From: Casey Schaufler <casey@schaufler-ca.com>
To: LSM List <linux-security-module@vger.kernel.org>
Subject: Systemd v254 LSM stacking issue - patch
Date: Tue, 19 Mar 2024 10:58:54 -0700 [thread overview]
Message-ID: <255cd7ad-332c-473f-8059-3258dad287a7@schaufler-ca.com> (raw)
In-Reply-To: 255cd7ad-332c-473f-8059-3258dad287a7.ref@schaufler-ca.com
Systemd version 254 (included in Fedora 39) has an assertion that
only one of Smack and SELinux is active. This can make experimenting
with full LSM stacking frustrating. This patch adds multiple label
operation support and removes the pesky assertion. It's experimental.
---
src/basic/label.c | 48 ++++++++++++++++++++++++++++++++++--------------
src/core/smack-setup.c | 2 +-
src/shared/label-util.c | 2 --
src/shared/smack-util.c | 2 +-
4 files changed, 36 insertions(+), 18 deletions(-)
diff --git a/src/basic/label.c b/src/basic/label.c
index f134e77589..6827fbbd46 100644
--- a/src/basic/label.c
+++ b/src/basic/label.c
@@ -5,26 +5,46 @@
#include "label.h"
-static const LabelOps *label_ops = NULL;
+#define POSSIBLE_LABEL_OPS 2 /* SELinux and Smack */
-int label_ops_set(const LabelOps *ops) {
- if (label_ops)
- return -EBUSY;
+static const LabelOps *label_ops[POSSIBLE_LABEL_OPS];
- label_ops = ops;
- return 0;
+int label_ops_set(const LabelOps *ops) {
+ int i;
+
+ for (i = 0; i < POSSIBLE_LABEL_OPS; i++) {
+ if (!label_ops[i]) {
+ label_ops[i] = ops;
+ return 0;
+ }
+ }
+ return -EBUSY;
}
int label_ops_pre(int dir_fd, const char *path, mode_t mode) {
- if (!label_ops || !label_ops->pre)
- return 0;
-
- return label_ops->pre(dir_fd, path, mode);
+ int i;
+ int r;
+
+ for (i = 0; i < POSSIBLE_LABEL_OPS; i++) {
+ if (label_ops[i] && label_ops[i]->pre) {
+ r = label_ops[i]->pre(dir_fd, path, mode);
+ if (r)
+ return r;
+ }
+ }
+ return 0;
}
int label_ops_post(int dir_fd, const char *path) {
- if (!label_ops || !label_ops->post)
- return 0;
-
- return label_ops->post(dir_fd, path);
+ int i;
+ int r;
+
+ for (i = 0; i < POSSIBLE_LABEL_OPS; i++) {
+ if (label_ops[i] && label_ops[i]->post) {
+ r = label_ops[i]->post(dir_fd, path);
+ if (r)
+ return r;
+ }
+ }
+ return 0;
}
diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c
index bcaa237c8d..b1dbbbc2e8 100644
--- a/src/core/smack-setup.c
+++ b/src/core/smack-setup.c
@@ -319,7 +319,7 @@ int mac_smack_setup(bool *loaded_policy) {
}
#if HAVE_SMACK_RUN_LABEL
- r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
+ r = write_string_file("/proc/self/attr/smack/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m");
r = write_string_file("/sys/fs/smackfs/ambient", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
diff --git a/src/shared/label-util.c b/src/shared/label-util.c
index 3316c9ed37..3154818371 100644
--- a/src/shared/label-util.c
+++ b/src/shared/label-util.c
@@ -120,8 +120,6 @@ int btrfs_subvol_make_label(const char *path) {
int mac_init(void) {
int r;
- assert(!(mac_selinux_use() && mac_smack_use()));
-
r = mac_selinux_init();
if (r < 0)
return r;
diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c
index 1f88e724d0..5661428f96 100644
--- a/src/shared/smack-util.c
+++ b/src/shared/smack-util.c
@@ -112,7 +112,7 @@ int mac_smack_apply_pid(pid_t pid, const char *label) {
if (!mac_smack_use())
return 0;
- p = procfs_file_alloca(pid, "attr/current");
+ p = procfs_file_alloca(pid, "attr/smack/current");
r = write_string_file(p, label, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return r;
parent reply other threads:[~2024-03-19 17:59 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <255cd7ad-332c-473f-8059-3258dad287a7.ref@schaufler-ca.com>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=255cd7ad-332c-473f-8059-3258dad287a7@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).