Exemple #1
0
int semanage_module_remove(semanage_handle_t * sh, char *module_name)
{
	if (sh->funcs->remove == NULL) {
		ERR(sh, "No remove function defined for this connection type.");
		return -1;
	} else if (!sh->is_connected) {
		ERR(sh, "Not connected.");
		return -1;
	} else if (!sh->is_in_transaction) {
		if (semanage_begin_transaction(sh) < 0) {
			return -1;
		}
	}
	sh->modules_modified = 1;
	return sh->funcs->remove(sh, module_name);
}
Exemple #2
0
static semanage_handle_t *semanage_init (void)
{
	int ret;
	semanage_handle_t *handle = NULL;

	handle = semanage_handle_create ();
	if (NULL == handle) {
		fprintf (stderr,
		         _("Cannot create SELinux management handle\n"));
		return NULL;
	}

	semanage_msg_set_callback (handle, semanage_error_callback, NULL);

	ret = semanage_is_managed (handle);
	if (ret != 1) {
		fprintf (stderr, _("SELinux policy not managed\n"));
		goto fail;
	}

	ret = semanage_access_check (handle);
	if (ret < SEMANAGE_CAN_READ) {
		fprintf (stderr, _("Cannot read SELinux policy store\n"));
		goto fail;
	}

	ret = semanage_connect (handle);
	if (ret != 0) {
		fprintf (stderr,
		         _("Cannot establish SELinux management connection\n"));
		goto fail;
	}

	ret = semanage_begin_transaction (handle);
	if (ret != 0) {
		fprintf (stderr, _("Cannot begin SELinux transaction\n"));
		goto fail;
	}

	return handle;

fail:
	semanage_handle_destroy (handle);
	return NULL;
}
Exemple #3
0
int semanage_module_install_hll(semanage_handle_t * sh,
			    char *module_data, size_t data_len, const char *name, const char *ext_lang)
{
	if (sh->funcs->install == NULL) {
		ERR(sh,
		    "No install function defined for this connection type.");
		return -1;
	} else if (!sh->is_connected) {
		ERR(sh, "Not connected.");
		return -1;
	} else if (!sh->is_in_transaction) {
		if (semanage_begin_transaction(sh) < 0) {
			return -1;
		}
	}
	sh->modules_modified = 1;
	return sh->funcs->install(sh, module_data, data_len, name, ext_lang);
}
Exemple #4
0
static sepoltrans *sepoltransNew(void)
{
    sepoltrans *pt = xcalloc(1, sizeof(*pt));
    pt->semodulepath = rpmExpand("%{__semodule}", NULL);
    pt->execsemodule = (!rpmChrootDone() && access(pt->semodulepath, X_OK) == 0);
    pt->changes = 0;

    if (pt->execsemodule) {
	argvAdd(&pt->semodargs, "semodule");
    } else {
	pt->sh = semanage_handle_create();
	if (!pt->sh) {
	    rpmlog(RPMLOG_ERR, _("Failed to create semanage handle\n"));
	    goto err;
	}
	semanage_set_create_store(pt->sh, 1);
	semanage_set_check_contexts(pt->sh, 0);
	if (semanage_connect(pt->sh) < 0) {
	    rpmlog(RPMLOG_ERR, _("Failed to connect to policy handler\n"));
	    goto err;
	}
	if (semanage_begin_transaction(pt->sh) < 0) {
	    rpmlog(RPMLOG_ERR, _("Failed to begin policy transaction: %s\n"),
		   errno ? strerror(errno) : "");
	    goto err;
	}
	semanage_set_reload(pt->sh, !rpmChrootDone());
    }

    return pt;

  err:
    if (pt->sh) {
	if (semanage_is_connected(pt->sh)) {
	    semanage_disconnect(pt->sh);
	}
	semanage_handle_destroy(pt->sh);
    }
    free(pt);

    return NULL;
}
Exemple #5
0
int main(int argc, char *argv[])
{
	int i, commit = 0;
	int result;
	int status = EXIT_FAILURE;
	char *genhomedirconargv[] = { "genhomedircon", "-B", "-n" };
	create_signal_handlers();
	if (strcmp(basename(argv[0]), "genhomedircon") == 0) {
		argc = 3;
		argv=genhomedirconargv;
	}
	parse_command_line(argc, argv);

	if (build)
		commit = 1;

	sh = semanage_handle_create();
	if (!sh) {
		fprintf(stderr, "%s:  Could not create semanage handle\n",
			argv[0]);
		goto cleanup_nohandle;
	}

	if (store) {
		/* Set the store we want to connect to, before connecting.
		 * this will always set a direct connection now, an additional
		 * option will need to be used later to specify a policy server 
		 * location */
		semanage_select_store(sh, store, SEMANAGE_CON_DIRECT);
	}

	/* if installing base module create store if necessary, for bootstrapping */
	semanage_set_create_store(sh, create_store);

	if (!create_store) {
		if (!semanage_is_managed(sh)) {
			fprintf(stderr,
				"%s: SELinux policy is not managed or store cannot be accessed.\n",
				argv[0]);
			goto cleanup;
		}

		if (semanage_access_check(sh) < SEMANAGE_CAN_READ) {
			fprintf(stderr, "%s: Cannot read policy store.\n",
				argv[0]);
			goto cleanup;
		}
	}

	if ((result = semanage_connect(sh)) < 0) {
		fprintf(stderr, "%s:  Could not connect to policy handler\n",
			argv[0]);
		goto cleanup;
	}

	if (reload) {
		if ((result = semanage_reload_policy(sh)) < 0) {
			fprintf(stderr, "%s:  Could not reload policy\n",
				argv[0]);
			goto cleanup;
		}
	}

	if (build) {
		if ((result = semanage_begin_transaction(sh)) < 0) {
			fprintf(stderr, "%s:  Could not begin transaction:  %s\n",
				argv[0], errno ? strerror(errno) : "");
			goto cleanup;
		}
	}

	for (i = 0; i < num_commands; i++) {
		enum client_modes mode = commands[i].mode;
		char *mode_arg = commands[i].arg;
		switch (mode) {
		case INSTALL_M:{
				if (verbose) {
					printf
					    ("Attempting to install module '%s':\n",
					     mode_arg);
				}
				result =
				    semanage_module_install_file(sh, mode_arg);
				break;
			}
		case UPGRADE_M:{
				if (verbose) {
					printf
					    ("Attempting to upgrade module '%s':\n",
					     mode_arg);
				}
				result =
				    semanage_module_upgrade_file(sh, mode_arg);
				break;
			}
		case BASE_M:{
				if (verbose) {
					printf
					    ("Attempting to install base module '%s':\n",
					     mode_arg);
				}
				result =
				    semanage_module_install_base_file(sh, mode_arg);
				break;
			}
		case ENABLE_M:{
				if (verbose) {
					printf
					    ("Attempting to enable module '%s':\n",
					     mode_arg);
				}
				result = semanage_module_enable(sh, mode_arg);
				if ( result == -2 ) { 
					continue;
				}
				break;
			}
		case DISABLE_M:{
				if (verbose) {
					printf
					    ("Attempting to disable module '%s':\n",
					     mode_arg);
				}
				result = semanage_module_disable(sh, mode_arg);
				if ( result == -2 ) { 
					continue;
				}
				break;
			}
		case REMOVE_M:{
				if (verbose) {
					printf
					    ("Attempting to remove module '%s':\n",
					     mode_arg);
				}
				result = semanage_module_remove(sh, mode_arg);
				if ( result == -2 ) { 
					continue;
				}
				break;
			}
		case LIST_M:{
				semanage_module_info_t *modinfo;
				int num_modules;
				if (verbose) {
					printf
					    ("Attempting to list active modules:\n");
				}
				if ((result =
				     semanage_module_list(sh, &modinfo,
							  &num_modules)) >= 0) {
					int j;
					if (num_modules == 0) {
						printf("No modules.\n");
					}
					for (j = 0; j < num_modules; j++) {
						semanage_module_info_t *m =
						    semanage_module_list_nth
						    (modinfo, j);
						printf("%s\t%s\t%s\n",
						       semanage_module_get_name
						       (m),
						       semanage_module_get_version
						       (m), 
						       (semanage_module_get_enabled(m) ? "" : "Disabled"));
						semanage_module_info_datum_destroy
						    (m);
					}
					free(modinfo);
				}
				break;
			}
		default:{
				fprintf(stderr,
					"%s:  Unknown mode specified.\n",
					argv[0]);
				usage(argv[0]);
				goto cleanup;
			}
		}
		commit += do_commit[mode];
		if (result < 0) {
			fprintf(stderr, "%s:  Failed on %s!\n", argv[0],
				mode_arg ? : "list");
			goto cleanup;
		} else if (verbose) {
Exemple #6
0
int del_seuser(const char *login_name)
{
    semanage_handle_t *handle = NULL;
    semanage_seuser_key_t *key = NULL;
    int ret;
    int exists = 0;

    handle = sss_semanage_init();
    if (!handle) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init SELinux management\n");
        ret = EIO;
        goto done;
    }

    ret = semanage_begin_transaction(handle);
    if (ret != 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot begin SELinux transaction\n");
        ret = EIO;
        goto done;
    }

    ret = semanage_seuser_key_create(handle, login_name, &key);
    if (ret != 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux user key\n");
        ret = EIO;
        goto done;
    }

    ret = semanage_seuser_exists(handle, key, &exists);
    if (ret < 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot verify the SELinux user\n");
        ret = EIO;
        goto done;
    }

    if (!exists) {
        DEBUG(SSSDBG_FUNC_DATA,
              "Login mapping for %s is not defined, OK if default mapping "
                  "was used\n", login_name);
        ret = EOK;  /* probably default mapping */
        goto done;
    }

    ret = semanage_seuser_exists_local(handle, key, &exists);
    if (ret < 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot verify the SELinux user\n");
        ret = EIO;
        goto done;
    }

    if (!exists) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              "Login mapping for %s is defined in policy, cannot be deleted\n",
              login_name);
        ret = ENOENT;
        goto done;
    }

    ret = semanage_seuser_del_local(handle, key);
    if (ret != 0) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              "Could not delete login mapping for %s\n", login_name);
        ret = EIO;
        goto done;
    }

    ret = semanage_commit(handle);
    if (ret < 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot commit SELinux transaction\n");
        ret = EIO;
        goto done;
    }

    ret = EOK;
done:
    sss_semanage_close(handle);
    return ret;
}
Exemple #7
0
int set_seuser(const char *login_name, const char *seuser_name,
               const char *mls)
{
    semanage_handle_t *handle = NULL;
    semanage_seuser_key_t *key = NULL;
    int ret;
    int seuser_exists = 0;

    if (seuser_name == NULL) {
        /* don't care, just let system pick the defaults */
        return EOK;
    }

    handle = sss_semanage_init();
    if (!handle) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init SELinux management\n");
        ret = EIO;
        goto done;
    }

    ret = semanage_begin_transaction(handle);
    if (ret != 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot begin SELinux transaction\n");
        ret = EIO;
        goto done;
    }

    ret = semanage_seuser_key_create(handle, login_name, &key);
    if (ret != 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux user key\n");
        ret = EIO;
        goto done;
    }

    ret = semanage_seuser_exists(handle, key, &seuser_exists);
    if (ret < 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot verify the SELinux user\n");
        ret = EIO;
        goto done;
    }

    if (seuser_exists) {
        ret = sss_semanage_user_mod(handle, key, login_name, seuser_name,
                                    mls);
        if (ret != 0) {
            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot modify SELinux user mapping\n");
            ret = EIO;
            goto done;
        }
    } else {
        ret = sss_semanage_user_add(handle, key, login_name, seuser_name,
                                    mls);
        if (ret != 0) {
            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot add SELinux user mapping\n");
            ret = EIO;
            goto done;
        }
    }

    ret = semanage_commit(handle);
    if (ret < 0) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot commit SELinux transaction\n");
        ret = EIO;
        goto done;
    }

    ret = EOK;
done:
    semanage_seuser_key_free(key);
    sss_semanage_close(handle);
    return ret;
}
/* Apply permanent boolean changes to policy via libsemanage */
static int semanage_set_boolean_list(size_t boolcnt,
				     SELboolean * boollist)
{

	size_t j;
	semanage_handle_t *handle = NULL;
	semanage_bool_t *boolean = NULL;
	semanage_bool_key_t *bool_key = NULL;
	int managed;

	handle = semanage_handle_create();
	if (handle == NULL) {
		fprintf(stderr, "Could not create semanage library handle\n");
		goto err;
	}

	managed = semanage_is_managed(handle);
	if (managed < 0) {
		fprintf(stderr,
			"Error when checking whether policy is managed\n");
		goto err;

	} else if (managed == 0) {
		if (getuid() == 0) {
			fprintf(stderr,
				"Cannot set persistent booleans without managed policy.\n");
		} else {
			fprintf(stderr,
				"Cannot set persistent booleans, please try as root.\n");
		}
		goto err;
	}

	if (semanage_connect(handle) < 0)
		goto err;

	if (semanage_begin_transaction(handle) < 0)
		goto err;

	for (j = 0; j < boolcnt; j++) {

		if (semanage_bool_create(handle, &boolean) < 0)
			goto err;

		if (semanage_bool_set_name(handle, boolean, boollist[j].name) <
		    0)
			goto err;

		semanage_bool_set_value(boolean, boollist[j].value);

		if (semanage_bool_key_extract(handle, boolean, &bool_key) < 0)
			goto err;

		if (semanage_bool_modify_local(handle, bool_key,
						  boolean) < 0)
			goto err;

		if (semanage_bool_set_active(handle, bool_key, boolean) < 0) {
			fprintf(stderr, "Could not change boolean %s\n",
				boollist[j].name);
			goto err;
		}
		semanage_bool_key_free(bool_key);
		semanage_bool_free(boolean);
		bool_key = NULL;
		boolean = NULL;
	}

	semanage_set_reload(handle, reload);
	if (semanage_commit(handle) < 0)
		goto err;

	semanage_disconnect(handle);
	semanage_handle_destroy(handle);
	return 0;

      err:
	semanage_bool_key_free(bool_key);
	semanage_bool_free(boolean);
	semanage_handle_destroy(handle);
	fprintf(stderr, "Could not change policy booleans\n");
	return -1;
}