1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "selinux_adp.h"
16
17 #include <errno.h>
18
19 #include "init_error.h"
20 #include "init_hook.h"
21 #include "init_module_engine.h"
22 #include "plugin_adapter.h"
23 #include "securec.h"
24
25 #include <policycoreutils.h>
26 #include <selinux/selinux.h>
27
28 enum {
29 CMD_LOAD_POLICY = 0,
30 CMD_SET_SERVICE_CONTEXTS = 1,
31 CMD_SET_SOCKET_CONTEXTS = 2,
32 CMD_RESTORE_INDEX = 3,
33 CMD_RESTORE_INDEX_FORCE = 4,
34 };
35
36 extern char *__progname;
37
LoadSelinuxPolicy(int id,const char * name,int argc,const char ** argv)38 static int LoadSelinuxPolicy(int id, const char *name, int argc, const char **argv)
39 {
40 int ret;
41 char processContext[MAX_SECON_LEN];
42
43 UNUSED(id);
44 UNUSED(name);
45 UNUSED(argc);
46 UNUSED(argv);
47 PLUGIN_LOGI("LoadSelinuxPolicy ");
48 // load selinux policy and context
49 if (LoadPolicy() < 0) {
50 PLUGIN_LOGE("main, load_policy failed.");
51 } else {
52 PLUGIN_LOGI("main, load_policy success.");
53 }
54
55 ret = snprintf_s(processContext, sizeof(processContext), sizeof(processContext) - 1, "u:r:%s:s0", __progname);
56 if (ret == -1) {
57 setcon("u:r:init:s0");
58 } else {
59 setcon(processContext);
60 }
61 (void)RestoreconRecurse("/dev");
62 return 0;
63 }
64
SetServiceContent(int id,const char * name,int argc,const char ** argv)65 static int SetServiceContent(int id, const char *name, int argc, const char **argv)
66 {
67 PLUGIN_CHECK(name != NULL && argc >= 1 && argv != NULL, return -1, "Invalid parameter");
68 ServiceExtData *data = GetServiceExtData(argv[0], HOOK_ID_SELINUX);
69 char *label = "u:r:limit_domain:s0";
70 if (data != NULL) {
71 label = (char *)data->data;
72 } else {
73 PLUGIN_LOGE("Please set secon field in service %s's cfg file, limit_domain will be blocked", argv[0]);
74 }
75
76 if (setexeccon(label) < 0) {
77 PLUGIN_LOGE("Service error %d %s, failed to set secon %s.", errno, argv[0], label);
78 #ifndef STARTUP_INIT_TEST
79 _exit(INIT_EEXEC_CONTENT);
80 #endif
81 } else {
82 PLUGIN_LOGV("Service info %s, set secon %s.", argv[0], label);
83 }
84 return 0;
85 }
86
SetSockCreateCon(int id,const char * name,int argc,const char ** argv)87 static int SetSockCreateCon(int id, const char *name, int argc, const char **argv)
88 {
89 PLUGIN_CHECK(name != NULL, return -1, "Invalid parameter");
90 if (argc == 0) {
91 setsockcreatecon(NULL);
92 return 0;
93 }
94 PLUGIN_CHECK(argc >= 1 && argv != NULL, return -1, "Invalid parameter");
95 ServiceExtData *data = GetServiceExtData(argv[0], HOOK_ID_SELINUX);
96 if (data != NULL) {
97 if (setsockcreatecon((char *)data->data) < 0) {
98 PLUGIN_LOGE("failed to set socket context %s's secon (%s).", argv[0], (char *)data->data);
99 #ifndef STARTUP_INIT_TEST
100 _exit(PROCESS_EXIT_CODE);
101 #endif
102 }
103 }
104
105 return 0;
106 }
107
RestoreContentRecurse(int id,const char * name,int argc,const char ** argv)108 static int RestoreContentRecurse(int id, const char *name, int argc, const char **argv)
109 {
110 PLUGIN_CHECK(name != NULL && argc >= 1 && argv != NULL, return -1, "Invalid parameter");
111 PLUGIN_LOGV("RestoreContentRecurse path %s", argv[0]);
112 if (RestoreconRecurse(argv[0]) && errno != 0) {
113 PLUGIN_LOGE("restoreContentRecurse failed for '%s', err %d.", argv[0], errno);
114 }
115 return 0;
116 }
117
RestoreContentRecurseForce(int id,const char * name,int argc,const char ** argv)118 static int RestoreContentRecurseForce(int id, const char *name, int argc, const char **argv)
119 {
120 PLUGIN_CHECK(name != NULL && argc >= 1 && argv != NULL, return -1, "Invalid parameter");
121 PLUGIN_LOGV("RestoreContentRecurseForce path %s", argv[0]);
122 if (RestoreconRecurseForce(argv[0]) && errno != 0) {
123 PLUGIN_LOGE("RestoreContentRecurseForce failed for '%s', err %d.", argv[0], errno);
124 }
125 return 0;
126 }
127
128 static int32_t selinuxAdpCmdIds[CMD_RESTORE_INDEX_FORCE + 1] = {0}; // 5 cmd count
SelinuxAdpInit(void)129 static void SelinuxAdpInit(void)
130 {
131 selinuxAdpCmdIds[CMD_LOAD_POLICY] = AddCmdExecutor("loadSelinuxPolicy", LoadSelinuxPolicy);
132 selinuxAdpCmdIds[CMD_SET_SERVICE_CONTEXTS] = AddCmdExecutor("setServiceContent", SetServiceContent);
133 selinuxAdpCmdIds[CMD_SET_SOCKET_CONTEXTS] = AddCmdExecutor("setSockCreateCon", SetSockCreateCon);
134 selinuxAdpCmdIds[CMD_RESTORE_INDEX] = AddCmdExecutor("restoreContentRecurse", RestoreContentRecurse);
135 selinuxAdpCmdIds[CMD_RESTORE_INDEX_FORCE] =
136 AddCmdExecutor("restoreContentRecurseForce", RestoreContentRecurseForce);
137 }
138
SelinuxAdpExit(void)139 static void SelinuxAdpExit(void)
140 {
141 if (selinuxAdpCmdIds[CMD_LOAD_POLICY] != -1) {
142 RemoveCmdExecutor("loadSelinuxPolicy", selinuxAdpCmdIds[CMD_LOAD_POLICY]);
143 }
144 if (selinuxAdpCmdIds[CMD_SET_SERVICE_CONTEXTS] != -1) {
145 RemoveCmdExecutor("setServiceContent", selinuxAdpCmdIds[CMD_SET_SERVICE_CONTEXTS]);
146 }
147 if (selinuxAdpCmdIds[CMD_SET_SOCKET_CONTEXTS] != -1) {
148 RemoveCmdExecutor("setSockCreateCon", selinuxAdpCmdIds[CMD_SET_SOCKET_CONTEXTS]);
149 }
150 if (selinuxAdpCmdIds[CMD_RESTORE_INDEX] != -1) {
151 RemoveCmdExecutor("restoreContentRecurse", selinuxAdpCmdIds[CMD_RESTORE_INDEX]);
152 }
153 if (selinuxAdpCmdIds[CMD_RESTORE_INDEX_FORCE] != -1) {
154 RemoveCmdExecutor("restoreContentRecurseForce", selinuxAdpCmdIds[CMD_RESTORE_INDEX_FORCE]);
155 }
156 }
157
MODULE_CONSTRUCTOR(void)158 MODULE_CONSTRUCTOR(void)
159 {
160 PLUGIN_LOGI("Selinux adapter plug-in init now ...");
161 SelinuxAdpInit();
162 }
163
MODULE_DESTRUCTOR(void)164 MODULE_DESTRUCTOR(void)
165 {
166 if (getpid() != 1) {
167 return;
168 }
169 PLUGIN_LOGI("Selinux adapter plug-in exit now ...");
170 SelinuxAdpExit();
171 }
172