picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

smack: rework smack APIs a bit

Browse source 
a) always return negative errno error codes
b) always become a noop if smack is off
c) always take a NULL label as a request to remove it
This commit is contained in:
Lennart Poettering 2014-10-23 18:06:51 +02:00
parent c80d766c80
commit d53e386db6
3 changed files with 81 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
src/core/socket.c
View file

@ -807,6 +807,8 @@ static void socket_close_fds(Socket *s) {
} }
static void socket_apply_socket_options(Socket *s, int fd) { static void socket_apply_socket_options(Socket *s, int fd) {
int r;
assert(s); assert(s);
assert(fd >= 0); assert(fd >= 0);
@ -894,7 +896,7 @@ static void socket_apply_socket_options(Socket *s, int fd) {
log_warning_unit(UNIT(s)->id, "IP_TOS failed: %m"); log_warning_unit(UNIT(s)->id, "IP_TOS failed: %m");
if (s->ip_ttl >= 0) { if (s->ip_ttl >= 0) {
int r, x; int x;
r = setsockopt(fd, IPPROTO_IP, IP_TTL, &s->ip_ttl, sizeof(s->ip_ttl)); r = setsockopt(fd, IPPROTO_IP, IP_TTL, &s->ip_ttl, sizeof(s->ip_ttl));
@ -920,27 +922,34 @@ static void socket_apply_socket_options(Socket *s, int fd) {
log_warning_unit(UNIT(s)->id, "SO_REUSEPORT failed: %m"); log_warning_unit(UNIT(s)->id, "SO_REUSEPORT failed: %m");
} }
if (s->smack_ip_in) if (s->smack_ip_in) {
if (mac_smack_apply_ip_in_fd(fd, s->smack_ip_in) < 0) r = mac_smack_apply_ip_in_fd(fd, s->smack_ip_in);
log_error_unit(UNIT(s)->id, "mac_smack_apply_ip_in_fd: %m"); if (r < 0)
log_error_unit(UNIT(s)->id, "mac_smack_apply_ip_in_fd: %s", strerror(-r));
}
if (s->smack_ip_out) if (s->smack_ip_out) {
if (mac_smack_apply_ip_out_fd(fd, s->smack_ip_out) < 0) r = mac_smack_apply_ip_out_fd(fd, s->smack_ip_out);
log_error_unit(UNIT(s)->id, "mac_smack_apply_ip_out_fd: %m"); if (r < 0)
log_error_unit(UNIT(s)->id, "mac_smack_apply_ip_out_fd: %s", strerror(-r));
}
} }
static void socket_apply_fifo_options(Socket *s, int fd) { static void socket_apply_fifo_options(Socket *s, int fd) {
int r;
assert(s); assert(s);
assert(fd >= 0); assert(fd >= 0);
if (s->pipe_size > 0) if (s->pipe_size > 0)
if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0) if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
log_warning_unit(UNIT(s)->id, log_warning_unit(UNIT(s)->id, "F_SETPIPE_SZ: %m");
"F_SETPIPE_SZ: %m");
if (s->smack) if (s->smack) {
if (mac_smack_apply_fd(fd, s->smack) < 0) r = mac_smack_apply_fd(fd, s->smack);
log_error_unit(UNIT(s)->id, "mac_smack_apply_fd: %m"); if (r < 0)
log_error_unit(UNIT(s)->id, "mac_smack_apply_fd: %s", strerror(-r));
}
} }
static int fifo_address_create( static int fifo_address_create(

67
src/shared/smack-util.c
View file

@ -38,54 +38,86 @@ bool mac_smack_use(void) {
#else #else
return false; return false;
#endif #endif
} }
int mac_smack_apply(const char *path, const char *label) { int mac_smack_apply(const char *path, const char *label) {
int r = 0;
assert(path);
#ifdef HAVE_SMACK #ifdef HAVE_SMACK
if (!mac_smack_use()) if (!mac_smack_use())
return 0; return 0;
if (label) if (label)
return setxattr(path, "security.SMACK64", label, strlen(label), 0); r = setxattr(path, "security.SMACK64", label, strlen(label), 0);
else else
return lremovexattr(path, "security.SMACK64"); r = lremovexattr(path, "security.SMACK64");
#else if (r < 0)
return 0; return -errno;
#endif #endif
return r;
} }
int mac_smack_apply_fd(int fd, const char *label) { int mac_smack_apply_fd(int fd, const char *label) {
int r = 0;
assert(fd >= 0);
#ifdef HAVE_SMACK #ifdef HAVE_SMACK
if (!mac_smack_use()) if (!mac_smack_use())
return 0; return 0;
return fsetxattr(fd, "security.SMACK64", label, strlen(label), 0); if (label)
#else r = fsetxattr(fd, "security.SMACK64", label, strlen(label), 0);
return 0; else
r = fremovexattr(fd, "security.SMACK64");
if (r < 0)
return -errno;
#endif #endif
return r;
} }
int mac_smack_apply_ip_out_fd(int fd, const char *label) { int mac_smack_apply_ip_out_fd(int fd, const char *label) {
int r = 0;
assert(fd >= 0);
#ifdef HAVE_SMACK #ifdef HAVE_SMACK
if (!mac_smack_use()) if (!mac_smack_use())
return 0; return 0;
return fsetxattr(fd, "security.SMACK64IPOUT", label, strlen(label), 0); if (label)
#else r = fsetxattr(fd, "security.SMACK64IPOUT", label, strlen(label), 0);
return 0; else
r = fremovexattr(fd, "security.SMACK64IPOUT");
if (r < 0)
return -errno;
#endif #endif
return r;
} }
int mac_smack_apply_ip_in_fd(int fd, const char *label) { int mac_smack_apply_ip_in_fd(int fd, const char *label) {
int r = 0;
assert(fd >= 0);
#ifdef HAVE_SMACK #ifdef HAVE_SMACK
if (!mac_smack_use()) if (!mac_smack_use())
return 0; return 0;
return fsetxattr(fd, "security.SMACK64IPIN", label, strlen(label), 0); if (label)
#else r = fsetxattr(fd, "security.SMACK64IPIN", label, strlen(label), 0);
return 0; else
r = fremovexattr(fd, "security.SMACK64IPIN");
if (r < 0)
return -errno;
#endif #endif
return r;
} }
int mac_smack_fix(const char *path) { int mac_smack_fix(const char *path) {
@ -94,6 +126,13 @@ int mac_smack_fix(const char *path) {
#ifdef HAVE_SMACK #ifdef HAVE_SMACK
struct stat sb; struct stat sb;
const char *label; const char *label;
#endif
assert(path);
#ifdef HAVE_SMACK
if (!mac_smack_use())
return 0;
/* /*
* Path must be in /dev and must exist * Path must be in /dev and must exist

10
src/udev/udev-node.c
View file

@ -294,21 +294,25 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
/* apply SECLABEL{$module}=$label */ /* apply SECLABEL{$module}=$label */
udev_list_entry_foreach(entry, udev_list_get_entry(seclabel_list)) { udev_list_entry_foreach(entry, udev_list_get_entry(seclabel_list)) {
const char *name, *label; const char *name, *label;
int r;
name = udev_list_entry_get_name(entry); name = udev_list_entry_get_name(entry);
label = udev_list_entry_get_value(entry); label = udev_list_entry_get_value(entry);
if (streq(name, "selinux")) { if (streq(name, "selinux")) {
selinux = true; selinux = true;
if (mac_selinux_apply(devnode, label) < 0) if (mac_selinux_apply(devnode, label) < 0)
log_error("SECLABEL: failed to set SELinux label '%s'", label); log_error("SECLABEL: failed to set SELinux label '%s': %s", label, strerror(-r));
else else
log_debug("SECLABEL: set SELinux label '%s'", label); log_debug("SECLABEL: set SELinux label '%s'", label);
} else if (streq(name, "smack")) { } else if (streq(name, "smack")) {
smack = true; smack = true;
if (mac_smack_apply(devnode, label) < 0)
log_error("SECLABEL: failed to set SMACK label '%s'", label); r = mac_smack_apply(devnode, label);
if (r < 0)
log_error("SECLABEL: failed to set SMACK label '%s': %s", label, strerror(-r));
else else
log_debug("SECLABEL: set SMACK label '%s'", label); log_debug("SECLABEL: set SMACK label '%s'", label);