xref: /third_party/selinux/libselinux/src/selinux_config.c

#include <stdio.h>
#include <stdio_ext.h>
#include <string.h>
#include <ctype.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <limits.h>
#include <unistd.h>
#include <pthread.h>
#include <errno.h>
#include "policy.h"
#include "selinux_internal.h"
#include "get_default_type_internal.h"

#define SELINUXDEFAULT "targeted"
#define SELINUXTYPETAG "SELINUXTYPE="
#define SELINUXTAG "SELINUX="
#define REQUIRESEUSERS "REQUIRESEUSERS="

/* Indices for file paths arrays. */
#define BINPOLICY         0
#define CONTEXTS_DIR      1
#define FILE_CONTEXTS     2
#define HOMEDIR_CONTEXTS  3
#define DEFAULT_CONTEXTS  4
#define USER_CONTEXTS     5
#define FAILSAFE_CONTEXT  6
#define DEFAULT_TYPE      7
/* BOOLEANS is deprecated */
#define BOOLEANS          8
#define MEDIA_CONTEXTS    9
#define REMOVABLE_CONTEXT 10
#define CUSTOMIZABLE_TYPES    11
/* USERS_DIR is deprecated */
#define USERS_DIR         12
#define SEUSERS           13
#define TRANSLATIONS      14
#define NETFILTER_CONTEXTS    15
#define FILE_CONTEXTS_HOMEDIR 16
#define FILE_CONTEXTS_LOCAL 17
#define SECURETTY_TYPES   18
#define X_CONTEXTS        19
#define COLORS            20
#define VIRTUAL_DOMAIN    21
#define VIRTUAL_IMAGE     22
#define FILE_CONTEXT_SUBS 23
#define SEPGSQL_CONTEXTS  24
#define FILE_CONTEXT_SUBS_DIST 25
#define LXC_CONTEXTS      26
#define BOOLEAN_SUBS      27
#define OPENSSH_CONTEXTS  28
#define SYSTEMD_CONTEXTS  29
#define SNAPPERD_CONTEXTS 30
#define OPENRC_CONTEXTS   31
#define NEL               32

/* Part of one-time lazy init */
static pthread_once_t once = PTHREAD_ONCE_INIT;
static void init_selinux_config(void);

/* New layout is relative to SELINUXDIR/policytype. */
static char *file_paths[NEL];
#define L1(l) L2(l)
#define L2(l)str##l
static const union file_path_suffixes_data {
	struct {
#define S_(n, s) char L1(__LINE__)[sizeof(s)];
#include "file_path_suffixes.h"
#undef S_
	};
	char str[0];
} file_path_suffixes_data = {
	{
#define S_(n, s) s,
#include "file_path_suffixes.h"
#undef S_
	}
};
static const uint16_t file_path_suffixes_idx[NEL] = {
#define S_(n, s) [n] = offsetof(union file_path_suffixes_data, L1(__LINE__)),
#include "file_path_suffixes.h"
#undef S_
};

#undef L1
#undef L2

int selinux_getenforcemode(int *enforce)
{
	int ret = -1;
	FILE *cfg = fopen(SELINUXCONFIG, "re");
	if (cfg) {
		char *buf;
		char *tag;
		int len = sizeof(SELINUXTAG) - 1;
		buf = malloc(selinux_page_size);
		if (!buf) {
			fclose(cfg);
			return -1;
		}
		while (fgets_unlocked(buf, selinux_page_size, cfg)) {
			if (strncmp(buf, SELINUXTAG, len))
				continue;
			tag = buf+len;
			while (isspace(*tag))
				tag++;
			if (!strncasecmp
			    (tag, "enforcing", sizeof("enforcing") - 1)) {
				*enforce = 1;
				ret = 0;
				break;
			} else
			    if (!strncasecmp
				(tag, "permissive",
				 sizeof("permissive") - 1)) {
				*enforce = 0;
				ret = 0;
				break;
			} else
			    if (!strncasecmp
				(tag, "disabled",
				 sizeof("disabled") - 1)) {
				*enforce = -1;
				ret = 0;
				break;
			}
		}
		fclose(cfg);
		free(buf);
	}
	return ret;
}


static char *selinux_policytype;

int selinux_getpolicytype(char **type)
{
	__selinux_once(once, init_selinux_config);
	if (!selinux_policytype)
		return -1;
	*type = strdup(selinux_policytype);
	return *type ? 0 : -1;
}


static int setpolicytype(const char *type)
{
	free(selinux_policytype);
	selinux_policytype = strdup(type);
	return selinux_policytype ? 0 : -1;
}

static char *selinux_policyroot = NULL;
static const char *selinux_rootpath = SELINUXDIR;

static void init_selinux_config(void)
{
	int i, *intptr;
	size_t line_len;
	ssize_t len;
	char *line_buf = NULL, *buf_p, *value, *type = NULL, *end;
	FILE *fp;

	if (selinux_policyroot)
		return;

	fp = fopen(SELINUXCONFIG, "re");
	if (fp) {
		__fsetlocking(fp, FSETLOCKING_BYCALLER);
		while ((len = getline(&line_buf, &line_len, fp)) > 0) {
			if (line_buf[len - 1] == '\n')
				line_buf[len - 1] = 0;
			buf_p = line_buf;
			while (isspace(*buf_p))
				buf_p++;
			if (*buf_p == '#' || *buf_p == 0)
				continue;

			if (!strncasecmp(buf_p, SELINUXTYPETAG,
					 sizeof(SELINUXTYPETAG) - 1)) {
				buf_p += sizeof(SELINUXTYPETAG) - 1;
				while (isspace(*buf_p))
					buf_p++;
				type = strdup(buf_p);
				if (!type) {
					free(line_buf);
					fclose(fp);
					return;
				}
				end = type + strlen(type) - 1;
				while ((end > type) &&
				       (isspace(*end) || iscntrl(*end))) {
					*end = 0;
					end--;
				}
				if (setpolicytype(type) != 0) {
					free(type);
					free(line_buf);
					fclose(fp);
					return;
				}
				free(type);
				continue;
			} else if (!strncmp(buf_p, REQUIRESEUSERS,
					    sizeof(REQUIRESEUSERS) - 1)) {
				value = buf_p + sizeof(REQUIRESEUSERS) - 1;
				while (isspace(*value))
					value++;
				intptr = &require_seusers;
			} else {
				continue;
			}

			if (isdigit(*value))
				*intptr = atoi(value);
			else if (strncasecmp(value, "true", sizeof("true") - 1))
				*intptr = 1;
			else if (strncasecmp
				 (value, "false", sizeof("false") - 1))
				*intptr = 0;
		}
		free(line_buf);
		fclose(fp);
	}

	if (!selinux_policytype && setpolicytype(SELINUXDEFAULT) != 0)
		return;

	if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, selinux_policytype) == -1)
		return;

	for (i = 0; i < NEL; i++)
		if (asprintf(&file_paths[i], "%s%s",
			     selinux_policyroot,
			     file_path_suffixes_data.str +
			     file_path_suffixes_idx[i])
		    == -1)
			return;
}

static void fini_selinux_policyroot(void) __attribute__ ((destructor));

static void fini_selinux_policyroot(void)
{
	int i;
	free(selinux_policyroot);
	selinux_policyroot = NULL;
	for (i = 0; i < NEL; i++) {
		free(file_paths[i]);
		file_paths[i] = NULL;
	}
	free(selinux_policytype);
	selinux_policytype = NULL;
}

void selinux_reset_config(void)
{
	fini_selinux_policyroot();
	init_selinux_config();
}


static const char *get_path(int idx)
{
	__selinux_once(once, init_selinux_config);
	return file_paths[idx];
}

const char *selinux_default_type_path(void)
{
	return get_path(DEFAULT_TYPE);
}


const char *selinux_policy_root(void)
{
	__selinux_once(once, init_selinux_config);
	return selinux_policyroot;
}

int selinux_set_policy_root(const char *path)
{
	int i;
	char *policy_type = strrchr(path, '/');
	if (!policy_type) {
		errno = EINVAL;
		return -1;
	}
	policy_type++;

	fini_selinux_policyroot();

	selinux_policyroot = strdup(path);
	if (! selinux_policyroot)
		return -1;

	if (setpolicytype(policy_type) != 0)
		return -1;

	for (i = 0; i < NEL; i++)
		if (asprintf(&file_paths[i], "%s%s",
			     selinux_policyroot,
			     file_path_suffixes_data.str +
			     file_path_suffixes_idx[i])
		    == -1)
			return -1;

	return 0;
}

const char *selinux_path(void)
{
	return selinux_rootpath;
}


const char *selinux_default_context_path(void)
{
	return get_path(DEFAULT_CONTEXTS);
}


const char *selinux_securetty_types_path(void)
{
	return get_path(SECURETTY_TYPES);
}


const char *selinux_failsafe_context_path(void)
{
	return get_path(FAILSAFE_CONTEXT);
}


const char *selinux_removable_context_path(void)
{
	return get_path(REMOVABLE_CONTEXT);
}


const char *selinux_binary_policy_path(void)
{
	return get_path(BINPOLICY);
}


const char *selinux_current_policy_path(void)
{
	int rc = 0;
	int vers = 0;
	static char policy_path[PATH_MAX];

	if (selinux_mnt) {
		snprintf(policy_path, sizeof(policy_path), "%s/policy", selinux_mnt);
		if (access(policy_path, F_OK) == 0 ) {
			return policy_path;
		}
	}
	vers = security_policyvers();
	do {
		/* Check prior versions to see if old policy is available */
		snprintf(policy_path, sizeof(policy_path), "%s.%d",
			 selinux_binary_policy_path(), vers);
	} while ((rc = access(policy_path, F_OK)) && --vers > 0);

	if (rc) return NULL;
	return policy_path;
}


const char *selinux_file_context_path(void)
{
	return get_path(FILE_CONTEXTS);
}


const char *selinux_homedir_context_path(void)
{
	return get_path(HOMEDIR_CONTEXTS);
}


const char *selinux_media_context_path(void)
{
	return get_path(MEDIA_CONTEXTS);
}


const char *selinux_customizable_types_path(void)
{
	return get_path(CUSTOMIZABLE_TYPES);
}


const char *selinux_contexts_path(void)
{
	return get_path(CONTEXTS_DIR);
}

const char *selinux_user_contexts_path(void)
{
	return get_path(USER_CONTEXTS);
}


/* Deprecated as local policy booleans no longer supported. */
const char *selinux_booleans_path(void)
{
	return get_path(BOOLEANS);
}


/* Deprecated as no longer supported. */
const char *selinux_users_path(void)
{
	return get_path(USERS_DIR);
}


const char *selinux_usersconf_path(void)
{
	return get_path(SEUSERS);
}


const char *selinux_translations_path(void)
{
	return get_path(TRANSLATIONS);
}


const char *selinux_colors_path(void)
{
	return get_path(COLORS);
}


const char *selinux_netfilter_context_path(void)
{
	return get_path(NETFILTER_CONTEXTS);
}


const char *selinux_file_context_homedir_path(void)
{
	return get_path(FILE_CONTEXTS_HOMEDIR);
}


const char *selinux_file_context_local_path(void)
{
	return get_path(FILE_CONTEXTS_LOCAL);
}


const char *selinux_x_context_path(void)
{
	return get_path(X_CONTEXTS);
}


const char *selinux_virtual_domain_context_path(void)
{
	return get_path(VIRTUAL_DOMAIN);
}


const char *selinux_virtual_image_context_path(void)
{
	return get_path(VIRTUAL_IMAGE);
}


const char *selinux_lxc_contexts_path(void)
{
	return get_path(LXC_CONTEXTS);
}


const char *selinux_openrc_contexts_path(void)
{
    return get_path(OPENRC_CONTEXTS);
}


const char *selinux_openssh_contexts_path(void)
{
    return get_path(OPENSSH_CONTEXTS);
}


const char *selinux_snapperd_contexts_path(void)
{
    return get_path(SNAPPERD_CONTEXTS);
}


const char *selinux_systemd_contexts_path(void)
{
	return get_path(SYSTEMD_CONTEXTS);
}


const char * selinux_booleans_subs_path(void) {
	return get_path(BOOLEAN_SUBS);
}


const char * selinux_file_context_subs_path(void) {
	return get_path(FILE_CONTEXT_SUBS);
}


const char * selinux_file_context_subs_dist_path(void) {
	return get_path(FILE_CONTEXT_SUBS_DIST);
}


const char *selinux_sepgsql_context_path(void)
{
	return get_path(SEPGSQL_CONTEXTS);
}