1 /* 2 * Callbacks for user-supplied memory allocation, supplemental 3 * auditing, and locking routines. 4 * 5 * Author : Eamon Walsh <ewalsh (at) epoch.ncsc.mil> 6 * 7 * Netlink code derived in part from sample code by 8 * James Morris <jmorris (at) redhat.com>. 9 */ 10 11 #include <errno.h> 12 #include <stdio.h> 13 #include <stdlib.h> 14 #include <stdint.h> 15 #include <unistd.h> 16 #include <fcntl.h> 17 #include <string.h> 18 #include <poll.h> 19 #include <sys/types.h> 20 #include <sys/socket.h> 21 #include <linux/types.h> 22 #include <linux/netlink.h> 23 #include "callbacks.h" 24 #include "selinux_netlink.h" 25 #include "avc_internal.h" 26 27 #ifndef NETLINK_SELINUX 28 #define NETLINK_SELINUX 7 29 #endif 30 31 /* callback pointers */ 32 void *(*avc_func_malloc) (size_t) = NULL; 33 void (*avc_func_free) (void *) = NULL; 34 35 void (*avc_func_log) (const char *, ...) = NULL; 36 void (*avc_func_audit) (void *, security_class_t, char *, size_t) = NULL; 37 38 int avc_using_threads = 0; 39 int avc_app_main_loop = 0; 40 void *(*avc_func_create_thread) (void (*)(void)) = NULL; 41 void (*avc_func_stop_thread) (void *) = NULL; 42 43 void *(*avc_func_alloc_lock) (void) = NULL; 44 void (*avc_func_get_lock) (void *) = NULL; 45 void (*avc_func_release_lock) (void *) = NULL; 46 void (*avc_func_free_lock) (void *) = NULL; 47 48 /* message prefix string and avc enforcing mode */ 49 char avc_prefix[AVC_PREFIX_SIZE] = "uavc"; 50 int avc_running = 0; 51 int avc_enforcing = 1; 52 int avc_setenforce = 0; 53 int avc_netlink_trouble = 0; 54 55 /* netlink socket code */ 56 static int fd = -1; 57 58 int avc_netlink_open(int blocking) 59 { 60 int len, rc = 0; 61 struct sockaddr_nl addr; 62 63 fd = socket(PF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_SELINUX); 64 if (fd < 0) { 65 rc = fd; 66 goto out; 67 } 68 69 if (!blocking && fcntl(fd, F_SETFL, O_NONBLOCK)) { 70 close(fd); 71 fd = -1; 72 rc = -1; 73 goto out; 74 } 75 76 len = sizeof(addr); 77 78 memset(&addr, 0, len); 79 addr.nl_family = AF_NETLINK; 80 addr.nl_groups = SELNL_GRP_AVC; 81 82 if (bind(fd, (struct sockaddr *)&addr, len) < 0) { 83 close(fd); 84 fd = -1; 85 rc = -1; 86 goto out; 87 } 88 out: 89 return rc; 90 } 91 92 void avc_netlink_close(void) 93 { 94 if (fd >= 0) 95 close(fd); 96 fd = -1; 97 } 98 99 static int avc_netlink_receive(char *buf, unsigned buflen, int blocking) 100 { 101 int rc; 102 struct pollfd pfd = { fd, POLLIN | POLLPRI, 0 }; 103 struct sockaddr_nl nladdr; 104 socklen_t nladdrlen = sizeof nladdr; 105 struct nlmsghdr *nlh = (struct nlmsghdr *)buf; 106 107 do { 108 rc = poll(&pfd, 1, (blocking ? -1 : 0)); 109 } while (rc < 0 && errno == EINTR); 110 111 if (rc == 0 && !blocking) { 112 errno = EWOULDBLOCK; 113 return -1; 114 } 115 else if (rc < 1) { 116 avc_log(SELINUX_ERROR, "%s: netlink poll: error %d\n", 117 avc_prefix, errno); 118 return rc; 119 } 120 121 rc = recvfrom(fd, buf, buflen, 0, (struct sockaddr *)&nladdr, 122 &nladdrlen); 123 if (rc < 0) 124 return rc; 125 126 if (nladdrlen != sizeof nladdr) { 127 avc_log(SELINUX_WARNING, 128 "%s: warning: netlink address truncated, len %d?\n", 129 avc_prefix, nladdrlen); 130 return -1; 131 } 132 133 if (nladdr.nl_pid) { 134 avc_log(SELINUX_WARNING, 135 "%s: warning: received spoofed netlink packet from: %d\n", 136 avc_prefix, nladdr.nl_pid); 137 return -1; 138 } 139 140 if (rc == 0) { 141 avc_log(SELINUX_WARNING, 142 "%s: warning: received EOF on netlink socket\n", 143 avc_prefix); 144 errno = EBADFD; 145 return -1; 146 } 147 148 if (nlh->nlmsg_flags & MSG_TRUNC || nlh->nlmsg_len > (unsigned)rc) { 149 avc_log(SELINUX_WARNING, 150 "%s: warning: incomplete netlink message\n", 151 avc_prefix); 152 return -1; 153 } 154 155 return 0; 156 } 157 158 static int avc_netlink_process(char *buf) 159 { 160 int rc; 161 struct nlmsghdr *nlh = (struct nlmsghdr *)buf; 162 163 switch (nlh->nlmsg_type) { 164 case NLMSG_ERROR:{ 165 struct nlmsgerr *err = NLMSG_DATA(nlh); 166 167 /* Netlink ack */ 168 if (err->error == 0) 169 break; 170 171 errno = -err->error; 172 avc_log(SELINUX_ERROR, 173 "%s: netlink error: %d\n", avc_prefix, errno); 174 return -1; 175 } 176 177 case SELNL_MSG_SETENFORCE:{ 178 struct selnl_msg_setenforce *msg = NLMSG_DATA(nlh); 179 avc_log(SELINUX_INFO, 180 "%s: received setenforce notice (enforcing=%d)\n", 181 avc_prefix, msg->val); 182 if (avc_setenforce) 183 break; 184 avc_enforcing = msg->val; 185 if (avc_enforcing && (rc = avc_ss_reset(0)) < 0) { 186 avc_log(SELINUX_ERROR, 187 "%s: cache reset returned %d (errno %d)\n", 188 avc_prefix, rc, errno); 189 return rc; 190 } 191 rc = selinux_netlink_setenforce(msg->val); 192 if (rc < 0) 193 return rc; 194 break; 195 } 196 197 case SELNL_MSG_POLICYLOAD:{ 198 struct selnl_msg_policyload *msg = NLMSG_DATA(nlh); 199 avc_log(SELINUX_INFO, 200 "%s: received policyload notice (seqno=%d)\n", 201 avc_prefix, msg->seqno); 202 rc = avc_ss_reset(msg->seqno); 203 if (rc < 0) { 204 avc_log(SELINUX_ERROR, 205 "%s: cache reset returned %d (errno %d)\n", 206 avc_prefix, rc, errno); 207 return rc; 208 } 209 rc = selinux_netlink_policyload(msg->seqno); 210 if (rc < 0) 211 return rc; 212 break; 213 } 214 215 default: 216 avc_log(SELINUX_WARNING, 217 "%s: warning: unknown netlink message %d\n", 218 avc_prefix, nlh->nlmsg_type); 219 } 220 return 0; 221 } 222 223 int avc_netlink_check_nb(void) 224 { 225 int rc; 226 char buf[1024] __attribute__ ((aligned)); 227 228 while (1) { 229 errno = 0; 230 rc = avc_netlink_receive(buf, sizeof(buf), 0); 231 if (rc < 0) { 232 if (errno == EWOULDBLOCK) 233 return 0; 234 if (errno == 0 || errno == EINTR) 235 continue; 236 else { 237 avc_log(SELINUX_ERROR, 238 "%s: netlink recvfrom: error %d\n", 239 avc_prefix, errno); 240 return rc; 241 } 242 } 243 244 (void)avc_netlink_process(buf); 245 } 246 return 0; 247 } 248 249 /* run routine for the netlink listening thread */ 250 void avc_netlink_loop(void) 251 { 252 int rc; 253 char buf[1024] __attribute__ ((aligned)); 254 255 while (1) { 256 errno = 0; 257 rc = avc_netlink_receive(buf, sizeof(buf), 1); 258 if (rc < 0) { 259 if (errno == 0 || errno == EINTR) 260 continue; 261 else { 262 avc_log(SELINUX_ERROR, 263 "%s: netlink recvfrom: error %d\n", 264 avc_prefix, errno); 265 break; 266 } 267 } 268 269 rc = avc_netlink_process(buf); 270 if (rc < 0) 271 break; 272 } 273 274 close(fd); 275 fd = -1; 276 avc_netlink_trouble = 1; 277 avc_log(SELINUX_ERROR, 278 "%s: netlink thread: errors encountered, terminating\n", 279 avc_prefix); 280 } 281 282 int avc_netlink_acquire_fd(void) 283 { 284 avc_app_main_loop = 1; 285 286 return fd; 287 } 288 289 void avc_netlink_release_fd(void) 290 { 291 avc_app_main_loop = 0; 292 } 293
