summaryrefslogtreecommitdiff
path: root/src/core/selinux-access.c
Commit message (Collapse)AuthorAgeFilesLines
* selinux: accept the fact that getxyzcon() can return success and NULLLennart Poettering2022-12-071-3/+7
| | | | | | | | | | | | Inspired by #25664: let's check explicitly for NULL everywhere we do one of those getXYZcon() calls. We usually turn this into EOPNOTSUPP, as when selinux is off (which is supposed to be the only case this can happen according to selinux docs) we otherwise return EOPNOTSUPP in that case. Note that in most cases we have an explicit mac_selinux_use() call beforehand, hence this should mostly not be triggerable codepaths.
* basic: rename util.h to logarithm.hZbigniew Jędrzejewski-Szmek2022-11-081-1/+0
| | | | | util.h is now about logarithms only, so we can rename it. Many files included util.h for no apparent reason… Those includes are dropped.
* core: update audit messagesChristian Göttsche2022-11-051-2/+2
| | | | | Pass getuid() instead of literal `0` as auid, since user session managers also issue audit messages on SELinux denials.
* core,logind,systemctl,journald: replace calls to strerror() with setting ↵Zbigniew Jędrzejewski-Szmek2022-10-111-12/+10
| | | | | | | | | | | | | errno + %m strerror() is not thread safe and calling it just isn't worth the effort required to justify why it would be safe in those cases. It's easier to just use %m which is thread-safe out of the box. I don't think that any of the changes in the patch cause any functional difference. This is just about getting rid of calls to strerror() in general. When we print an error message and fail to format the string, using something like "(null)" is good enough. This is very very unlikely to happen anyway.
* selinux: include precise low-level error string in returned D-Bus errorsLennart Poettering2022-07-201-3/+3
|
* core: cache unit file selinux label, and make decisions based on thatLennart Poettering2022-07-201-29/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not go back to disk on each selinux access, but instead cache the label off the inode we are actually reading. That way unit file contents and unit file label we use for access checks are always in sync. Based on discussions here: https://github.com/systemd/systemd/pull/10023#issuecomment-1179835586 Replaces: https://github.com/systemd/systemd/pull/23910 This changes behaviour a bit, because we'll reach and cache the label at the moment of loading the unit (i.e. usually on boot and reload), but not after relabelling. Thus, users must refresh the cache explicitly via a "systemctl daemon-reload" if they relabelled things. This makes the SELinux story a bit more debuggable, as it adds an AccessSELinuxContext bus property to units that will report the label we are using for a unit (or the empty string if not known). This also drops using the "source" path of a unit as label source. if there's value in it, then generators should manually copy the selinux label from the source files onto the generated unit files, so that the rule that "access labels are read when we read the definition files" is upheld. But I am not convinced this is really a necessary, good idea.
* tree-wide: add a space after if, switch, for, and whileYu Watanabe2022-04-011-1/+1
|
* selinux: name mac_selinux_generic_access_check as internal functionChristian Göttsche2021-11-201-2/+2
| | | | | | `mac_selinux_generic_access_check()` should not be called directly, only via the wrapper macros `mac_selinux_access_check` and `mac_selinux_unit_access_check`.
* selinux: improve debug log formatChristian Göttsche2021-11-201-1/+1
| | | | | | | | path might be NULL when checking against the system permissions, so wrap with strna(). The command line might not be available over D-Bus and thus cl might be empty. Print "n/a" instead of the empty string.
* selinux: add function name to audit dataChristian Göttsche2021-11-201-4/+10
| | | | | | Include the systemd C function name in the audit message to improve the debug ability on denials. Similar like kernel denial messages include the syscall name.
* tree-wide: use C99 __func__ rather than obsolete __FUNCTION__Lennart Poettering2021-10-111-1/+1
| | | | | We use __func__ almost everywhere, but there are some holdouts. Fix that.
* tree-wide: voidify unchecked snprintf callsLuca Boccassi2021-08-201-5/+5
| | | | | | | | | | | | | | | According to Coverity, 194 ouf of 227 times we check for snprintf return code. Voidify the rest. CID#1461512 CID#1461513 CID#1461514 CID#1461515 CID#1461516 CID#1461518 CID#1461519 CID#1461520 CID#1461522
* selinux: invoke selinux_set_callback(3) more type-safeChristian Göttsche2021-05-141-2/+2
|
* core/selinux: fix wrong assertion when 0 is passed to log_debugZbigniew Jędrzejewski-Szmek2021-04-151-2/+3
| | | | https://github.com/systemd/systemd/pull/19317#issuecomment-820245680
* tree-wide: sd_bus_error_setf → set_bus_error_setZbigniew Jędrzejewski-Szmek2021-04-071-2/+2
| | | | strdup() is more efficient than asprintf().
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* selinux: use SELinux status pageChristian Göttsche2020-08-271-3/+3
| | | | | | | | | | Switch from security_getenforce() and netlink notifications to the SELinux status page. This usage saves system calls and will also be the default in libselinux > 3.1 [1]. [1]: https://github.com/SELinuxProject/selinux/commit/05bdc03130d741e53e1fb45a958d0a2c184be503
* Revert "selinux: cache enforced status and treat retrieve failure as ↵Lennart Poettering2020-07-161-2/+3
| | | | | | enforced mode" This reverts commit 257188f80ce1a083e3a88b679b898a73fecab53b.
* tree-wide: use DISABLE_WARNING_FORMAT_NONLITERAL where appropriateLennart Poettering2020-05-251-3/+3
|
* selinux: add parenthesis to function names in log messagesChristian Göttsche2020-05-141-2/+2
|
* selinux: print enforcing state in access check debug messageChristian Göttsche2020-03-271-2/+2
|
* selinux: delay mac_selinux_enforcing call after SELinux was determined to be ↵Christian Göttsche2020-03-191-1/+4
| | | | | | | | | | enabled Calling `mac_selinux_enforcing()`, which calls `security_getenforce()`, on a SELinux disabled system causes the following error message to be printed: Failed to get SELinux enforced status: No such file or directory Fixes: 257188f80ce1a083e3a88b679b898a73fecab53b ("selinux: cache enforced status and treat retrieve failure as enforced mode") Supersedes: #15145
* selinux: cache enforced status and treat retrieve failure as enforced modeChristian Göttsche2020-03-031-8/+5
|
* core/selinux-access: use _cleanup_ and improve loggingZbigniew Jędrzejewski-Szmek2020-02-061-28/+41
| | | | | | Instead of setting the bus error structure and then freeing it, let's only set it if used. If we will ignore the selinux denial, say ", ignore" to make this clear. Also, use _cleanup_ to avoid gotos.
* core/selinux-access: do not use NULL for %sZbigniew Jędrzejewski-Szmek2020-02-061-3/+3
| | | | | | | | | | | | ../src/core/selinux-access.c: In function ‘mac_selinux_generic_access_check’: ../src/basic/log.h:223:27: error: ‘%s’ directive argument is null [-Werror=format-overflow=] ../src/core/selinux-access.c:235:85: note: format string is defined here 235 | log_warning_errno(errno, "SELinux getcon_raw failed (tclass=%s perm=%s): %m", tclass, permission); | ^~ I wonder why nobody ever noticed this. Fixes #14691 (other issues listed in that ticket have already been fixed).
* selinux: update log message to suppress warning by coverityYu Watanabe2020-02-061-2/+2
| | | | Fixes CID#1417440 and CID#1417438.
* selinux-access: log warning on context acquisition failureChristian Göttsche2020-02-041-0/+2
| | | | | Relevant when testing in permissive mode, where the function does not return a failure to the client. This helps to configure a system in permissive mode, without getting surprising failures when switching to enforced mode.
* tree-wide: drop stdio.h when stdio-util.h is includedYu Watanabe2019-11-041-1/+0
|
* Merge pull request #12926 from keszybz/urlify-logsLennart Poettering2019-07-111-1/+1
|\ | | | | Urlify CONFIG_FILE and improve SYSTEMD_LOG_LOCATION
| * tree-wide: use PROJECT_FILE instead of __FILE__Zbigniew Jędrzejewski-Szmek2019-07-041-1/+1
| | | | | | | | This replaces the internal uses of __FILE__ with the new macro.
* | tree-wide: introduce strerror_safe()Yu Watanabe2019-07-051-1/+2
|/
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+1
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to auditMichal Sekletar2019-02-271-1/+5
| | | | | | | | | | | | | | | | | Previously we logged even info message from libselinux as USER_AVC's to audit. For example, setting SELinux to permissive mode generated following audit message, time->Tue Feb 26 11:29:29 2019 type=USER_AVC msg=audit(1551198569.423:334): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: received setenforce notice (enforcing=0) exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' This is unnecessary and wrong at the same time. First, kernel already records audit event that SELinux was switched to permissive mode, also the type of the message really shouldn't be USER_AVC. Let's ignore SELINUX_WARNING and SELINUX_INFO and forward to audit only USER_AVC's and errors as these two libselinux message types have clear mapping to audit message types.
* tree-wide: drop copyright lines for more authorsZbigniew Jędrzejewski-Szmek2018-06-221-3/+0
| | | | Acks in https://github.com/systemd/systemd/issues/9320.
* tree-wide: beautify remaining copyright statementsLennart Poettering2018-06-141-1/+1
| | | | | | Let's unify an beautify our remaining copyright statements, with a unicode ©. This means our copyright statements are now always formatted the same way. Yay.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* build-sys: use #if Y instead of #ifdef Y everywhereZbigniew Jędrzejewski-Szmek2017-10-041-3/+3
| | | | | | | | | | | | | | | The advantage is that is the name is mispellt, cpp will warn us. $ git grep -Ee "conf.set\('(HAVE|ENABLE)_" -l|xargs sed -r -i "s/conf.set\('(HAVE|ENABLE)_/conf.set10('\1_/" $ git grep -Ee '#ifn?def (HAVE|ENABLE)' -l|xargs sed -r -i 's/#ifdef (HAVE|ENABLE)/#if \1/; s/#ifndef (HAVE|ENABLE)/#if ! \1/;' $ git grep -Ee 'if.*defined\(HAVE' -l|xargs sed -i -r 's/defined\((HAVE_[A-Z0-9_]*)\)/\1/g' $ git grep -Ee 'if.*defined\(ENABLE' -l|xargs sed -i -r 's/defined\((ENABLE_[A-Z0-9_]*)\)/\1/g' + manual changes to meson.build squash! build-sys: use #if Y instead of #ifdef Y everywhere v2: - fix incorrect setting of HAVE_LIBIDN2
* basic/log: fix _printf_ annotation on log_object_internalvZbigniew Jędrzejewski-Szmek2017-04-201-1/+6
| | | | | | | | | | | | Fixup for 4b58153dd22172d817055d2a09a0cdf3f4bd9db3. I saw this because of a clang warning. With gcc the -Wformat-nonliteral warning doesn't seem to work as expected. In two places, a string constructed with strjoina is used as the pattern. This is safe, because we're taking a pattern which was already marked with _printf_ and prepending a known value to it. Those places are marked with #pragma to silence the warning.
* tree-wide: get rid of selinux_context_t (#3732)Zbigniew Jędrzejewski-Szmek2016-07-151-1/+1
| | | | | | https://github.com/SELinuxProject/selinux/commit/9eb9c9327563014ad6a807814e7975424642d5b9 deprecated selinux_context_t. Replace with a simple char* everywhere. Alternative fix for #3719.
* core: prefix selinux messages with "selinux: "Zbigniew Jędrzejewski-Szmek2016-04-211-1/+4
| | | | | | SELinux outputs semi-random messages like "Unknown permission start for class system", and the user has to dig into message metadata to find out where they are comming from. Add a prefix to give a hint.
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* core: simplify selinux AVC initializationLennart Poettering2015-11-301-38/+37
| | | | | | | | | | Let's merge access_init() and mac_selinux_access_init(), and only call mac_selinux_use() once, inside the merged function, instead of multiple times, including in the caller. See comments on: https://github.com/systemd/systemd/pull/2053
* tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easyLennart Poettering2015-11-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.
* tree-wide: sort includesThomas Hindoe Paaboel Andersen2015-11-161-2/+2
| | | | Sort the includes accoding to the new coding style.
* util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering2015-10-271-0/+1
|
* util-lib: split out printf() helpers to stdio-util.hLennart Poettering2015-10-271-3/+5
|
* tree-wide: remove unused functionsThomas Hindoe Paaboel Andersen2015-10-191-11/+0
|
* selinux: always use *_raw API from libselinuxMichal Sekletar2015-09-011-2/+2
| | | | | | | | | | | | | | | When mcstransd* is running non-raw functions will return translated SELinux context. Problem is that libselinux will cache this information and in the future it will return same context even though mcstransd maybe not running at that time. If you then check with such context against SELinux policy then selinux_check_access may fail depending on whether mcstransd is running or not. To workaround this problem/bug in libselinux, we should always get raw context instead. Most users will not notice because result of access check is logged only in debug mode. * SELinux context translation service, which will translates labels to human readable form
View Lorry Controller Status