1 /*
2 * Copyright (c) 2005 Daniel Walsh <[email protected]>
3 * Copyright (c) 2006 Damien Miller <[email protected]>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 /*
19 * Linux-specific portability code - just SELinux support at present
20 */
21
22 #include "includes.h"
23
24 #if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
25 #include <errno.h>
26 #include <stdarg.h>
27 #include <string.h>
28 #include <stdio.h>
29
30 #include "log.h"
31 #include "xmalloc.h"
32 #include "port-linux.h"
33
34 #ifdef WITH_SELINUX
35 #include <selinux/selinux.h>
36 #include <selinux/get_context_list.h>
37
38 #ifndef SSH_SELINUX_UNCONFINED_TYPE
39 # define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:"
40 #endif
41
42 /* Wrapper around is_selinux_enabled() to log its return value once only */
43 int
ssh_selinux_enabled(void)44 ssh_selinux_enabled(void)
45 {
46 static int enabled = -1;
47
48 if (enabled == -1) {
49 enabled = (is_selinux_enabled() == 1);
50 debug("SELinux support %s", enabled ? "enabled" : "disabled");
51 }
52
53 return (enabled);
54 }
55
56 /* Return the default security context for the given username */
57 static security_context_t
ssh_selinux_getctxbyname(char * pwname)58 ssh_selinux_getctxbyname(char *pwname)
59 {
60 security_context_t sc = NULL;
61 char *sename = NULL, *lvl = NULL;
62 int r;
63
64 #ifdef HAVE_GETSEUSERBYNAME
65 if (getseuserbyname(pwname, &sename, &lvl) != 0)
66 return NULL;
67 #else
68 sename = pwname;
69 lvl = NULL;
70 #endif
71
72 #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
73 r = get_default_context_with_level(sename, lvl, NULL, &sc);
74 #else
75 r = get_default_context(sename, NULL, &sc);
76 #endif
77
78 if (r != 0) {
79 switch (security_getenforce()) {
80 case -1:
81 fatal("%s: ssh_selinux_getctxbyname: "
82 "security_getenforce() failed", __func__);
83 case 0:
84 error("%s: Failed to get default SELinux security "
85 "context for %s", __func__, pwname);
86 sc = NULL;
87 break;
88 default:
89 fatal("%s: Failed to get default SELinux security "
90 "context for %s (in enforcing mode)",
91 __func__, pwname);
92 }
93 }
94
95 #ifdef HAVE_GETSEUSERBYNAME
96 free(sename);
97 free(lvl);
98 #endif
99
100 return sc;
101 }
102
103 /* Set the execution context to the default for the specified user */
104 void
ssh_selinux_setup_exec_context(char * pwname)105 ssh_selinux_setup_exec_context(char *pwname)
106 {
107 security_context_t user_ctx = NULL;
108
109 if (!ssh_selinux_enabled())
110 return;
111
112 debug3("%s: setting execution context", __func__);
113
114 user_ctx = ssh_selinux_getctxbyname(pwname);
115 if (setexeccon(user_ctx) != 0) {
116 switch (security_getenforce()) {
117 case -1:
118 fatal("%s: security_getenforce() failed", __func__);
119 case 0:
120 error("%s: Failed to set SELinux execution "
121 "context for %s", __func__, pwname);
122 break;
123 default:
124 fatal("%s: Failed to set SELinux execution context "
125 "for %s (in enforcing mode)", __func__, pwname);
126 }
127 }
128 if (user_ctx != NULL)
129 freecon(user_ctx);
130
131 debug3("%s: done", __func__);
132 }
133
134 /* Set the TTY context for the specified user */
135 void
ssh_selinux_setup_pty(char * pwname,const char * tty)136 ssh_selinux_setup_pty(char *pwname, const char *tty)
137 {
138 security_context_t new_tty_ctx = NULL;
139 security_context_t user_ctx = NULL;
140 security_context_t old_tty_ctx = NULL;
141 security_class_t chrclass;
142
143 if (!ssh_selinux_enabled())
144 return;
145
146 debug3("%s: setting TTY context on %s", __func__, tty);
147
148 user_ctx = ssh_selinux_getctxbyname(pwname);
149
150 /* XXX: should these calls fatal() upon failure in enforcing mode? */
151
152 if (getfilecon(tty, &old_tty_ctx) == -1) {
153 error("%s: getfilecon: %s", __func__, strerror(errno));
154 goto out;
155 }
156 if ((chrclass = string_to_security_class("chr_file")) == 0) {
157 error("%s: couldn't get security class for chr_file", __func__);
158 goto out;
159 }
160 if (security_compute_relabel(user_ctx, old_tty_ctx,
161 chrclass, &new_tty_ctx) != 0) {
162 error("%s: security_compute_relabel: %s",
163 __func__, strerror(errno));
164 goto out;
165 }
166
167 if (setfilecon(tty, new_tty_ctx) != 0)
168 error("%s: setfilecon: %s", __func__, strerror(errno));
169 out:
170 if (new_tty_ctx != NULL)
171 freecon(new_tty_ctx);
172 if (old_tty_ctx != NULL)
173 freecon(old_tty_ctx);
174 if (user_ctx != NULL)
175 freecon(user_ctx);
176 debug3("%s: done", __func__);
177 }
178
179 void
ssh_selinux_change_context(const char * newname)180 ssh_selinux_change_context(const char *newname)
181 {
182 int len, newlen;
183 char *oldctx, *newctx, *cx;
184 void (*switchlog) (const char *fmt,...) = logit;
185
186 if (!ssh_selinux_enabled())
187 return;
188
189 if (getcon((security_context_t *)&oldctx) < 0) {
190 logit("%s: getcon failed with %s", __func__, strerror(errno));
191 return;
192 }
193 if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) ==
194 NULL) {
195 logit ("%s: unparseable context %s", __func__, oldctx);
196 return;
197 }
198
199 /*
200 * Check whether we are attempting to switch away from an unconfined
201 * security context.
202 */
203 if (strncmp(cx, SSH_SELINUX_UNCONFINED_TYPE,
204 sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0)
205 switchlog = debug3;
206
207 newlen = strlen(oldctx) + strlen(newname) + 1;
208 newctx = xmalloc(newlen);
209 len = cx - oldctx + 1;
210 memcpy(newctx, oldctx, len);
211 strlcpy(newctx + len, newname, newlen - len);
212 if ((cx = index(cx + 1, ':')))
213 strlcat(newctx, cx, newlen);
214 debug3("%s: setting context from '%s' to '%s'", __func__,
215 oldctx, newctx);
216 if (setcon(newctx) < 0)
217 switchlog("%s: setcon %s from %s failed with %s", __func__,
218 newctx, oldctx, strerror(errno));
219 free(oldctx);
220 free(newctx);
221 }
222
223 void
ssh_selinux_setfscreatecon(const char * path)224 ssh_selinux_setfscreatecon(const char *path)
225 {
226 security_context_t context;
227
228 if (!ssh_selinux_enabled())
229 return;
230 if (path == NULL) {
231 setfscreatecon(NULL);
232 return;
233 }
234 if (matchpathcon(path, 0700, &context) == 0)
235 setfscreatecon(context);
236 }
237
238 #endif /* WITH_SELINUX */
239
240 #ifdef LINUX_OOM_ADJUST
241 /*
242 * The magic "don't kill me" values, old and new, as documented in eg:
243 * http://lxr.linux.no/#linux+v2.6.32/Documentation/filesystems/proc.txt
244 * http://lxr.linux.no/#linux+v2.6.36/Documentation/filesystems/proc.txt
245 */
246
247 static int oom_adj_save = INT_MIN;
248 static char *oom_adj_path = NULL;
249 struct {
250 char *path;
251 int value;
252 } oom_adjust[] = {
253 {"/proc/self/oom_score_adj", -1000}, /* kernels >= 2.6.36 */
254 {"/proc/self/oom_adj", -17}, /* kernels <= 2.6.35 */
255 {NULL, 0},
256 };
257
258 /*
259 * Tell the kernel's out-of-memory killer to avoid sshd.
260 * Returns the previous oom_adj value or zero.
261 */
262 void
oom_adjust_setup(void)263 oom_adjust_setup(void)
264 {
265 int i, value;
266 FILE *fp;
267
268 debug3("%s", __func__);
269 for (i = 0; oom_adjust[i].path != NULL; i++) {
270 oom_adj_path = oom_adjust[i].path;
271 value = oom_adjust[i].value;
272 if ((fp = fopen(oom_adj_path, "r+")) != NULL) {
273 if (fscanf(fp, "%d", &oom_adj_save) != 1)
274 verbose("error reading %s: %s", oom_adj_path,
275 strerror(errno));
276 else {
277 rewind(fp);
278 if (fprintf(fp, "%d\n", value) <= 0)
279 verbose("error writing %s: %s",
280 oom_adj_path, strerror(errno));
281 else
282 debug("Set %s from %d to %d",
283 oom_adj_path, oom_adj_save, value);
284 }
285 fclose(fp);
286 return;
287 }
288 }
289 oom_adj_path = NULL;
290 }
291
292 /* Restore the saved OOM adjustment */
293 void
oom_adjust_restore(void)294 oom_adjust_restore(void)
295 {
296 FILE *fp;
297
298 debug3("%s", __func__);
299 if (oom_adj_save == INT_MIN || oom_adj_path == NULL ||
300 (fp = fopen(oom_adj_path, "w")) == NULL)
301 return;
302
303 if (fprintf(fp, "%d\n", oom_adj_save) <= 0)
304 verbose("error writing %s: %s", oom_adj_path, strerror(errno));
305 else
306 debug("Set %s to %d", oom_adj_path, oom_adj_save);
307
308 fclose(fp);
309 return;
310 }
311 #endif /* LINUX_OOM_ADJUST */
312 #endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
313