blob: c89a8867d8a14b3ca9fd81ed884687be4be52d0c [file] [log] [blame]
/*
* Callbacks for user-supplied memory allocation, supplemental
* auditing, and locking routines.
*
* Author : Eamon Walsh <ewalsh@epoch.ncsc.mil>
*
* Netlink code derived in part from sample code by
* James Morris <jmorris@redhat.com>.
*/
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <poll.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <linux/netlink.h>
#include "callbacks.h"
#include "selinux_netlink.h"
#include "avc_internal.h"
#ifndef NETLINK_SELINUX
#define NETLINK_SELINUX 7
#endif
/* callback pointers */
void *(*avc_func_malloc) (size_t) = NULL;
void (*avc_func_free) (void *) = NULL;
void (*avc_func_log) (const char *, ...) = NULL;
void (*avc_func_audit) (void *, security_class_t, char *, size_t) = NULL;
int avc_using_threads = 0;
int avc_app_main_loop = 0;
void *(*avc_func_create_thread) (void (*)(void)) = NULL;
void (*avc_func_stop_thread) (void *) = NULL;
void *(*avc_func_alloc_lock) (void) = NULL;
void (*avc_func_get_lock) (void *) = NULL;
void (*avc_func_release_lock) (void *) = NULL;
void (*avc_func_free_lock) (void *) = NULL;
/* message prefix string and avc enforcing mode */
char avc_prefix[AVC_PREFIX_SIZE] = "uavc";
int avc_running = 0;
int avc_enforcing = 1;
int avc_setenforce = 0;
int avc_netlink_trouble = 0;
/* netlink socket code */
static int fd = -1;
int avc_netlink_open(int blocking)
{
int len, rc = 0;
struct sockaddr_nl addr;
fd = socket(PF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_SELINUX);
if (fd < 0) {
rc = fd;
goto out;
}
if (!blocking && fcntl(fd, F_SETFL, O_NONBLOCK)) {
close(fd);
fd = -1;
rc = -1;
goto out;
}
len = sizeof(addr);
memset(&addr, 0, len);
addr.nl_family = AF_NETLINK;
addr.nl_groups = SELNL_GRP_AVC;
if (bind(fd, (struct sockaddr *)&addr, len) < 0) {
close(fd);
fd = -1;
rc = -1;
goto out;
}
out:
return rc;
}
void avc_netlink_close(void)
{
if (fd >= 0)
close(fd);
fd = -1;
}
static int avc_netlink_receive(char *buf, unsigned buflen, int blocking)
{
int rc;
struct pollfd pfd = { fd, POLLIN | POLLPRI, 0 };
struct sockaddr_nl nladdr;
socklen_t nladdrlen = sizeof nladdr;
struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
do {
rc = poll(&pfd, 1, (blocking ? -1 : 0));
} while (rc < 0 && errno == EINTR);
if (rc == 0 && !blocking) {
errno = EWOULDBLOCK;
return -1;
}
else if (rc < 1) {
avc_log(SELINUX_ERROR, "%s: netlink poll: error %d\n",
avc_prefix, errno);
return rc;
}
rc = recvfrom(fd, buf, buflen, 0, (struct sockaddr *)&nladdr,
&nladdrlen);
if (rc < 0)
return rc;
if (nladdrlen != sizeof nladdr) {
avc_log(SELINUX_WARNING,
"%s: warning: netlink address truncated, len %d?\n",
avc_prefix, nladdrlen);
return -1;
}
if (nladdr.nl_pid) {
avc_log(SELINUX_WARNING,
"%s: warning: received spoofed netlink packet from: %d\n",
avc_prefix, nladdr.nl_pid);
return -1;
}
if (rc == 0) {
avc_log(SELINUX_WARNING,
"%s: warning: received EOF on netlink socket\n",
avc_prefix);
errno = EBADFD;
return -1;
}
if (nlh->nlmsg_flags & MSG_TRUNC || nlh->nlmsg_len > (unsigned)rc) {
avc_log(SELINUX_WARNING,
"%s: warning: incomplete netlink message\n",
avc_prefix);
return -1;
}
return 0;
}
static int avc_netlink_process(char *buf)
{
int rc;
struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
switch (nlh->nlmsg_type) {
case NLMSG_ERROR:{
struct nlmsgerr *err = NLMSG_DATA(nlh);
/* Netlink ack */
if (err->error == 0)
break;
errno = -err->error;
avc_log(SELINUX_ERROR,
"%s: netlink error: %d\n", avc_prefix, errno);
return -1;
}
case SELNL_MSG_SETENFORCE:{
struct selnl_msg_setenforce *msg = NLMSG_DATA(nlh);
avc_log(SELINUX_INFO,
"%s: received setenforce notice (enforcing=%d)\n",
avc_prefix, msg->val);
if (avc_setenforce)
break;
avc_enforcing = msg->val;
if (avc_enforcing && (rc = avc_ss_reset(0)) < 0) {
avc_log(SELINUX_ERROR,
"%s: cache reset returned %d (errno %d)\n",
avc_prefix, rc, errno);
return rc;
}
rc = selinux_netlink_setenforce(msg->val);
if (rc < 0)
return rc;
break;
}
case SELNL_MSG_POLICYLOAD:{
struct selnl_msg_policyload *msg = NLMSG_DATA(nlh);
avc_log(SELINUX_INFO,
"%s: received policyload notice (seqno=%d)\n",
avc_prefix, msg->seqno);
rc = avc_ss_reset(msg->seqno);
if (rc < 0) {
avc_log(SELINUX_ERROR,
"%s: cache reset returned %d (errno %d)\n",
avc_prefix, rc, errno);
return rc;
}
rc = selinux_netlink_policyload(msg->seqno);
if (rc < 0)
return rc;
break;
}
default:
avc_log(SELINUX_WARNING,
"%s: warning: unknown netlink message %d\n",
avc_prefix, nlh->nlmsg_type);
}
return 0;
}
int avc_netlink_check_nb(void)
{
int rc;
char buf[1024] __attribute__ ((aligned));
while (1) {
errno = 0;
rc = avc_netlink_receive(buf, sizeof(buf), 0);
if (rc < 0) {
if (errno == EWOULDBLOCK)
return 0;
if (errno == 0 || errno == EINTR)
continue;
else {
avc_log(SELINUX_ERROR,
"%s: netlink recvfrom: error %d\n",
avc_prefix, errno);
return rc;
}
}
(void)avc_netlink_process(buf);
}
return 0;
}
/* run routine for the netlink listening thread */
void avc_netlink_loop(void)
{
int rc;
char buf[1024] __attribute__ ((aligned));
while (1) {
errno = 0;
rc = avc_netlink_receive(buf, sizeof(buf), 1);
if (rc < 0) {
if (errno == 0 || errno == EINTR)
continue;
else {
avc_log(SELINUX_ERROR,
"%s: netlink recvfrom: error %d\n",
avc_prefix, errno);
break;
}
}
rc = avc_netlink_process(buf);
if (rc < 0)
break;
}
close(fd);
fd = -1;
avc_netlink_trouble = 1;
avc_log(SELINUX_ERROR,
"%s: netlink thread: errors encountered, terminating\n",
avc_prefix);
}
int avc_netlink_acquire_fd(void)
{
avc_app_main_loop = 1;
return fd;
}
void avc_netlink_release_fd(void)
{
avc_app_main_loop = 0;
}