1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "param_checker.h"
17 #include <fcntl.h>
18 #include <selinux_internal.h>
19 #include <unistd.h>
20 #include "callbacks.h"
21 #include "errno.h"
22 #include "securec.h"
23 #include "selinux_error.h"
24 #include "selinux_klog.h"
25
26 static pthread_once_t SET_LOG_ONCE = PTHREAD_ONCE_INIT;
27 #define BUF_SIZE 512
28
29 typedef struct AuditMsg {
30 const struct ucred *ucred;
31 const char *name;
32 } AuditMsg;
33
GetProcessNameFromPid(pid_t pid,char * processName)34 static int GetProcessNameFromPid(pid_t pid, char *processName)
35 {
36 char filename[BUF_SIZE];
37 char buff[BUF_SIZE];
38
39 if (snprintf_s(filename, BUF_SIZE, BUF_SIZE - 1, "/proc/%d/status", pid) <= 0) {
40 return -1;
41 }
42 FILE *fp = fopen(filename, "r");
43 if (fp == NULL) {
44 return -1;
45 }
46
47 while (fgets(buff, BUF_SIZE - 1, fp) != NULL) {
48 if (strstr(buff, "Name:") != NULL) {
49 if (sscanf_s(buff, "%*s %s", processName) <= 0) {
50 (void)fclose(fp);
51 return -1;
52 }
53 (void)fclose(fp);
54 return 0;
55 }
56 }
57 (void)fclose(fp);
58 return -1;
59 }
60
SelinuxAuditCallback(void * data,security_class_t cls,char * buf,size_t len)61 static int SelinuxAuditCallback(void *data, security_class_t cls, char *buf, size_t len)
62 {
63 if (data == NULL || buf == NULL) {
64 return -1;
65 }
66 AuditMsg *msg = (AuditMsg *)data;
67 if (!msg->name || !msg->ucred) {
68 selinux_log(SELINUX_ERROR, "Selinux audit msg invalid argument\n");
69 return -1;
70 }
71 char processName[BUF_SIZE];
72 if (GetProcessNameFromPid(msg->ucred->pid, processName) != 0) {
73 if (strcpy_s(processName, BUF_SIZE, "unknown process") != EOK) {
74 return -1;
75 }
76 }
77 if (snprintf_s(buf, len, len - 1, "process=\"%s\" parameter=%s pid=%d uid=%u gid=%u", processName, msg->name,
78 msg->ucred->pid, msg->ucred->uid, msg->ucred->gid) <= 0) {
79 return -1;
80 }
81 return 0;
82 }
83
SelinuxSetCallback(void)84 static void SelinuxSetCallback(void)
85 {
86 SetSelinuxKmsgLevel(SELINUX_KERROR);
87 union selinux_callback cb;
88 cb.func_log = SelinuxKmsg;
89 selinux_set_callback(SELINUX_CB_LOG, cb);
90 cb.func_audit = SelinuxAuditCallback;
91 selinux_set_callback(SELINUX_CB_AUDIT, cb);
92 }
93
CheckPerm(const char * paraName,const char * srcContext,const char * destContext,const struct ucred * uc)94 static int CheckPerm(const char *paraName, const char *srcContext, const char *destContext, const struct ucred *uc)
95 {
96 if (srcContext == NULL || uc == NULL) {
97 selinux_log(SELINUX_ERROR, "args empty!\n");
98 return -SELINUX_PTR_NULL;
99 }
100 selinux_log(SELINUX_INFO, "srcContext[%s] is setting param[%s] destContext[%s]\n", srcContext, paraName,
101 destContext);
102 AuditMsg msg;
103 msg.name = paraName;
104 msg.ucred = uc;
105 int res = selinux_check_access(srcContext, destContext, "parameter_service", "set", &msg);
106 return res == 0 ? SELINUX_SUCC : -SELINUX_PERMISSION_DENY;
107 }
108
SetInitSelinuxLog(void)109 void SetInitSelinuxLog(void)
110 {
111 if (getpid() == 1) {
112 __selinux_once(SET_LOG_ONCE, SelinuxSetCallback);
113 }
114 }
115
SetParamCheck(const char * paraName,const char * destContext,const SrcInfo * info)116 int SetParamCheck(const char *paraName, const char *destContext, const SrcInfo *info)
117 {
118 if (paraName == NULL || destContext == NULL || info == NULL) {
119 selinux_log(SELINUX_ERROR, "input param is null!\n");
120 return -SELINUX_PTR_NULL;
121 }
122
123 char *srcContext = NULL;
124 int rc = getpeercon(info->sockFd, &srcContext);
125 if (rc < 0) {
126 selinux_log(SELINUX_ERROR, "getpeercon failed: %s\n", strerror(errno));
127 return -SELINUX_GET_CONTEXT_ERROR;
128 }
129
130 int res = CheckPerm(paraName, srcContext, destContext, &(info->uc));
131 freecon(srcContext);
132 return res;
133 }
134