1 /* SELinux access controls for nscd.
2 Copyright (C) 2004-2023 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <https://www.gnu.org/licenses/>. */
18
19 #include "config.h"
20 #include <error.h>
21 #include <errno.h>
22 #include <libintl.h>
23 #include <pthread.h>
24 #include <stdarg.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <syslog.h>
28 #include <unistd.h>
29 #include <sys/prctl.h>
30 #include <selinux/avc.h>
31 #include <selinux/selinux.h>
32 #ifdef HAVE_LIBAUDIT
33 # include <libaudit.h>
34 #endif
35 #include <libc-diag.h>
36
37 #include "dbg_log.h"
38 #include "selinux.h"
39
40
41 #ifdef HAVE_SELINUX
42 /* Global variable to tell if the kernel has SELinux support. */
43 int selinux_enabled;
44
45 /* Define mappings of request type to AVC permission name. */
46 static const char *perms[LASTREQ] =
47 {
48 [GETPWBYNAME] = "getpwd",
49 [GETPWBYUID] = "getpwd",
50 [GETGRBYNAME] = "getgrp",
51 [GETGRBYGID] = "getgrp",
52 [GETHOSTBYNAME] = "gethost",
53 [GETHOSTBYNAMEv6] = "gethost",
54 [GETHOSTBYADDR] = "gethost",
55 [GETHOSTBYADDRv6] = "gethost",
56 [SHUTDOWN] = "admin",
57 [GETSTAT] = "getstat",
58 [INVALIDATE] = "admin",
59 [GETFDPW] = "shmempwd",
60 [GETFDGR] = "shmemgrp",
61 [GETFDHST] = "shmemhost",
62 [GETAI] = "gethost",
63 [INITGROUPS] = "getgrp",
64 [GETSERVBYNAME] = "getserv",
65 [GETSERVBYPORT] = "getserv",
66 [GETFDSERV] = "shmemserv",
67 [GETNETGRENT] = "getnetgrp",
68 [INNETGR] = "getnetgrp",
69 [GETFDNETGR] = "shmemnetgrp",
70 };
71
72 /* Store an entry ref to speed AVC decisions. */
73 static struct avc_entry_ref aeref;
74
75 /* Thread to listen for SELinux status changes via netlink. */
76 static pthread_t avc_notify_thread;
77
78 #ifdef HAVE_LIBAUDIT
79 /* Prototype for supporting the audit daemon */
80 static void log_callback (const char *fmt, ...);
81 #endif
82
83 /* Prototypes for AVC callback functions. */
84 static void *avc_create_thread (void (*run) (void));
85 static void avc_stop_thread (void *thread);
86 static void *avc_alloc_lock (void);
87 static void avc_get_lock (void *lock);
88 static void avc_release_lock (void *lock);
89 static void avc_free_lock (void *lock);
90
91 /* AVC callback structures for use in avc_init. */
92 static const struct avc_log_callback log_cb =
93 {
94 #ifdef HAVE_LIBAUDIT
95 .func_log = log_callback,
96 #else
97 .func_log = dbg_log,
98 #endif
99 .func_audit = NULL
100 };
101 static const struct avc_thread_callback thread_cb =
102 {
103 .func_create_thread = avc_create_thread,
104 .func_stop_thread = avc_stop_thread
105 };
106 static const struct avc_lock_callback lock_cb =
107 {
108 .func_alloc_lock = avc_alloc_lock,
109 .func_get_lock = avc_get_lock,
110 .func_release_lock = avc_release_lock,
111 .func_free_lock = avc_free_lock
112 };
113
114 #ifdef HAVE_LIBAUDIT
115 /* The audit system's netlink socket descriptor */
116 static int audit_fd = -1;
117
118 /* When an avc denial occurs, log it to audit system */
119 static void
120 log_callback (const char *fmt, ...)
121 {
122 if (audit_fd >= 0)
123 {
124 va_list ap;
125 va_start (ap, fmt);
126
127 char *buf;
128 int e = vasprintf (&buf, fmt, ap);
129 if (e < 0)
130 {
131 buf = alloca (BUFSIZ);
132 vsnprintf (buf, BUFSIZ, fmt, ap);
133 }
134
135 /* FIXME: need to attribute this to real user, using getuid for now */
136 audit_log_user_avc_message (audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
137 NULL, getuid ());
138
139 if (e >= 0)
140 free (buf);
141
142 va_end (ap);
143 }
144 }
145
146 /* Initialize the connection to the audit system */
147 static void
148 audit_init (void)
149 {
150 audit_fd = audit_open ();
151 if (audit_fd < 0
152 /* If kernel doesn't support audit, bail out */
153 && errno != EINVAL && errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT)
154 dbg_log (_("Failed opening connection to the audit subsystem: %m"));
155 }
156
157
158 # ifdef HAVE_LIBCAP
159 static const cap_value_t new_cap_list[] =
160 { CAP_AUDIT_WRITE };
161 # define nnew_cap_list (sizeof (new_cap_list) / sizeof (new_cap_list[0]))
162 static const cap_value_t tmp_cap_list[] =
163 { CAP_AUDIT_WRITE, CAP_SETUID, CAP_SETGID };
164 # define ntmp_cap_list (sizeof (tmp_cap_list) / sizeof (tmp_cap_list[0]))
165
166 cap_t
167 preserve_capabilities (void)
168 {
169 if (getuid () != 0)
170 /* Not root, then we cannot preserve anything. */
171 return NULL;
172
173 if (prctl (PR_SET_KEEPCAPS, 1) == -1)
174 {
175 dbg_log (_("Failed to set keep-capabilities"));
176 do_exit (EXIT_FAILURE, errno, _("prctl(KEEPCAPS) failed"));
177 /* NOTREACHED */
178 }
179
180 cap_t tmp_caps = cap_init ();
181 cap_t new_caps = NULL;
182 if (tmp_caps != NULL)
183 new_caps = cap_init ();
184
185 if (tmp_caps == NULL || new_caps == NULL)
186 {
187 if (tmp_caps != NULL)
188 cap_free (tmp_caps);
189
190 dbg_log (_("Failed to initialize drop of capabilities"));
191 do_exit (EXIT_FAILURE, 0, _("cap_init failed"));
192 }
193
194 /* There is no reason why these should not work. */
195 cap_set_flag (new_caps, CAP_PERMITTED, nnew_cap_list,
196 (cap_value_t *) new_cap_list, CAP_SET);
197 cap_set_flag (new_caps, CAP_EFFECTIVE, nnew_cap_list,
198 (cap_value_t *) new_cap_list, CAP_SET);
199
200 cap_set_flag (tmp_caps, CAP_PERMITTED, ntmp_cap_list,
201 (cap_value_t *) tmp_cap_list, CAP_SET);
202 cap_set_flag (tmp_caps, CAP_EFFECTIVE, ntmp_cap_list,
203 (cap_value_t *) tmp_cap_list, CAP_SET);
204
205 int res = cap_set_proc (tmp_caps);
206
207 cap_free (tmp_caps);
208
209 if (__glibc_unlikely (res != 0))
210 {
211 cap_free (new_caps);
212 dbg_log (_("Failed to drop capabilities"));
213 do_exit (EXIT_FAILURE, 0, _("cap_set_proc failed"));
214 }
215
216 return new_caps;
217 }
218
219 void
220 install_real_capabilities (cap_t new_caps)
221 {
222 /* If we have no capabilities there is nothing to do here. */
223 if (new_caps == NULL)
224 return;
225
226 if (cap_set_proc (new_caps))
227 {
228 cap_free (new_caps);
229 dbg_log (_("Failed to drop capabilities"));
230 do_exit (EXIT_FAILURE, 0, _("cap_set_proc failed"));
231 /* NOTREACHED */
232 }
233
234 cap_free (new_caps);
235
236 if (prctl (PR_SET_KEEPCAPS, 0) == -1)
237 {
238 dbg_log (_("Failed to unset keep-capabilities"));
239 do_exit (EXIT_FAILURE, errno, _("prctl(KEEPCAPS) failed"));
240 /* NOTREACHED */
241 }
242 }
243 # endif /* HAVE_LIBCAP */
244 #endif /* HAVE_LIBAUDIT */
245
246 /* Determine if we are running on an SELinux kernel. Set selinux_enabled
247 to the result. */
248 void
249 nscd_selinux_enabled (int *selinux_enabled)
250 {
251 *selinux_enabled = is_selinux_enabled ();
252 if (*selinux_enabled < 0)
253 {
254 dbg_log (_("Failed to determine if kernel supports SELinux"));
255 do_exit (EXIT_FAILURE, 0, NULL);
256 }
257 }
258
259
260 /* Create thread for AVC netlink notification. */
261 static void *
262 avc_create_thread (void (*run) (void))
263 {
264 int rc;
265
266 rc =
267 pthread_create (&avc_notify_thread, NULL, (void *(*) (void *)) run, NULL);
268 if (rc != 0)
269 do_exit (EXIT_FAILURE, rc, _("Failed to start AVC thread"));
270
271 return &avc_notify_thread;
272 }
273
274
275 /* Stop AVC netlink thread. */
276 static void
277 avc_stop_thread (void *thread)
278 {
279 pthread_cancel (*(pthread_t *) thread);
280 }
281
282
283 /* Allocate a new AVC lock. */
284 static void *
285 avc_alloc_lock (void)
286 {
287 pthread_mutex_t *avc_mutex;
288
289 avc_mutex = malloc (sizeof (pthread_mutex_t));
290 if (avc_mutex == NULL)
291 do_exit (EXIT_FAILURE, errno, _("Failed to create AVC lock"));
292 pthread_mutex_init (avc_mutex, NULL);
293
294 return avc_mutex;
295 }
296
297
298 /* Acquire an AVC lock. */
299 static void
300 avc_get_lock (void *lock)
301 {
302 pthread_mutex_lock (lock);
303 }
304
305
306 /* Release an AVC lock. */
307 static void
308 avc_release_lock (void *lock)
309 {
310 pthread_mutex_unlock (lock);
311 }
312
313
314 /* Free an AVC lock. */
315 static void
316 avc_free_lock (void *lock)
317 {
318 pthread_mutex_destroy (lock);
319 free (lock);
320 }
321
322
323 /* avc_init (along with several other symbols) was marked as deprecated by the
324 SELinux API starting from version 3.1. We use it here, but should
325 eventually switch to the newer API. */
326 DIAG_PUSH_NEEDS_COMMENT
327 DIAG_IGNORE_NEEDS_COMMENT (10, "-Wdeprecated-declarations");
328
329 /* Initialize the user space access vector cache (AVC) for NSCD along with
330 log/thread/lock callbacks. */
331 void
332 nscd_avc_init (void)
333 {
334 avc_entry_ref_init (&aeref);
335
336 if (avc_init ("avc", NULL, &log_cb, &thread_cb, &lock_cb) < 0)
337 do_exit (EXIT_FAILURE, errno, _("Failed to start AVC"));
338 else
339 dbg_log (_("Access Vector Cache (AVC) started"));
340 #ifdef HAVE_LIBAUDIT
341 audit_init ();
342 #endif
343 }
344 DIAG_POP_NEEDS_COMMENT
345
346
347 /* security_context_t and sidput (along with several other symbols) were marked
348 as deprecated by the SELinux API starting from version 3.1. We use them
349 here, but should eventually switch to the newer API. */
350 DIAG_PUSH_NEEDS_COMMENT
351 DIAG_IGNORE_NEEDS_COMMENT (10, "-Wdeprecated-declarations");
352
353 /* Check the permission from the caller (via getpeercon) to nscd.
354 Returns 0 if access is allowed, 1 if denied, and -1 on error.
355
356 The SELinux policy, enablement, and permission bits are all dynamic and the
357 caching done by glibc is not entirely correct. This nscd support should be
358 rewritten to use selinux_check_permission. A rewrite is risky though and
359 requires some refactoring. Currently we use symbolic mappings instead of
360 compile time constants (which SELinux upstream says are going away), and we
361 use security_deny_unknown to determine what to do if selinux-policy* doesn't
362 have a definition for the the permission or object class we are looking
363 up. */
364 int
365 nscd_request_avc_has_perm (int fd, request_type req)
366 {
367 /* Initialize to NULL so we know what to free in case of failure. */
368 security_context_t scon = NULL;
369 security_context_t tcon = NULL;
370 security_id_t ssid = NULL;
371 security_id_t tsid = NULL;
372 int rc = -1;
373 security_class_t sc_nscd;
374 access_vector_t perm;
375 int avc_deny_unknown;
376
377 /* Check if SELinux denys or allows unknown object classes
378 and permissions. It is 0 if they are allowed, 1 if they
379 are not allowed and -1 on error. */
380 if ((avc_deny_unknown = security_deny_unknown ()) == -1)
381 dbg_log (_("Error querying policy for undefined object classes "
382 "or permissions."));
383
384 /* Get the security class for nscd. If this fails we will likely be
385 unable to do anything unless avc_deny_unknown is 0. */
386 sc_nscd = string_to_security_class ("nscd");
387 if (sc_nscd == 0 && avc_deny_unknown == 1)
388 dbg_log (_("Error getting security class for nscd."));
389
390 /* Convert permission to AVC bits. */
391 perm = string_to_av_perm (sc_nscd, perms[req]);
392 if (perm == 0 && avc_deny_unknown == 1)
393 dbg_log (_("Error translating permission name "
394 "\"%s\" to access vector bit."), perms[req]);
395
396 /* If the nscd security class was not found or perms were not
397 found and AVC does not deny unknown values then allow it. */
398 if ((sc_nscd == 0 || perm == 0) && avc_deny_unknown == 0)
399 return 0;
400
401 if (getpeercon (fd, &scon) < 0)
402 {
403 dbg_log (_("Error getting context of socket peer"));
404 goto out;
405 }
406 if (getcon (&tcon) < 0)
407 {
408 dbg_log (_("Error getting context of nscd"));
409 goto out;
410 }
411 if (avc_context_to_sid (scon, &ssid) < 0
412 || avc_context_to_sid (tcon, &tsid) < 0)
413 {
414 dbg_log (_("Error getting sid from context"));
415 goto out;
416 }
417
418 /* The SELinux API for avc_has_perm conflates access denied and error into
419 the return code -1, while nscd_request_avs_has_perm has distinct error
420 (-1) and denied (1) return codes. We map the avc_has_perm access denied or
421 error into an access denied at the nscd interface level (we do accurately
422 report error for the getpeercon, getcon, and avc_context_to_sid interfaces
423 used above). */
424 rc = avc_has_perm (ssid, tsid, sc_nscd, perm, &aeref, NULL) < 0;
425
426 out:
427 if (scon)
428 freecon (scon);
429 if (tcon)
430 freecon (tcon);
431 if (ssid)
432 sidput (ssid);
433 if (tsid)
434 sidput (tsid);
435
436 return rc;
437 }
438 DIAG_POP_NEEDS_COMMENT
439
440
441 /* Wrapper to get AVC statistics. */
442 void
443 nscd_avc_cache_stats (struct avc_cache_stats *cstats)
444 {
445 avc_cache_stats (cstats);
446 }
447
448
449 /* Print the AVC statistics to stdout. */
450 void
451 nscd_avc_print_stats (struct avc_cache_stats *cstats)
452 {
453 printf (_("\nSELinux AVC Statistics:\n\n"
454 "%15u entry lookups\n"
455 "%15u entry hits\n"
456 "%15u entry misses\n"
457 "%15u entry discards\n"
458 "%15u CAV lookups\n"
459 "%15u CAV hits\n"
460 "%15u CAV probes\n"
461 "%15u CAV misses\n"),
462 cstats->entry_lookups, cstats->entry_hits, cstats->entry_misses,
463 cstats->entry_discards, cstats->cav_lookups, cstats->cav_hits,
464 cstats->cav_probes, cstats->cav_misses);
465 }
466
467 #endif /* HAVE_SELINUX */