1/*
2 * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
3 * Copyright (c) 2006 Damien Miller <djm@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18/*
19 * Linux-specific portability code - just SELinux support at present
20 */
21
22#include "includes.h"
23
24#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
25#include <errno.h>
26#include <stdarg.h>
27#include <string.h>
28#include <stdio.h>
29
30#include "log.h"
31#include "xmalloc.h"
32#include "port-linux.h"
33
34#ifdef WITH_SELINUX
35#include <selinux/selinux.h>
36#include <selinux/get_context_list.h>
37
38#ifndef SSH_SELINUX_UNCONFINED_TYPE
39# define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:"
40#endif
41
42/* Wrapper around is_selinux_enabled() to log its return value once only */
43int
44ssh_selinux_enabled(void)
45{
46	static int enabled = -1;
47
48	if (enabled == -1) {
49		enabled = (is_selinux_enabled() == 1);
50		debug("SELinux support %s", enabled ? "enabled" : "disabled");
51	}
52
53	return (enabled);
54}
55
56/* Return the default security context for the given username */
57static security_context_t
58ssh_selinux_getctxbyname(char *pwname)
59{
60	security_context_t sc = NULL;
61	char *sename = NULL, *lvl = NULL;
62	int r;
63
64#ifdef HAVE_GETSEUSERBYNAME
65	if (getseuserbyname(pwname, &sename, &lvl) != 0)
66		return NULL;
67#else
68	sename = pwname;
69	lvl = NULL;
70#endif
71
72#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
73	r = get_default_context_with_level(sename, lvl, NULL, &sc);
74#else
75	r = get_default_context(sename, NULL, &sc);
76#endif
77
78	if (r != 0) {
79		switch (security_getenforce()) {
80		case -1:
81			fatal("%s: ssh_selinux_getctxbyname: "
82			    "security_getenforce() failed", __func__);
83		case 0:
84			error("%s: Failed to get default SELinux security "
85			    "context for %s", __func__, pwname);
86			sc = NULL;
87			break;
88		default:
89			fatal("%s: Failed to get default SELinux security "
90			    "context for %s (in enforcing mode)",
91			    __func__, pwname);
92		}
93	}
94
95#ifdef HAVE_GETSEUSERBYNAME
96	free(sename);
97	free(lvl);
98#endif
99
100	return sc;
101}
102
103/* Set the execution context to the default for the specified user */
104void
105ssh_selinux_setup_exec_context(char *pwname)
106{
107	security_context_t user_ctx = NULL;
108
109	if (!ssh_selinux_enabled())
110		return;
111
112	debug3("%s: setting execution context", __func__);
113
114	user_ctx = ssh_selinux_getctxbyname(pwname);
115	if (setexeccon(user_ctx) != 0) {
116		switch (security_getenforce()) {
117		case -1:
118			fatal("%s: security_getenforce() failed", __func__);
119		case 0:
120			error("%s: Failed to set SELinux execution "
121			    "context for %s", __func__, pwname);
122			break;
123		default:
124			fatal("%s: Failed to set SELinux execution context "
125			    "for %s (in enforcing mode)", __func__, pwname);
126		}
127	}
128	if (user_ctx != NULL)
129		freecon(user_ctx);
130
131	debug3("%s: done", __func__);
132}
133
134/* Set the TTY context for the specified user */
135void
136ssh_selinux_setup_pty(char *pwname, const char *tty)
137{
138	security_context_t new_tty_ctx = NULL;
139	security_context_t user_ctx = NULL;
140	security_context_t old_tty_ctx = NULL;
141	security_class_t chrclass;
142
143	if (!ssh_selinux_enabled())
144		return;
145
146	debug3("%s: setting TTY context on %s", __func__, tty);
147
148	user_ctx = ssh_selinux_getctxbyname(pwname);
149
150	/* XXX: should these calls fatal() upon failure in enforcing mode? */
151
152	if (getfilecon(tty, &old_tty_ctx) == -1) {
153		error("%s: getfilecon: %s", __func__, strerror(errno));
154		goto out;
155	}
156	if ((chrclass = string_to_security_class("chr_file")) == 0) {
157		error("%s: couldn't get security class for chr_file", __func__);
158		goto out;
159	}
160	if (security_compute_relabel(user_ctx, old_tty_ctx,
161	    chrclass, &new_tty_ctx) != 0) {
162		error("%s: security_compute_relabel: %s",
163		    __func__, strerror(errno));
164		goto out;
165	}
166
167	if (setfilecon(tty, new_tty_ctx) != 0)
168		error("%s: setfilecon: %s", __func__, strerror(errno));
169 out:
170	if (new_tty_ctx != NULL)
171		freecon(new_tty_ctx);
172	if (old_tty_ctx != NULL)
173		freecon(old_tty_ctx);
174	if (user_ctx != NULL)
175		freecon(user_ctx);
176	debug3("%s: done", __func__);
177}
178
179void
180ssh_selinux_change_context(const char *newname)
181{
182	int len, newlen;
183	char *oldctx, *newctx, *cx;
184	void (*switchlog) (const char *fmt,...) = logit;
185
186	if (!ssh_selinux_enabled())
187		return;
188
189	if (getcon((security_context_t *)&oldctx) < 0) {
190		logit("%s: getcon failed with %s", __func__, strerror(errno));
191		return;
192	}
193	if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) ==
194	    NULL) {
195		logit ("%s: unparseable context %s", __func__, oldctx);
196		return;
197	}
198
199	/*
200	 * Check whether we are attempting to switch away from an unconfined
201	 * security context.
202	 */
203	if (strncmp(cx, SSH_SELINUX_UNCONFINED_TYPE,
204	    sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0)
205		switchlog = debug3;
206
207	newlen = strlen(oldctx) + strlen(newname) + 1;
208	newctx = xmalloc(newlen);
209	len = cx - oldctx + 1;
210	memcpy(newctx, oldctx, len);
211	strlcpy(newctx + len, newname, newlen - len);
212	if ((cx = index(cx + 1, ':')))
213		strlcat(newctx, cx, newlen);
214	debug3("%s: setting context from '%s' to '%s'", __func__,
215	    oldctx, newctx);
216	if (setcon(newctx) < 0)
217		switchlog("%s: setcon %s from %s failed with %s", __func__,
218		    newctx, oldctx, strerror(errno));
219	free(oldctx);
220	free(newctx);
221}
222
223void
224ssh_selinux_setfscreatecon(const char *path)
225{
226	security_context_t context;
227
228	if (!ssh_selinux_enabled())
229		return;
230	if (path == NULL) {
231		setfscreatecon(NULL);
232		return;
233	}
234	if (matchpathcon(path, 0700, &context) == 0)
235		setfscreatecon(context);
236}
237
238#endif /* WITH_SELINUX */
239
240#ifdef LINUX_OOM_ADJUST
241/*
242 * The magic "don't kill me" values, old and new, as documented in eg:
243 * http://lxr.linux.no/#linux+v2.6.32/Documentation/filesystems/proc.txt
244 * http://lxr.linux.no/#linux+v2.6.36/Documentation/filesystems/proc.txt
245 */
246
247static int oom_adj_save = INT_MIN;
248static char *oom_adj_path = NULL;
249struct {
250	char *path;
251	int value;
252} oom_adjust[] = {
253	{"/proc/self/oom_score_adj", -1000},	/* kernels >= 2.6.36 */
254	{"/proc/self/oom_adj", -17},		/* kernels <= 2.6.35 */
255	{NULL, 0},
256};
257
258/*
259 * Tell the kernel's out-of-memory killer to avoid sshd.
260 * Returns the previous oom_adj value or zero.
261 */
262void
263oom_adjust_setup(void)
264{
265	int i, value;
266	FILE *fp;
267
268	debug3("%s", __func__);
269	 for (i = 0; oom_adjust[i].path != NULL; i++) {
270		oom_adj_path = oom_adjust[i].path;
271		value = oom_adjust[i].value;
272		if ((fp = fopen(oom_adj_path, "r+")) != NULL) {
273			if (fscanf(fp, "%d", &oom_adj_save) != 1)
274				verbose("error reading %s: %s", oom_adj_path,
275				    strerror(errno));
276			else {
277				rewind(fp);
278				if (fprintf(fp, "%d\n", value) <= 0)
279					verbose("error writing %s: %s",
280					   oom_adj_path, strerror(errno));
281				else
282					debug("Set %s from %d to %d",
283					   oom_adj_path, oom_adj_save, value);
284			}
285			fclose(fp);
286			return;
287		}
288	}
289	oom_adj_path = NULL;
290}
291
292/* Restore the saved OOM adjustment */
293void
294oom_adjust_restore(void)
295{
296	FILE *fp;
297
298	debug3("%s", __func__);
299	if (oom_adj_save == INT_MIN || oom_adj_path == NULL ||
300	    (fp = fopen(oom_adj_path, "w")) == NULL)
301		return;
302
303	if (fprintf(fp, "%d\n", oom_adj_save) <= 0)
304		verbose("error writing %s: %s", oom_adj_path, strerror(errno));
305	else
306		debug("Set %s to %d", oom_adj_path, oom_adj_save);
307
308	fclose(fp);
309	return;
310}
311#endif /* LINUX_OOM_ADJUST */
312#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
313