno(r, "Failed to load Smack network host rules: %m, ignoring.");
176 *loaded_policy = true;