From patchwork Mon Aug 10 01:15:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Spooren X-Patchwork-Id: 1342690 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.openwrt.org (client-ip=2001:8b0:10b:1231::1; helo=merlin.infradead.org; envelope-from=openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=aparcar.org Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=merlin.20170209 header.b=0t8DiU28; dkim-atps=neutral Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:8b0:10b:1231::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BPylG5Qvrz9sRN for ; Mon, 10 Aug 2020 11:18:18 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=K1Ij/vhJsbOGNTtjRFYK7Pn7NIRqdhcPgFx0vEY/lyQ=; b=0t8DiU280pJfIcCYH46l1p7RCp O/X8qgBFmZhoKM2tjLyRRuiozG3hfLX00uvZ+3GEoQuQ/afRfIxEeqLfnG6fLZkDMblCk9hC7Z8BK k4LiA+SfwRc1jLKQ9K0ONVK501TBy57AKydq8isUs9ZSfG9ydSKFyOGJijO0tGb95l8sfHCsNCOP6 HWEletVrGotiHYaZWim67VT/ld6TxiT0bRaJUh5c3eWyGdn4u/2SwQah3JM08OXpfh/DT5EmDDD9M QhvgdUZ5y0vGX9M2FQQmfW1XwI0503qJMNHg+QW3iNea8vgQH3HvXI4Ab/xrMVgM/6Y6IZO1J0kZA lxOQhqMw==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1k4wPw-00011E-VY; Mon, 10 Aug 2020 01:16:01 +0000 Received: from relay1-d.mail.gandi.net ([217.70.183.193]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1k4wPt-00010s-TX for openwrt-devel@lists.openwrt.org; Mon, 10 Aug 2020 01:15:59 +0000 X-Originating-IP: 72.234.141.215 Received: from dawn.lan (udp224251uds.hawaiiantel.net [72.234.141.215]) (Authenticated sender: mail@aparcar.org) by relay1-d.mail.gandi.net (Postfix) with ESMTPA id 8F76C240002; Mon, 10 Aug 2020 01:15:51 +0000 (UTC) From: Paul Spooren To: openwrt-devel@lists.openwrt.org Subject: [PATCH procd] initd/init: add minimal SELinux policy loading support Date: Sun, 9 Aug 2020 15:15:20 -1000 Message-Id: <20200810011540.128951-1-mail@aparcar.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200809_211558_055157_3C5FF75E X-CRM114-Status: GOOD ( 16.28 ) X-Spam-Score: -0.7 (/) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-0.7 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low trust [217.70.183.193 listed in list.dnswl.org] 0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [217.70.183.193 listed in wl.mailspike.net] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-BeenThere: openwrt-devel@lists.openwrt.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OpenWrt Development List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: daniel@makrotopia.org, thomas.petazzoni@bootlin.com, Paul Spooren Sender: "openwrt-devel" Errors-To: openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org From: Thomas Petazzoni In order to support SELinux in OpenWrt, this commit introduces minimal support for loading the SELinux policy in the init code. The logic is very much inspired from what Busybox is doing: call selinux_init_load_policy() from libselinux, and then re-execute init so that it runs with the SELinux policy in place and enforced. Signed-off-by: Thomas Petazzoni [fix spelling of OpenWrt] Signed-off-by: Paul Spooren --- This is part of a bigger PR on GitHub[1], however this patch should be added directly to `procd` rather than as a patch in openwrt.git. As some core devs avoid GitHubs heavy frontend, I send this particular patch here again. I've tested the patch series and it compiles and runs as (I) expected. [1]: https://github.com/openwrt/openwrt/pull/3207 CMakeLists.txt | 9 ++++++++- initd/init.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c7adfa3..d20e57b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -46,6 +46,12 @@ IF(ZRAM_TMPFS) SET(SOURCES_ZRAM initd/zram.c) ENDIF() +IF(SELINUX) + include(FindPkgConfig) + pkg_search_module(SELINUX REQUIRED libselinux) + add_compile_definitions(WITH_SELINUX) +ENDIF() + add_subdirectory(upgraded) ADD_EXECUTABLE(procd ${SOURCES}) @@ -62,7 +68,8 @@ ADD_DEFINITIONS(-DDISABLE_INIT) ELSE() ADD_EXECUTABLE(init initd/init.c initd/early.c initd/preinit.c initd/mkdev.c sysupgrade.c watchdog.c utils/utils.c ${SOURCES_ZRAM}) -TARGET_LINK_LIBRARIES(init ${LIBS}) +TARGET_INCLUDE_DIRECTORIES(init PUBLIC ${SELINUX_INCLUDE_DIRS}) +TARGET_LINK_LIBRARIES(init ${LIBS} ${SELINUX_LIBRARIES}) INSTALL(TARGETS init RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR} ) diff --git a/initd/init.c b/initd/init.c index 9b47826..2eb6ead 100644 --- a/initd/init.c +++ b/initd/init.c @@ -29,6 +29,10 @@ #include #include +#if defined(WITH_SELINUX) +#include +#endif + #include "../utils/utils.h" #include "init.h" #include "../watchdog.h" @@ -67,6 +71,38 @@ cmdline(void) } } +#if defined(WITH_SELINUX) +static int +selinux(char **argv) +{ + int enforce = 0; + int ret; + + /* SELinux already initialized */ + if (getenv("SELINUX_INIT")) + return 0; + + putenv("SELINUX_INIT=1"); + + ret = selinux_init_load_policy(&enforce); + if (ret == 0) + execv(argv[0], argv); + + if (enforce > 0) { + fprintf(stderr, "Cannot load SELinux policy, but system in enforcing mode. Halting.\n"); + return 1; + } + + return 0; +} +#else +static int +selinux(char **argv) +{ + return 0; +} +#endif + int main(int argc, char **argv) { @@ -79,6 +115,8 @@ main(int argc, char **argv) sigaction(SIGUSR2, &sa_shutdown, NULL); sigaction(SIGPWR, &sa_shutdown, NULL); + if (selinux(argv)) + exit(-1); early(); cmdline(); watchdog_init(1);