summaryrefslogtreecommitdiff
path: root/src/core/smack-setup.c
AgeCommit message (Collapse)Author
2016-02-10tree-wide: remove Emacs lines from all filesDaniel Mack
This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
2016-01-11smack: Handling networkCasey Schaufler
- Set Smack ambient to match run label - Set Smack netlabel host rules Set Smack ambient to match run label ------------------------------------ Set the Smack networking ambient label to match the run label of systemd. System services may expect to communicate with external services over IP. Setting the ambient label assigns that label to IP packets that do not include CIPSO headers. This allows systemd and the services it spawns access to unlabeled IP packets, and hence external services. A system may choose to restrict network access to particular services later in the startup process. This is easily done by resetting the ambient label elsewhere. Set Smack netlabel host rules ----------------------------- If SMACK_RUN_LABEL is defined set all other hosts to be single label hosts at the specified label. Set the loopback address to be a CIPSO host. If any netlabel host rules are defined in /etc/smack/netlabel.d install them into the smackfs netlabel interface. [Patrick Ohly: copied from https://review.tizen.org/git/?p=platform/upstream/systemd.git;a=commit;h=db4f6c9a074644aa2bf] [Patrick Ohly: adapt to write_string_file() change in "fileio: consolidate write_string_file*()"] [Patrick Ohly: create write_netlabel_rules() based on the original write_rules() that was removed in "smack: support smack access change-rule"] [Patrick Ohly: adapted to upstream code review feedback: error logging, string constants]
2015-10-27util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering
2015-10-27util-lib: introduce dirent-util.[ch] for directory entry callsLennart Poettering
Also, move a couple of more path-related functions to path-util.c.
2015-10-25util-lib: split out fd-related operations into fd-util.[ch]Lennart Poettering
There are more than enough to deserve their own .c file, hence move them over.
2015-10-24util-lib: split our string related calls from util.[ch] into its own file ↵Lennart Poettering
string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.
2015-10-01tree-wide: add missing errno arguments to log_*_errno()Michal Schmidt
A few of the recent conversions to log_*_errno() were missing the errno value arguments. Fixes: e53fc357a9b "tree-wide: remove a number of invocations of strerror() and replace by %m"
2015-09-30tree-wide: remove a number of invocations of strerror() and replace by %mLennart Poettering
Let's clean up our tree a bit, and reduce invocations of the thread-unsafe strerror() by replacing it with printf()'s %m specifier.
2015-07-06fileio: consolidate write_string_file*()Daniel Mack
Merge write_string_file(), write_string_file_no_create() and write_string_file_atomic() into write_string_file() and provide a flags mask that allows combinations of atomic writing, newline appending and automatic file creation. Change all users accordingly.
2015-06-22smack: support smack access change-ruleWaLyong Cho
Smack is also able to have modification rules of existing rules. In this case, the rule has additional argument to modify previous rule. /sys/fs/smackfs/load2 node can only take three arguments: subject object access. So if modification rules are written to /sys/fs/smackfs/load2, EINVAL error is happen. Those modification rules have to be written to /sys/fs/smackfs/change-rule. To distinguish access with operation of cipso2, split write_rules() for each operation. And, in write access rules, parse the rule and if the rule has four argument then write into /sys/fs/smackfs/change-rule. https://lwn.net/Articles/532340/ fwrite() or fputs() are fancy functions to write byte stream such like regular file. But special files on linux such like proc, sysfs are not stream of bytes. Those special files on linux have to be written with specific size. By this reason, in some of many case, fputs() was failed to write buffer to smack load2 node. The write operation for the smack nodes should be performed with write().
2015-02-23remove unused includesThomas Hindoe Paaboel Andersen
This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.
2014-11-28treewide: use log_*_errno whenever %m is in the format stringMichal Schmidt
If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-10-28mac: add mac_ prefix to distinguish origin security apisWaLyong Cho
2014-09-13core: smack-setup: Actually allow for succesfully loading CIPSO policyPhilippe De Swert
The line under the last switch statement *loaded_policy = true; would never be executed. As all switch cases return 0. Thus the policy would never be marked as loaded. Found with Coverity. Fixes: CID#1237785
2014-03-18util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering
safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-02-24smack: set loaded_policy in smack_setup()Łukasz Stelmach
With loaded_policy set to true mount_setup() relabels /dev properly.
2013-10-07Run with a custom SMACK domain (label).Auke Kok
Allows the systemd --system process to change its current SMACK label to a predefined custom label (usually "system") at boot time. This is needed to have a few system-generated folders and sockets automatically be created with the right SMACK label. Without that, processes either cannot communicate with systemd or systemd fails to perform some actions.
2013-10-01smack-setup: fix path to Smack/CIPSO mappingsPatrick McCarty
The correct path to the dir with CIPSO mappings is /etc/smack/cipso.d/; /etc/smack/cipso is a file that can include these mappings as well, though it is no longer supported in upstream libsmack.
2013-05-17Make it possible to disable smack separately from xattr supportKarol Lewandowski
Additionally, compile out rule loading if feature is disabled.
2013-03-15smack-setup: enable Smack/CIPSO mappingNathaniel Chen
CIPSO is the Common IP Security Option, an IETF standard for setting security levels for a process sending packets. In Smack kernels, CIPSO headers are mapped to Smack labels automatically, but can be changed. This patch writes label/category mappings from /etc/smack/cipso/ to /sys/fs/smackfs/cipso2. The mapping format is "%s%4d%4d"["%4d"]... For more information about Smack and CIPSO, see: https://kernel.org/doc/Documentation/security/Smack.txt
2013-03-15smack-setup: extract rule writing into a separate functionZbigniew Jędrzejewski-Szmek
Check all errors.
2013-03-11core/smack: downgrade info to debugZbigniew Jędrzejewski-Szmek
BogdanR> I think it's cool it supports SMACK and that it encourages them to use a propper mount point for smackfs but I don't think it's cool that it's printing on the screen even when I parse quiet to the kernel that "SMACK support is not enabled ...".
2013-03-07core: mount and initialize SmackNathaniel Chen
SMACK is the Simple Mandatory Access Control Kernel, a minimal approach to Access Control implemented as a kernel LSM. The kernel exposes the smackfs filesystem API through which access rules can be loaded. At boot time, we want to load the access rules as early as possible to ensure all early boot steps are checked by Smack. This patch mounts smackfs at the new location at /sys/fs/smackfs for kernels 3.8 and above. The /smack mountpoint is not supported. After mounting smackfs, rules are loaded from the usual location. For more information about Smack see: http://www.kernel.org/doc/Documentation/security/Smack.txt