4 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 only,
8 * as published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License version 2 for more details (a copy is included
14 * in the LICENSE file that accompanied this code).
16 * You should have received a copy of the GNU General Public License
17 * version 2 along with this program; If not, see http://www.gnu.org/licenses
23 * Copyright (c) 2016 DDN Storage
24 * Author: Sebastien Buisson sbuisson@ddn.com
28 * lustre/utils/l_getsepol.c
29 * Userland helper to retrieve SELinux policy information.
32 #include <sys/types.h>
50 #include <openssl/evp.h>
52 #include <selinux/selinux.h>
54 #include <libcfs/util/param.h>
55 #include <linux/lustre/lustre_user.h>
56 #include <linux/lustre/lustre_idl.h>
59 static char *progname;
60 static char *obd_type = NULL, *obd_name = NULL;
61 static time_t ref_pol_mtime = 0;
62 static char ref_selinux_mode = -1;
64 static void errlog(const char *fmt, ...)
68 openlog(progname, LOG_PID, LOG_AUTHPRIV);
71 vsyslog(LOG_NOTICE, fmt, args);
77 /* Retrieve name of policy loaded, and version */
78 static int sepol_get_policy_info(char **policyname)
82 /* Name of loaded policy can be retrieved from policy root path */
83 pol_path = strdup(selinux_policy_root());
87 errlog("can't get policy name: %s\n", strerror(errno));
91 *policyname = strdup(basename(pol_path));
97 /* Read binary SELinux policy, and compute hash */
98 static int sepol_get_policy_data(const char *pol_bin_path,
99 unsigned char **mdval, unsigned int *mdsize)
103 ssize_t count = 1024;
105 const EVP_MD *md = EVP_sha256(); /* use SHA-256 */
108 /* Open policy file */
109 fd = open(pol_bin_path, O_RDONLY);
111 errlog("can't open SELinux policy file %s: %s\n", pol_bin_path,
117 /* Read policy file */
118 mdctx = EVP_MD_CTX_create();
119 EVP_DigestInit_ex(mdctx, md, NULL);
120 while (count == 1024) {
121 count = read(fd, buffer, count);
123 errlog("can't read SELinux policy file %s\n",
129 EVP_DigestUpdate(mdctx, buffer, count);
132 /* Close policy file */
139 *mdsize = EVP_MD_size(md);
140 *mdval = malloc(*mdsize);
141 if (*mdval == NULL) {
146 EVP_DigestFinal_ex(mdctx, *mdval, NULL);
147 EVP_MD_CTX_destroy(mdctx);
153 int get_opts(int argc, char *const argv[])
155 static struct option long_opts[] = {
156 { .val = 'o', .name = "obd_type",
157 .has_arg = required_argument},
158 { .val = 'n', .name = "obd_name",
159 .has_arg = required_argument},
160 { .val = 't', .name = "sel_mtime",
161 .has_arg = required_argument},
162 { .val = 'm', .name = "sel_mode",
163 .has_arg = required_argument},
165 char *short_opts = "o:n:t:m:";
168 char *sel_mtime = NULL, *sel_mode = NULL;
172 while ((opt = getopt_long(argc, argv, short_opts, long_opts,
189 fprintf(stderr, "Unknown option '%c'\n", opt);
194 if (optind != argc) {
195 errlog("incorrect arguments\n");
199 if (!obd_type || !obd_name)
200 /* called without arg (presumably from command line):
201 * ignore everything */
205 ref_pol_mtime = (time_t)strtoul(sel_mtime, &res, 0);
207 /* not a valid number */
208 errlog("invalid sel_mtime");
214 ref_selinux_mode = sel_mode[0] - '0';
215 if (ref_selinux_mode != 0 && ref_selinux_mode != 1) {
216 /* not a valid enforcing mode */
217 errlog("invalid sel_mode");
225 #define sepol_downcall(type_t, magic) ({ \
228 struct type_t *data; \
232 size = offsetof(struct type_t, \
233 sdd_sepol[LUSTRE_NODEMAP_SEPOL_LENGTH + 1]); \
234 data = malloc(size); \
236 errlog("malloc sepol downcall data(%d) failed!\n", size); \
240 memset(data, 0, size); \
242 /* Put all info together and generate string \
243 * to represent SELinux policy information \
245 rc = snprintf(data->sdd_sepol, LUSTRE_NODEMAP_SEPOL_LENGTH + 1, \
246 "%.1d:%s:%u:", enforce, policy_type, policyver); \
247 if (rc >= LUSTRE_NODEMAP_SEPOL_LENGTH + 1) { \
249 goto out_data_ ## type_t ; \
252 p = data->sdd_sepol + strlen(data->sdd_sepol); \
253 size = LUSTRE_NODEMAP_SEPOL_LENGTH + 1 - strlen(data->sdd_sepol); \
254 for (idx = 0; idx < mdsize; idx++) { \
255 rc = snprintf(p, size, "%02x", \
256 (unsigned char)(mdval[idx])); \
259 if (size < 0 || rc >= size) { \
261 goto out_data_ ## type_t ; \
264 data->sdd_sepol_len = p - data->sdd_sepol; \
266 size = offsetof(struct type_t, \
267 sdd_sepol[data->sdd_sepol_len]); \
269 if (!obd_type || !obd_name) { \
270 /* called without arg (presumably from command line): \
271 * print SELinux status and exit \
273 printf("SELinux status info: %.*s\n", \
274 data->sdd_sepol_len, data->sdd_sepol); \
278 data->sdd_magic = magic; \
279 data->sdd_sepol_mtime = policymtime; \
280 /* Send SELinux policy info to kernelspace */ \
281 rc = cfs_get_param_paths(&path, "%s/%s/srpc_sepol", obd_type, \
284 errlog("can't get param '%s/%s/srpc_sepol': %s\n", \
285 obd_type, obd_name, strerror(errno)); \
287 goto out_data_ ## type_t ; \
290 fd = open(path.gl_pathv[0], O_WRONLY); \
292 errlog("can't open file '%s':%s\n", path.gl_pathv[0], \
295 goto out_params_ ## type_t ; \
298 rc = write(fd, data, size); \
301 errlog("partial write ret %d: %s\n", rc, strerror(errno)); \
307 out_params_ ## type_t : \
308 cfs_free_param_data(&path); \
309 out_data_ ## type_t : \
314 * Calculate SELinux status information.
315 * String that represents SELinux status info has the following format:
316 * <mode>:<policy name>:<policy version>:<policy hash>
317 * <mode> is a digit equal to 0 for SELinux Permissive mode,
318 * and 1 for Enforcing mode.
319 * When called from kernel space, it requires 4 args:
322 * - SELinux policy mtime
323 * - SELinux enforcing mode
324 * When called from command line (in this case without proper args), it prints
325 * SELinux status info to stdout.
327 int main(int argc, char **argv)
330 char pol_bin_path[PATH_MAX + 1];
334 char *policy_type = NULL;
335 unsigned char *mdval = NULL;
336 unsigned int mdsize = 0;
339 progname = basename(argv[0]);
341 rc = get_opts(argc, argv);
345 /* Version of loaded policy */
346 policyver = security_policyvers();
348 errlog("unknown policy version: %s\n", strerror(errno));
353 /* Path of binary policy file */
354 snprintf(pol_bin_path, sizeof(pol_bin_path), "%s.%d",
355 selinux_binary_policy_path(), policyver);
357 /* Stat binary policy file */
358 if (stat(pol_bin_path, &st)) {
359 errlog("can't stat %s: %s\n", pol_bin_path, strerror(errno));
363 policymtime = st.st_mtime;
365 /* Determine if SELinux is in permissive or enforcing mode */
366 enforce = security_getenforce();
368 errlog("can't getenforce: %s\n", strerror(errno));
373 if (ref_pol_mtime == policymtime && ref_selinux_mode == enforce) {
374 /* Policy has not changed: return immediately */
379 /* Now we need to calculate SELinux status information */
380 /* Get policy name */
381 rc = sepol_get_policy_info(&policy_type);
385 /* Read binary SELinux policy, and compute hash */
386 rc = sepol_get_policy_data(pol_bin_path, &mdval, &mdsize);
390 sepol_downcall(sepol_downcall_data, SEPOL_DOWNCALL_MAGIC);
391 #if LUSTRE_VERSION_CODE < OBD_OCD_VERSION(2, 16, 53, 0)
393 /* try with old magic */
394 sepol_downcall(sepol_downcall_data_old,
395 SEPOL_DOWNCALL_MAGIC_OLD);
403 if (isatty(STDIN_FILENO))
404 /* we are called from the command line */
405 return rc < 0 ? -rc : rc;