[openssh.git] / openbsd-compat / port-linux.c

/* $Id$ */

/*
 * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
 * Copyright (c) 2006 Damien Miller <djm@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/*
 * Linux-specific portability code - just SELinux support at present
 */

#include "includes.h"

#include <errno.h>
#include <string.h>

#ifdef WITH_SELINUX
#include "log.h"
#include "port-linux.h"

#include <selinux/selinux.h>
#include <selinux/flask.h>
#include <selinux/get_context_list.h>

/* Wrapper around is_selinux_enabled() to log its return value once only */
static int
ssh_selinux_enabled(void)
{
	static int enabled = -1;

	if (enabled == -1) {
		enabled = is_selinux_enabled();
		debug("SELinux support %s", enabled ? "enabled" : "disabled");
	}

	return (enabled);
}

/* Return the default security context for the given username */
static security_context_t
ssh_selinux_getctxbyname(char *pwname)
{
	security_context_t sc;
	char *sename = NULL, *lvl = NULL;
	int r;

#ifdef HAVE_GETSEUSERBYNAME
	if (getseuserbyname(pwname, &sename, &lvl) != 0)
		return NULL;
#else
	sename = pwname;
	lvl = NULL;
#endif

#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
	r = get_default_context_with_level(sename, lvl, NULL, &sc);
#else
	r = get_default_context(sename, NULL, &sc);
#endif

	if (r != 0) {
		switch (security_getenforce()) {
		case -1:
			fatal("%s: ssh_selinux_getctxbyname: "
			    "security_getenforce() failed", __func__);
		case 0:
			error("%s: Failed to get default SELinux security "
			    "context for %s", __func__, pwname);
		default:
			fatal("%s: Failed to get default SELinux security "
			    "context for %s (in enforcing mode)",
			    __func__, pwname);
		}
	}

#ifdef HAVE_GETSEUSERBYNAME
	if (sename != NULL)
		xfree(sename);
	if (lvl != NULL)
		xfree(lvl);
#endif

	return (sc);
}

/* Set the execution context to the default for the specified user */
void
ssh_selinux_setup_exec_context(char *pwname)
{
	security_context_t user_ctx = NULL;

	if (!ssh_selinux_enabled())
		return;

	debug3("%s: setting execution context", __func__);

	user_ctx = ssh_selinux_getctxbyname(pwname);
	if (setexeccon(user_ctx) != 0) {
		switch (security_getenforce()) {
		case -1:
			fatal("%s: security_getenforce() failed", __func__);
		case 0:
			error("%s: Failed to set SELinux execution "
			    "context for %s", __func__, pwname);
		default:
			fatal("%s: Failed to set SELinux execution context "
			    "for %s (in enforcing mode)", __func__, pwname);
		}
	}
	if (user_ctx != NULL)
		freecon(user_ctx);

	debug3("%s: done", __func__);
}

/* Set the TTY context for the specified user */
void
ssh_selinux_setup_pty(char *pwname, const char *tty)
{
	security_context_t new_tty_ctx = NULL;
	security_context_t user_ctx = NULL;
	security_context_t old_tty_ctx = NULL;

	if (!ssh_selinux_enabled())
		return;

	debug3("%s: setting TTY context on %s", __func__, tty);

	user_ctx = ssh_selinux_getctxbyname(pwname);

	/* XXX: should these calls fatal() upon failure in enforcing mode? */

	if (getfilecon(tty, &old_tty_ctx) == -1) {
		error("%s: getfilecon: %s", __func__, strerror(errno));
		goto out;
	}

	if (security_compute_relabel(user_ctx, old_tty_ctx,
	    SECCLASS_CHR_FILE, &new_tty_ctx) != 0) {
		error("%s: security_compute_relabel: %s",
		    __func__, strerror(errno));
		goto out;
	}

	if (setfilecon(tty, new_tty_ctx) != 0)
		error("%s: setfilecon: %s", __func__, strerror(errno));
 out:
	if (new_tty_ctx != NULL)
		freecon(new_tty_ctx);
	if (old_tty_ctx != NULL)
		freecon(old_tty_ctx);
	if (user_ctx != NULL)
		freecon(user_ctx);
	debug3("%s: done", __func__);
}
#endif /* WITH_SELINUX */
Commit	Line	Data
ef4d1846	1	/* $Id$ */
	2
	3	/*
	4	* Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
	5	* Copyright (c) 2006 Damien Miller <djm@openbsd.org>
	6	*
	7	* Permission to use, copy, modify, and distribute this software for any
	8	* purpose with or without fee is hereby granted, provided that the above
	9	* copyright notice and this permission notice appear in all copies.
	10	*
	11	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	12	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	13	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	14	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	15	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	16	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	17	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	18	*/
	19
	20	/*
	21	* Linux-specific portability code - just SELinux support at present
	22	*/
	23
	24	#include "includes.h"
	25
28cb0a43	26	#include <errno.h>
	27	#include <string.h>
	28
ef4d1846	29	#ifdef WITH_SELINUX
	30	#include "log.h"
	31	#include "port-linux.h"
	32
	33	#include <selinux/selinux.h>
	34	#include <selinux/flask.h>
	35	#include <selinux/get_context_list.h>
	36
	37	/* Wrapper around is_selinux_enabled() to log its return value once only */
	38	static int
	39	ssh_selinux_enabled(void)
	40	{
	41	static int enabled = -1;
	42
	43	if (enabled == -1) {
	44	enabled = is_selinux_enabled();
	45	debug("SELinux support %s", enabled ? "enabled" : "disabled");
	46	}
	47
	48	return (enabled);
	49	}
	50
	51	/* Return the default security context for the given username */
	52	static security_context_t
	53	ssh_selinux_getctxbyname(char *pwname)
	54	{
	55	security_context_t sc;
	56	char sename = NULL, lvl = NULL;
	57	int r;
	58
	59	#ifdef HAVE_GETSEUSERBYNAME
	60	if (getseuserbyname(pwname, &sename, &lvl) != 0)
	61	return NULL;
	62	#else
	63	sename = pwname;
	64	lvl = NULL;
	65	#endif
	66
	67	#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
	68	r = get_default_context_with_level(sename, lvl, NULL, &sc);
	69	#else
	70	r = get_default_context(sename, NULL, &sc);
	71	#endif
	72
	73	if (r != 0) {
	74	switch (security_getenforce()) {
	75	case -1:
	76	fatal("%s: ssh_selinux_getctxbyname: "
	77	"security_getenforce() failed", __func__);
	78	case 0:
	79	error("%s: Failed to get default SELinux security "
	80	"context for %s", __func__, pwname);
	81	default:
	82	fatal("%s: Failed to get default SELinux security "
	83	"context for %s (in enforcing mode)",
	84	__func__, pwname);
	85	}
	86	}
	87
	88	#ifdef HAVE_GETSEUSERBYNAME
	89	if (sename != NULL)
	90	xfree(sename);
	91	if (lvl != NULL)
	92	xfree(lvl);
93	#endif
94
95	return (sc);
96	}
97
98	/* Set the execution context to the default for the specified user */
99	void
100	ssh_selinux_setup_exec_context(char *pwname)
101	{
102	security_context_t user_ctx = NULL;
103
104	if (!ssh_selinux_enabled())
105	return;
106
107	debug3("%s: setting execution context", __func__);
108
109	user_ctx = ssh_selinux_getctxbyname(pwname);
110	if (setexeccon(user_ctx) != 0) {
111	switch (security_getenforce()) {
112	case -1:
113	fatal("%s: security_getenforce() failed", __func__);
114	case 0:
115	error("%s: Failed to set SELinux execution "
116	"context for %s", __func__, pwname);
117	default:
118	fatal("%s: Failed to set SELinux execution context "
119	"for %s (in enforcing mode)", __func__, pwname);
120	}
121	}
122	if (user_ctx != NULL)
123	freecon(user_ctx);
124
125	debug3("%s: done", __func__);
126	}
127
128	/* Set the TTY context for the specified user */
129	void
130	ssh_selinux_setup_pty(char pwname, const char tty)
131	{
132	security_context_t new_tty_ctx = NULL;
133	security_context_t user_ctx = NULL;
134	security_context_t old_tty_ctx = NULL;
135
136	if (!ssh_selinux_enabled())
137	return;
138
139	debug3("%s: setting TTY context on %s", __func__, tty);
140
141	user_ctx = ssh_selinux_getctxbyname(pwname);
142
143	/* XXX: should these calls fatal() upon failure in enforcing mode? */
144
145	if (getfilecon(tty, &old_tty_ctx) == -1) {
146	error("%s: getfilecon: %s", __func__, strerror(errno));
147	goto out;
148	}
149
150	if (security_compute_relabel(user_ctx, old_tty_ctx,
151	SECCLASS_CHR_FILE, &new_tty_ctx) != 0) {
152	error("%s: security_compute_relabel: %s",
153	__func__, strerror(errno));
154	goto out;
155	}
156
157	if (setfilecon(tty, new_tty_ctx) != 0)
158	error("%s: setfilecon: %s", __func__, strerror(errno));
159	out:
160	if (new_tty_ctx != NULL)
161	freecon(new_tty_ctx);
162	if (old_tty_ctx != NULL)
163	freecon(old_tty_ctx);
164	if (user_ctx != NULL)
165	freecon(user_ctx);
166	debug3("%s: done", __func__);
167	}
168	#endif /* WITH_SELINUX */