From d682b3a7e7c7c2941a4d3e193f1e330dbc9fae89 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 10 Oct 2013 16:35:44 +0200 Subject: security: rework selinux, smack, ima, apparmor detection logic Always cache the results, and bypass low-level security calls when the respective subsystem is not enabled. --- src/shared/apparmor-util.c | 41 +++++++++++++++++++++++++++++++++++++++++ src/shared/apparmor-util.h | 26 ++++++++++++++++++++++++++ src/shared/ima-util.c | 35 +++++++++++++++++++++++++++++++++++ src/shared/ima-util.h | 26 ++++++++++++++++++++++++++ src/shared/selinux-util.c | 9 +++++++++ src/shared/smack-util.c | 13 +++++++++---- 6 files changed, 146 insertions(+), 4 deletions(-) create mode 100644 src/shared/apparmor-util.c create mode 100644 src/shared/apparmor-util.h create mode 100644 src/shared/ima-util.c create mode 100644 src/shared/ima-util.h (limited to 'src/shared') diff --git a/src/shared/apparmor-util.c b/src/shared/apparmor-util.c new file mode 100644 index 0000000000..2b85da1e4a --- /dev/null +++ b/src/shared/apparmor-util.c @@ -0,0 +1,41 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +/*** + This file is part of systemd. + + Copyright 2013 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see . +***/ + +#include + +#include "util.h" +#include "fileio.h" +#include "apparmor-util.h" + +static int use_apparmor_cached = -1; + +bool use_apparmor(void) { + + if (use_apparmor_cached < 0) { + _cleanup_free_ char *p = NULL; + + use_apparmor_cached = + read_one_line_file("/sys/module/apparmor/parameters/enabled", &p) >= 0 && + parse_boolean(p) > 0; + } + + return use_apparmor_cached; +} diff --git a/src/shared/apparmor-util.h b/src/shared/apparmor-util.h new file mode 100644 index 0000000000..4b056a1aae --- /dev/null +++ b/src/shared/apparmor-util.h @@ -0,0 +1,26 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +#pragma once + +/*** + This file is part of systemd. + + Copyright 2013 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see . +***/ + +#include + +bool use_apparmor(void); diff --git a/src/shared/ima-util.c b/src/shared/ima-util.c new file mode 100644 index 0000000000..f0d3c926a2 --- /dev/null +++ b/src/shared/ima-util.c @@ -0,0 +1,35 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +/*** + This file is part of systemd. + + Copyright 2013 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see . +***/ + +#include + +#include "apparmor-util.h" + + +static int use_ima_cached = -1; + +bool use_ima(void) { + + if (use_ima_cached < 0) + use_ima_cached = access("/sys/kernel/security/ima/", F_OK) >= 0; + + return use_ima_cached; +} diff --git a/src/shared/ima-util.h b/src/shared/ima-util.h new file mode 100644 index 0000000000..d382161706 --- /dev/null +++ b/src/shared/ima-util.h @@ -0,0 +1,26 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +#pragma once + +/*** + This file is part of systemd. + + Copyright 2013 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see . +***/ + +#include + +bool use_ima(void); diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index ff3375607f..026ae5a9e8 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -39,4 +39,13 @@ void retest_selinux(void) { use_selinux_cached = -1; } +#else + +bool use_selinux(void) { + return false; +} + +void retest_selinux(void) { +} + #endif diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c index a73eaac6de..4e8cf796d3 100644 --- a/src/shared/smack-util.c +++ b/src/shared/smack-util.c @@ -21,16 +21,21 @@ along with systemd; If not, see . ***/ -#include "smack-util.h" - #include -static int use_smack_cached = -1; +#include "smack-util.h" bool use_smack(void) { +#ifdef HAVE_SMACK + static int use_smack_cached = -1; + if (use_smack_cached < 0) - use_smack_cached = (access("/sys/fs/smackfs", F_OK) >= 0); + use_smack_cached = access("/sys/fs/smackfs/", F_OK) >= 0; return use_smack_cached; +#else + return false; +#endif + } -- cgit v1.2.3-54-g00ecf