Darren Tucker | f60845f | 2013-06-02 08:07:31 +1000 | [diff] [blame] | 1 | /* $Id: port-linux.c,v 1.18 2013/06/01 22:07:32 dtucker Exp $ */ |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 2 | |
| 3 | /* |
| 4 | * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> |
| 5 | * Copyright (c) 2006 Damien Miller <djm@openbsd.org> |
| 6 | * |
| 7 | * Permission to use, copy, modify, and distribute this software for any |
| 8 | * purpose with or without fee is hereby granted, provided that the above |
| 9 | * copyright notice and this permission notice appear in all copies. |
| 10 | * |
| 11 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 12 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 13 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| 14 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 15 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| 16 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| 17 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 18 | */ |
| 19 | |
| 20 | /* |
| 21 | * Linux-specific portability code - just SELinux support at present |
| 22 | */ |
| 23 | |
| 24 | #include "includes.h" |
| 25 | |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 26 | #if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) |
Damien Miller | b8fe89c | 2006-07-24 14:51:00 +1000 | [diff] [blame] | 27 | #include <errno.h> |
Damien Miller | ded319c | 2006-09-01 15:38:36 +1000 | [diff] [blame] | 28 | #include <stdarg.h> |
Damien Miller | b8fe89c | 2006-07-24 14:51:00 +1000 | [diff] [blame] | 29 | #include <string.h> |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 30 | #include <stdio.h> |
Damien Miller | b8fe89c | 2006-07-24 14:51:00 +1000 | [diff] [blame] | 31 | |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 32 | #include "log.h" |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 33 | #include "xmalloc.h" |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 34 | #include "port-linux.h" |
| 35 | |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 36 | #ifdef WITH_SELINUX |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 37 | #include <selinux/selinux.h> |
| 38 | #include <selinux/flask.h> |
| 39 | #include <selinux/get_context_list.h> |
| 40 | |
Damien Miller | 58ac11a | 2011-08-29 16:09:52 +1000 | [diff] [blame] | 41 | #ifndef SSH_SELINUX_UNCONFINED_TYPE |
| 42 | # define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:" |
| 43 | #endif |
| 44 | |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 45 | /* Wrapper around is_selinux_enabled() to log its return value once only */ |
Darren Tucker | b8eb586 | 2008-03-27 07:27:20 +1100 | [diff] [blame] | 46 | int |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 47 | ssh_selinux_enabled(void) |
| 48 | { |
| 49 | static int enabled = -1; |
| 50 | |
| 51 | if (enabled == -1) { |
Darren Tucker | 50e3bab | 2010-09-10 10:30:25 +1000 | [diff] [blame] | 52 | enabled = (is_selinux_enabled() == 1); |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 53 | debug("SELinux support %s", enabled ? "enabled" : "disabled"); |
| 54 | } |
| 55 | |
| 56 | return (enabled); |
| 57 | } |
| 58 | |
| 59 | /* Return the default security context for the given username */ |
| 60 | static security_context_t |
| 61 | ssh_selinux_getctxbyname(char *pwname) |
| 62 | { |
Damien Miller | 7bf7b88 | 2012-03-09 10:25:16 +1100 | [diff] [blame] | 63 | security_context_t sc = NULL; |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 64 | char *sename = NULL, *lvl = NULL; |
| 65 | int r; |
| 66 | |
| 67 | #ifdef HAVE_GETSEUSERBYNAME |
| 68 | if (getseuserbyname(pwname, &sename, &lvl) != 0) |
| 69 | return NULL; |
| 70 | #else |
| 71 | sename = pwname; |
| 72 | lvl = NULL; |
| 73 | #endif |
| 74 | |
| 75 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL |
| 76 | r = get_default_context_with_level(sename, lvl, NULL, &sc); |
| 77 | #else |
| 78 | r = get_default_context(sename, NULL, &sc); |
| 79 | #endif |
| 80 | |
| 81 | if (r != 0) { |
| 82 | switch (security_getenforce()) { |
| 83 | case -1: |
| 84 | fatal("%s: ssh_selinux_getctxbyname: " |
| 85 | "security_getenforce() failed", __func__); |
| 86 | case 0: |
| 87 | error("%s: Failed to get default SELinux security " |
| 88 | "context for %s", __func__, pwname); |
Damien Miller | 7bf7b88 | 2012-03-09 10:25:16 +1100 | [diff] [blame] | 89 | sc = NULL; |
Damien Miller | 0d7b934 | 2007-06-28 08:48:02 +1000 | [diff] [blame] | 90 | break; |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 91 | default: |
| 92 | fatal("%s: Failed to get default SELinux security " |
| 93 | "context for %s (in enforcing mode)", |
| 94 | __func__, pwname); |
| 95 | } |
| 96 | } |
| 97 | |
| 98 | #ifdef HAVE_GETSEUSERBYNAME |
Darren Tucker | f60845f | 2013-06-02 08:07:31 +1000 | [diff] [blame] | 99 | free(sename); |
| 100 | free(lvl); |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 101 | #endif |
| 102 | |
Damien Miller | 7bf7b88 | 2012-03-09 10:25:16 +1100 | [diff] [blame] | 103 | return sc; |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 104 | } |
| 105 | |
| 106 | /* Set the execution context to the default for the specified user */ |
| 107 | void |
| 108 | ssh_selinux_setup_exec_context(char *pwname) |
| 109 | { |
| 110 | security_context_t user_ctx = NULL; |
| 111 | |
| 112 | if (!ssh_selinux_enabled()) |
| 113 | return; |
| 114 | |
| 115 | debug3("%s: setting execution context", __func__); |
| 116 | |
| 117 | user_ctx = ssh_selinux_getctxbyname(pwname); |
| 118 | if (setexeccon(user_ctx) != 0) { |
| 119 | switch (security_getenforce()) { |
| 120 | case -1: |
| 121 | fatal("%s: security_getenforce() failed", __func__); |
| 122 | case 0: |
| 123 | error("%s: Failed to set SELinux execution " |
| 124 | "context for %s", __func__, pwname); |
Damien Miller | 0d7b934 | 2007-06-28 08:48:02 +1000 | [diff] [blame] | 125 | break; |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 126 | default: |
| 127 | fatal("%s: Failed to set SELinux execution context " |
| 128 | "for %s (in enforcing mode)", __func__, pwname); |
| 129 | } |
| 130 | } |
| 131 | if (user_ctx != NULL) |
| 132 | freecon(user_ctx); |
| 133 | |
| 134 | debug3("%s: done", __func__); |
| 135 | } |
| 136 | |
| 137 | /* Set the TTY context for the specified user */ |
| 138 | void |
| 139 | ssh_selinux_setup_pty(char *pwname, const char *tty) |
| 140 | { |
| 141 | security_context_t new_tty_ctx = NULL; |
| 142 | security_context_t user_ctx = NULL; |
| 143 | security_context_t old_tty_ctx = NULL; |
| 144 | |
| 145 | if (!ssh_selinux_enabled()) |
| 146 | return; |
| 147 | |
| 148 | debug3("%s: setting TTY context on %s", __func__, tty); |
| 149 | |
| 150 | user_ctx = ssh_selinux_getctxbyname(pwname); |
| 151 | |
| 152 | /* XXX: should these calls fatal() upon failure in enforcing mode? */ |
| 153 | |
| 154 | if (getfilecon(tty, &old_tty_ctx) == -1) { |
| 155 | error("%s: getfilecon: %s", __func__, strerror(errno)); |
| 156 | goto out; |
| 157 | } |
| 158 | |
| 159 | if (security_compute_relabel(user_ctx, old_tty_ctx, |
| 160 | SECCLASS_CHR_FILE, &new_tty_ctx) != 0) { |
| 161 | error("%s: security_compute_relabel: %s", |
| 162 | __func__, strerror(errno)); |
| 163 | goto out; |
| 164 | } |
| 165 | |
| 166 | if (setfilecon(tty, new_tty_ctx) != 0) |
| 167 | error("%s: setfilecon: %s", __func__, strerror(errno)); |
| 168 | out: |
| 169 | if (new_tty_ctx != NULL) |
| 170 | freecon(new_tty_ctx); |
| 171 | if (old_tty_ctx != NULL) |
| 172 | freecon(old_tty_ctx); |
| 173 | if (user_ctx != NULL) |
| 174 | freecon(user_ctx); |
| 175 | debug3("%s: done", __func__); |
| 176 | } |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 177 | |
| 178 | void |
| 179 | ssh_selinux_change_context(const char *newname) |
| 180 | { |
| 181 | int len, newlen; |
| 182 | char *oldctx, *newctx, *cx; |
Damien Miller | 58ac11a | 2011-08-29 16:09:52 +1000 | [diff] [blame] | 183 | void (*switchlog) (const char *fmt,...) = logit; |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 184 | |
| 185 | if (!ssh_selinux_enabled()) |
| 186 | return; |
| 187 | |
| 188 | if (getcon((security_context_t *)&oldctx) < 0) { |
Damien Miller | 58ac11a | 2011-08-29 16:09:52 +1000 | [diff] [blame] | 189 | logit("%s: getcon failed with %s", __func__, strerror(errno)); |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 190 | return; |
| 191 | } |
| 192 | if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) == |
| 193 | NULL) { |
| 194 | logit ("%s: unparseable context %s", __func__, oldctx); |
| 195 | return; |
| 196 | } |
| 197 | |
Damien Miller | 58ac11a | 2011-08-29 16:09:52 +1000 | [diff] [blame] | 198 | /* |
| 199 | * Check whether we are attempting to switch away from an unconfined |
| 200 | * security context. |
| 201 | */ |
| 202 | if (strncmp(cx, SSH_SELINUX_UNCONFINED_TYPE, |
| 203 | sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0) |
| 204 | switchlog = debug3; |
| 205 | |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 206 | newlen = strlen(oldctx) + strlen(newname) + 1; |
| 207 | newctx = xmalloc(newlen); |
| 208 | len = cx - oldctx + 1; |
| 209 | memcpy(newctx, oldctx, len); |
| 210 | strlcpy(newctx + len, newname, newlen - len); |
| 211 | if ((cx = index(cx + 1, ':'))) |
| 212 | strlcat(newctx, cx, newlen); |
Damien Miller | 58ac11a | 2011-08-29 16:09:52 +1000 | [diff] [blame] | 213 | debug3("%s: setting context from '%s' to '%s'", __func__, |
| 214 | oldctx, newctx); |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 215 | if (setcon(newctx) < 0) |
Damien Miller | 58ac11a | 2011-08-29 16:09:52 +1000 | [diff] [blame] | 216 | switchlog("%s: setcon %s from %s failed with %s", __func__, |
| 217 | newctx, oldctx, strerror(errno)); |
Darren Tucker | f60845f | 2013-06-02 08:07:31 +1000 | [diff] [blame] | 218 | free(oldctx); |
| 219 | free(newctx); |
Darren Tucker | 4d6656b | 2009-10-24 15:04:12 +1100 | [diff] [blame] | 220 | } |
Damien Miller | 71adf12 | 2011-01-25 12:16:15 +1100 | [diff] [blame] | 221 | |
| 222 | void |
| 223 | ssh_selinux_setfscreatecon(const char *path) |
| 224 | { |
Damien Miller | d4a5504 | 2011-01-28 10:30:18 +1100 | [diff] [blame] | 225 | security_context_t context; |
Damien Miller | 71adf12 | 2011-01-25 12:16:15 +1100 | [diff] [blame] | 226 | |
Damien Miller | d4a5504 | 2011-01-28 10:30:18 +1100 | [diff] [blame] | 227 | if (!ssh_selinux_enabled()) |
| 228 | return; |
Darren Tucker | 3b9617e | 2011-02-06 13:24:35 +1100 | [diff] [blame] | 229 | if (path == NULL) { |
Damien Miller | d4a5504 | 2011-01-28 10:30:18 +1100 | [diff] [blame] | 230 | setfscreatecon(NULL); |
| 231 | return; |
| 232 | } |
| 233 | if (matchpathcon(path, 0700, &context) == 0) |
Damien Miller | 71adf12 | 2011-01-25 12:16:15 +1100 | [diff] [blame] | 234 | setfscreatecon(context); |
| 235 | } |
| 236 | |
Damien Miller | 73b42d2 | 2006-04-22 21:26:08 +1000 | [diff] [blame] | 237 | #endif /* WITH_SELINUX */ |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 238 | |
| 239 | #ifdef LINUX_OOM_ADJUST |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 240 | /* |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 241 | * The magic "don't kill me" values, old and new, as documented in eg: |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 242 | * http://lxr.linux.no/#linux+v2.6.32/Documentation/filesystems/proc.txt |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 243 | * http://lxr.linux.no/#linux+v2.6.36/Documentation/filesystems/proc.txt |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 244 | */ |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 245 | |
| 246 | static int oom_adj_save = INT_MIN; |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 247 | static char *oom_adj_path = NULL; |
| 248 | struct { |
| 249 | char *path; |
| 250 | int value; |
| 251 | } oom_adjust[] = { |
| 252 | {"/proc/self/oom_score_adj", -1000}, /* kernels >= 2.6.36 */ |
| 253 | {"/proc/self/oom_adj", -17}, /* kernels <= 2.6.35 */ |
| 254 | {NULL, 0}, |
| 255 | }; |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 256 | |
| 257 | /* |
| 258 | * Tell the kernel's out-of-memory killer to avoid sshd. |
| 259 | * Returns the previous oom_adj value or zero. |
| 260 | */ |
| 261 | void |
| 262 | oom_adjust_setup(void) |
| 263 | { |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 264 | int i, value; |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 265 | FILE *fp; |
| 266 | |
| 267 | debug3("%s", __func__); |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 268 | for (i = 0; oom_adjust[i].path != NULL; i++) { |
| 269 | oom_adj_path = oom_adjust[i].path; |
| 270 | value = oom_adjust[i].value; |
| 271 | if ((fp = fopen(oom_adj_path, "r+")) != NULL) { |
| 272 | if (fscanf(fp, "%d", &oom_adj_save) != 1) |
| 273 | verbose("error reading %s: %s", oom_adj_path, |
| 274 | strerror(errno)); |
| 275 | else { |
| 276 | rewind(fp); |
| 277 | if (fprintf(fp, "%d\n", value) <= 0) |
| 278 | verbose("error writing %s: %s", |
| 279 | oom_adj_path, strerror(errno)); |
| 280 | else |
| 281 | verbose("Set %s from %d to %d", |
| 282 | oom_adj_path, oom_adj_save, value); |
| 283 | } |
| 284 | fclose(fp); |
| 285 | return; |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 286 | } |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 287 | } |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 288 | oom_adj_path = NULL; |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 289 | } |
| 290 | |
| 291 | /* Restore the saved OOM adjustment */ |
| 292 | void |
| 293 | oom_adjust_restore(void) |
| 294 | { |
| 295 | FILE *fp; |
| 296 | |
| 297 | debug3("%s", __func__); |
Darren Tucker | 263d43d | 2011-01-17 18:50:22 +1100 | [diff] [blame] | 298 | if (oom_adj_save == INT_MIN || oom_adj_path == NULL || |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 299 | (fp = fopen(oom_adj_path, "w")) == NULL) |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 300 | return; |
| 301 | |
| 302 | if (fprintf(fp, "%d\n", oom_adj_save) <= 0) |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 303 | verbose("error writing %s: %s", oom_adj_path, strerror(errno)); |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 304 | else |
Darren Tucker | 0c93adc | 2011-01-17 11:55:59 +1100 | [diff] [blame] | 305 | verbose("Set %s to %d", oom_adj_path, oom_adj_save); |
Darren Tucker | c8802aa | 2009-12-08 13:39:48 +1100 | [diff] [blame] | 306 | |
| 307 | fclose(fp); |
| 308 | return; |
| 309 | } |
| 310 | #endif /* LINUX_OOM_ADJUST */ |
| 311 | #endif /* WITH_SELINUX || LINUX_OOM_ADJUST */ |