src/selinux.c

   1 /* selinux - core functions for maintaining SELinux labeling
   2    Copyright (C) 2012-2024 Free Software Foundation, Inc.
   3
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation, either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  16
  17 /* Written by Daniel Walsh <dwalsh@redhat.com> */
  18
  19 #include <config.h>
  20 #include <selinux/label.h>
  21 #include <selinux/context.h>
  22 #include <sys/types.h>
  23
  24 #include "system.h"
  25 #include "canonicalize.h"
  26 #include "xfts.h"
  27 #include "selinux.h"
  28
  29 #if HAVE_SELINUX_LABEL_H
  30
  31 # if ! HAVE_MODE_TO_SECURITY_CLASS
  32 /*
  33   This function has been added to libselinux-2.1.12-5, but is here
  34   for support with older versions of SELinux
  35
  36   Translates a mode into an Internal SELinux security_class definition.
  37   Returns 0 on failure, with errno set to EINVAL.
  38 */
  39 static security_class_t
  40 mode_to_security_class (mode_t m)
  41 {
  42
  43   if (S_ISREG (m))
  44     return string_to_security_class ("file");
  45   if (S_ISDIR (m))
  46     return string_to_security_class ("dir");
  47   if (S_ISCHR (m))
  48     return string_to_security_class ("chr_file");
  49   if (S_ISBLK (m))
  50     return string_to_security_class ("blk_file");
  51   if (S_ISFIFO (m))
  52     return string_to_security_class ("fifo_file");
  53   if (S_ISLNK (m))
  54     return string_to_security_class ("lnk_file");
  55   if (S_ISSOCK (m))
  56     return string_to_security_class ("sock_file");
  57
  58   errno = EINVAL;
  59   return 0;
  60 }
  61 # endif
  62
  63 /*
  64   This function takes a PATH and a MODE and then asks SELinux what the label
  65   of the path object would be if the current process label created it.
  66   It then returns the label.
  67
  68   Returns -1 on failure.  errno will be set appropriately.
  69 */
  70
  71 static int
  72 computecon_raw (char const *path, mode_t mode, char **con)
  73 {
  74   char *scon_raw = nullptr;
  75   char *tcon_raw = nullptr;
  76   security_class_t tclass;
  77   int rc = -1;
  78
  79   char *dir = dir_name (path);
  80   if (!dir)
  81     goto quit;
  82   if (getcon_raw (&scon_raw) < 0)
  83     goto quit;
  84   if (getfilecon_raw (dir, &tcon_raw) < 0)
  85     goto quit;
  86   tclass = mode_to_security_class (mode);
  87   if (!tclass)
  88     goto quit;
  89   rc = security_compute_create_raw (scon_raw, tcon_raw, tclass, con);
  90
  91  quit:;
  92   int err = errno;
  93   free (dir);
  94   freecon (scon_raw);
  95   freecon (tcon_raw);
  96   errno = err;
  97   return rc;
  98 }
  99
 100 /*
 101   This function takes a handle, path and mode, it calls computecon_raw to get
 102   the label of the path object if the current process created it, then it calls
 103   selabel_lookup to get the default type for the object.  It substitutes the
 104   default type into label.  It tells the SELinux Kernel to label all new file
 105   system objects created by the current process with this label.
 106
 107   Returns -1 on failure.  errno will be set appropriately.
 108 */
 109 int
 110 defaultcon (struct selabel_handle *selabel_handle,
 111             char const *path, mode_t mode)
 112 {
 113   int rc = -1;
 114   char *scon_raw = nullptr;
 115   char *tcon_raw = nullptr;
 116   context_t scontext = 0, tcontext = 0;
 117   char const *contype;
 118   char const *constr;
 119   char *newpath = nullptr;
 120
 121   if (! IS_ABSOLUTE_FILE_NAME (path))
 122     {
 123       /* Generate absolute name as required by subsequent selabel_lookup.  */
 124       newpath = canonicalize_filename_mode (path, CAN_MISSING);
 125       if (! newpath)
 126         goto quit;
 127       path = newpath;
 128     }
 129
 130   if (selabel_lookup_raw (selabel_handle, &scon_raw, path, mode) < 0)
 131     {
 132       /* "No such file or directory" is a confusing error,
 133          when processing files, when in fact it was the
 134          associated default context that was not found.
 135          Therefore map the error to something more appropriate
 136          to the context in which we're using selabel_lookup().  */
 137       if (errno == ENOENT)
 138         errno = ENODATA;
 139       goto quit;
 140     }
 141   if (computecon_raw (path, mode, &tcon_raw) < 0)
 142     goto quit;
 143   if (!(scontext = context_new (scon_raw)))
 144     goto quit;
 145   if (!(tcontext = context_new (tcon_raw)))
 146     goto quit;
 147
 148   if (!(contype = context_type_get (scontext)))
 149     goto quit;
 150   if (context_type_set (tcontext, contype))
 151     goto quit;
 152   if (!(constr = context_str (tcontext)))
 153     goto quit;
 154
 155   rc = setfscreatecon_raw (constr);
 156
 157  quit:;
 158   int err = errno;
 159   context_free (scontext);
 160   context_free (tcontext);
 161   freecon (scon_raw);
 162   freecon (tcon_raw);
 163   free (newpath);
 164   errno = err;
 165   return rc;
 166 }
 167
 168 /*
 169   If SELABEL_HANDLE is null, set PATH's label to the default to the
 170   local process.  Otherwise use selabel_lookup to determine the
 171   default label, extract the type field and then modify the file
 172   system object.  Note only the type field is updated, thus preserving MLS
 173   levels and user identity etc. of the PATH.
 174
 175   Returns -1 on failure.  errno will be set appropriately.
 176 */
 177 static int
 178 restorecon_private (struct selabel_handle *selabel_handle, char const *path)
 179 {
 180   int rc = -1;
 181   struct stat sb;
 182   char *scon_raw = nullptr;
 183   char *tcon_raw = nullptr;
 184   context_t scontext = 0, tcontext = 0;
 185   char const *contype;
 186   char const *constr;
 187   int fd;
 188
 189   if (!selabel_handle)
 190     {
 191       if (getfscreatecon_raw (&tcon_raw) < 0)
 192         return rc;
 193       if (!tcon_raw)
 194         {
 195           errno = ENODATA;
 196           return rc;
 197         }
 198       rc = lsetfilecon_raw (path, tcon_raw);
 199       int err = errno;
 200       freecon (tcon_raw);
 201       errno = err;
 202       return rc;
 203     }
 204
 205   fd = open (path, O_RDONLY | O_NOFOLLOW);
 206   if (fd == -1 && (errno != ELOOP))
 207     goto quit;
 208
 209   if (fd != -1)
 210     {
 211       if (fstat (fd, &sb) < 0)
 212         goto quit;
 213     }
 214   else
 215     {
 216       if (lstat (path, &sb) < 0)
 217         goto quit;
 218     }
 219
 220   if (selabel_lookup_raw (selabel_handle, &scon_raw, path, sb.st_mode) < 0)
 221     {
 222       /* "No such file or directory" is a confusing error,
 223          when processing files, when in fact it was the
 224          associated default context that was not found.
 225          Therefore map the error to something more appropriate
 226          to the context in which we're using selabel_lookup.  */
 227       if (errno == ENOENT)
 228         errno = ENODATA;
 229       goto quit;
 230     }
 231   if (!(scontext = context_new (scon_raw)))
 232     goto quit;
 233
 234   if (fd != -1)
 235     {
 236       if (fgetfilecon_raw (fd, &tcon_raw) < 0)
 237         goto quit;
 238     }
 239   else
 240     {
 241       if (lgetfilecon_raw (path, &tcon_raw) < 0)
 242         goto quit;
 243     }
 244
 245   if (!(tcontext = context_new (tcon_raw)))
 246     goto quit;
 247
 248   if (!(contype = context_type_get (scontext)))
 249     goto quit;
 250   if (context_type_set (tcontext, contype))
 251     goto quit;
 252   if (!(constr = context_str (tcontext)))
 253     goto quit;
 254
 255   if (fd != -1)
 256     rc = fsetfilecon_raw (fd, constr);
 257   else
 258     rc = lsetfilecon_raw (path, constr);
 259
 260  quit:;
 261   int err = errno;
 262   if (fd != -1)
 263     close (fd);
 264   context_free (scontext);
 265   context_free (tcontext);
 266   freecon (scon_raw);
 267   freecon (tcon_raw);
 268   errno = err;
 269   return rc;
 270 }
 271
 272 /*
 273   This function takes three parameters:
 274
 275   SELABEL_HANDLE for selabel_lookup, or null to preserve.
 276
 277   PATH of an existing file system object.
 278
 279   A RECURSE boolean which if the file system object is a directory, will
 280   call restorecon_private on every file system object in the directory.
 281
 282   Return false on failure.  errno will be set appropriately.
 283 */
 284 bool
 285 restorecon (struct selabel_handle *selabel_handle,
 286             char const *path, bool recurse)
 287 {
 288   char *newpath = nullptr;
 289
 290   if (! IS_ABSOLUTE_FILE_NAME (path))
 291     {
 292       /* Generate absolute name as required by subsequent selabel_lookup.
 293          When RECURSE, this also generates absolute names in the
 294          fts entries, which may be quicker to process in any case.  */
 295       newpath = canonicalize_filename_mode (path, CAN_MISSING);
 296       if (! newpath)
 297         return false;
 298       path = newpath;
 299     }
 300
 301   if (! recurse)
 302     {
 303       bool ok = restorecon_private (selabel_handle, path) != -1;
 304       int err = errno;
 305       free (newpath);
 306       errno = err;
 307       return ok;
 308     }
 309
 310   char const *ftspath[2] = { path, nullptr };
 311   FTS *fts = xfts_open ((char *const *) ftspath, FTS_PHYSICAL, nullptr);
 312
 313   int err = 0;
 314   for (FTSENT *ent; (ent = fts_read (fts)); )
 315     if (restorecon_private (selabel_handle, fts->fts_path) < 0)
 316       err = errno;
 317
 318   if (errno != 0)
 319     err = errno;
 320
 321   if (fts_close (fts) != 0)
 322     err = errno;
 323
 324   free (newpath);
 325   return !err;
 326 }
 327 #endif