picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

smack: handling smack onlycap list (#5542)

Browse source 
To support smack onlycap, read onlycap list from /etc/smack/onlycap and write
to /sys/fs/smackfs/onlycap.

https://lwn.net/Articles/292128/
http://lkml.iu.edu/hypermail/linux/kernel/1505.2/04718.html
http://schaufler-ca.com/description_from_the_linux_source_tree
This commit is contained in:
WaLyong Cho 2017-06-27 04:00:03 +09:00 committed by Lennart Poettering
parent b1d25c25e1
commit 217f95db7b
1 changed files with 64 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

64
src/core/smack-setup.c
View file

@ -264,6 +264,54 @@ static int write_netlabel_rules(const char* srcdir) {
return r;
}
static int write_onlycap_list(void) {
_cleanup_close_ int onlycap_fd = -1;
_cleanup_free_ char *list = NULL;
_cleanup_fclose_ FILE *f = NULL;
size_t len = 0, allocated = 0;
char buf[LINE_MAX];
int r;
f = fopen("/etc/smack/onlycap", "re");
if (!f) {
if (errno != ENOENT)
log_warning_errno(errno, "Failed to read '/etc/smack/onlycap'");
return errno == ENOENT ? ENOENT : -errno;
}
FOREACH_LINE(buf, f, return -errno) {
size_t l;
if (isempty(truncate_nl(buf)) || strchr(COMMENTS, *buf))
continue;
l = strlen(buf);
if (!GREEDY_REALLOC(list, allocated, len + l + 1))
return log_oom();
stpcpy(list + len, buf)[0] = ' ';
len += l + 1;
}
if (!len)
return 0;
list[len - 1] = 0;
onlycap_fd = open("/sys/fs/smackfs/onlycap", O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
if (onlycap_fd < 0) {
if (errno != ENOENT)
log_warning_errno(errno, "Failed to open '/sys/fs/smackfs/onlycap'");
return -errno; /* negative error */
}
r = write(onlycap_fd, list, len);
if (r < 0)
return log_error_errno(errno, "Failed to write onlycap list(%s) to '/sys/fs/smackfs/onlycap'", list);
return 0;
}
#endif
int mac_smack_setup(bool *loaded_policy) {
@ -338,6 +386,22 @@ int mac_smack_setup(bool *loaded_policy) {
break;
}
r = write_onlycap_list();
switch(r) {
case -ENOENT:
log_debug("Smack is not enabled in the kernel.");
break;
case ENOENT:
log_debug("Smack onlycap list file '/etc/smack/onlycap' not found");
break;
case 0:
log_info("Successfully wrote Smack onlycap list.");
break;
default:
log_emergency_errno(r, "Failed to write Smack onlycap list.");
return r;
}
*loaded_policy = true;
#endif