4 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 only,
8 * as published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License version 2 for more details (a copy is included
14 * in the LICENSE file that accompanied this code).
16 * You should have received a copy of the GNU General Public License
17 * version 2 along with this program; If not, see http://www.gnu.org/licenses
23 * Copyright (c) 2016 DDN Storage
24 * Author: Sebastien Buisson sbuisson@ddn.com
28 * lustre/utils/l_getsepol.c
29 * Userland helper to retrieve SELinux policy information.
32 #include <sys/types.h>
50 #include <openssl/evp.h>
52 #include <selinux/selinux.h>
54 #include <libcfs/util/param.h>
55 #include <linux/lustre/lustre_user.h>
56 #include <linux/lustre/lustre_idl.h>
59 static char *progname;
60 static char *obd_type = NULL, *obd_name = NULL;
61 static time_t ref_pol_mtime = 0;
62 static char ref_selinux_mode = -1;
64 static void errlog(const char *fmt, ...)
68 openlog(progname, LOG_PERROR | LOG_PID, LOG_AUTHPRIV);
71 vsyslog(LOG_NOTICE, fmt, args);
77 /* Retrieve name of policy loaded, and version */
78 static int sepol_get_policy_info(char **policyname)
82 /* Name of loaded policy can be retrieved from policy root path */
83 pol_path = strdup(selinux_policy_root());
87 errlog("can't get policy name: %s\n", strerror(errno));
91 *policyname = strdup(basename(pol_path));
97 /* Read binary SELinux policy, and compute hash */
98 static int sepol_get_policy_data(const char *pol_bin_path,
99 unsigned char **mdval, unsigned int *mdsize)
103 ssize_t count = 1024;
105 const EVP_MD *md = EVP_sha256(); /* use SHA-256 */
108 /* Open policy file */
109 fd = open(pol_bin_path, O_RDONLY);
111 errlog("can't open SELinux policy file %s: %s\n", pol_bin_path,
117 /* Read policy file */
118 mdctx = EVP_MD_CTX_create();
119 EVP_DigestInit_ex(mdctx, md, NULL);
120 while (count == 1024) {
121 count = read(fd, buffer, count);
123 errlog("can't read SELinux policy file %s\n",
129 EVP_DigestUpdate(mdctx, buffer, count);
132 /* Close policy file */
139 *mdsize = EVP_MD_size(md);
140 *mdval = malloc(*mdsize);
141 if (*mdval == NULL) {
146 EVP_DigestFinal_ex(mdctx, *mdval, NULL);
147 EVP_MD_CTX_destroy(mdctx);
153 int get_opts(int argc, char *const argv[])
155 static struct option long_opts[] = {
156 { .val = 'o', .name = "obd_type",
157 .has_arg = required_argument},
158 { .val = 'n', .name = "obd_name",
159 .has_arg = required_argument},
160 { .val = 't', .name = "sel_mtime",
161 .has_arg = required_argument},
162 { .val = 'm', .name = "sel_mode",
163 .has_arg = required_argument},
165 char *short_opts = "o:n:t:m:";
168 char *sel_mtime = NULL, *sel_mode = NULL;
172 while ((opt = getopt_long(argc, argv, short_opts, long_opts,
189 fprintf(stderr, "Unknown option '%c'\n", opt);
194 if (optind != argc) {
195 errlog("incorrect arguments\n");
199 if (!obd_type || !obd_name)
200 /* called without arg (presumably from command line):
201 * ignore everything */
205 ref_pol_mtime = (time_t)strtoul(sel_mtime, &res, 0);
207 /* not a valid number */
208 errlog("invalid sel_mtime");
214 ref_selinux_mode = sel_mode[0] - '0';
215 if (ref_selinux_mode != 0 && ref_selinux_mode != 1) {
216 /* not a valid enforcing mode */
217 errlog("invalid sel_mode");
226 * Calculate SELinux status information.
227 * String that represents SELinux status info has the following format:
228 * <mode>:<policy name>:<policy version>:<policy hash>
229 * <mode> is a digit equal to 0 for SELinux Permissive mode,
230 * and 1 for Enforcing mode.
231 * When called from kernel space, it requires 4 args:
234 * - SELinux policy mtime
235 * - SELinux enforcing mode
236 * When called from command line (in this case without proper args), it prints
237 * SELinux status info to stdout.
239 int main(int argc, char **argv)
242 char pol_bin_path[PATH_MAX + 1];
246 struct sepol_downcall_data *data = NULL;
249 char *policy_type = NULL;
250 unsigned char *mdval = NULL;
251 unsigned int mdsize = 0;
256 progname = basename(argv[0]);
258 rc = get_opts(argc, argv);
262 /* Version of loaded policy */
263 policyver = security_policyvers();
265 errlog("unknown policy version: %s\n", strerror(errno));
270 /* Path of binary policy file */
271 snprintf(pol_bin_path, sizeof(pol_bin_path), "%s.%d",
272 selinux_binary_policy_path(), policyver);
274 /* Stat binary policy file */
275 if (stat(pol_bin_path, &st)) {
276 errlog("can't stat %s: %s\n", pol_bin_path, strerror(errno));
280 policymtime = st.st_mtime;
282 /* Determine if SELinux is in permissive or enforcing mode */
283 enforce = security_getenforce();
285 errlog("can't getenforce: %s\n", strerror(errno));
290 if (ref_pol_mtime == policymtime && ref_selinux_mode == enforce) {
291 /* Policy has not changed: return immediately */
296 /* Now we need to calculate SELinux status information */
297 size = offsetof(struct sepol_downcall_data,
298 sdd_sepol[LUSTRE_NODEMAP_SEPOL_LENGTH + 1]);
301 errlog("malloc sepol downcall data(%d) failed!\n", size);
305 memset(data, 0, size);
307 /* Get policy name */
308 rc = sepol_get_policy_info(&policy_type);
312 /* Read binary SELinux policy, and compute hash */
313 rc = sepol_get_policy_data(pol_bin_path, &mdval, &mdsize);
317 /* Put all info together and generate string
318 * to represent SELinux policy information
320 rc = snprintf(data->sdd_sepol, LUSTRE_NODEMAP_SEPOL_LENGTH + 1,
321 "%.1d:%s:%u:", enforce, policy_type, policyver);
322 if (rc >= LUSTRE_NODEMAP_SEPOL_LENGTH + 1) {
327 p = data->sdd_sepol + strlen(data->sdd_sepol);
328 size = LUSTRE_NODEMAP_SEPOL_LENGTH + 1 - strlen(data->sdd_sepol);
329 for (idx = 0; idx < mdsize; idx++) {
330 rc = snprintf(p, size, "%02x",
331 (unsigned char)(mdval[idx]));
334 if (size < 0 || rc >= size) {
339 data->sdd_sepol_len = p - data->sdd_sepol;
341 size = offsetof(struct sepol_downcall_data,
342 sdd_sepol[data->sdd_sepol_len]);
344 if (!obd_type || !obd_name) {
345 /* called without arg (presumably from command line):
346 * print SELinux status and exit
348 printf("SELinux status info: %.*s\n",
349 data->sdd_sepol_len, data->sdd_sepol);
353 data->sdd_magic = SEPOL_DOWNCALL_MAGIC;
354 data->sdd_sepol_mtime = policymtime;
355 /* Send SELinux policy info to kernelspace */
356 rc = cfs_get_param_paths(&path, "%s/%s/srpc_sepol", obd_type, obd_name);
358 errlog("can't get param '%s/%s/srpc_sepol': %s\n",
359 obd_type, obd_name, strerror(errno));
364 fd = open(path.gl_pathv[0], O_WRONLY);
366 errlog("can't open file '%s':%s\n", path.gl_pathv[0],
372 rc = write(fd, data, size);
375 errlog("partial write ret %d: %s\n", rc, strerror(errno));
382 cfs_free_param_data(&path);
390 if (isatty(STDIN_FILENO))
391 /* we are called from the command line */
392 return rc < 0 ? -rc : rc;