2 * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
3 * Copyright (c) 2006 Damien Miller <djm@openbsd.org>
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 * Linux-specific portability code - just SELinux support at present
24 #if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
32 #include "port-linux.h"
35 #include <selinux/selinux.h>
36 #include <selinux/get_context_list.h>
38 #ifndef SSH_SELINUX_UNCONFINED_TYPE
39 # define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:"
42 /* Wrapper around is_selinux_enabled() to log its return value once only */
44 ssh_selinux_enabled(void)
46 static int enabled = -1;
49 enabled = (is_selinux_enabled() == 1);
50 debug("SELinux support %s", enabled ? "enabled" : "disabled");
56 /* Return the default security context for the given username */
57 static security_context_t
58 ssh_selinux_getctxbyname(char *pwname)
60 security_context_t sc = NULL;
61 char *sename = NULL, *lvl = NULL;
64 #ifdef HAVE_GETSEUSERBYNAME
65 if (getseuserbyname(pwname, &sename, &lvl) != 0)
72 #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
73 r = get_default_context_with_level(sename, lvl, NULL, &sc);
75 r = get_default_context(sename, NULL, &sc);
79 switch (security_getenforce()) {
81 fatal("%s: ssh_selinux_getctxbyname: "
82 "security_getenforce() failed", __func__);
84 error("%s: Failed to get default SELinux security "
85 "context for %s", __func__, pwname);
89 fatal("%s: Failed to get default SELinux security "
90 "context for %s (in enforcing mode)",
95 #ifdef HAVE_GETSEUSERBYNAME
103 /* Set the execution context to the default for the specified user */
105 ssh_selinux_setup_exec_context(char *pwname)
107 security_context_t user_ctx = NULL;
109 if (!ssh_selinux_enabled())
112 debug3("%s: setting execution context", __func__);
114 user_ctx = ssh_selinux_getctxbyname(pwname);
115 if (setexeccon(user_ctx) != 0) {
116 switch (security_getenforce()) {
118 fatal("%s: security_getenforce() failed", __func__);
120 error("%s: Failed to set SELinux execution "
121 "context for %s", __func__, pwname);
124 fatal("%s: Failed to set SELinux execution context "
125 "for %s (in enforcing mode)", __func__, pwname);
128 if (user_ctx != NULL)
131 debug3("%s: done", __func__);
134 /* Set the TTY context for the specified user */
136 ssh_selinux_setup_pty(char *pwname, const char *tty)
138 security_context_t new_tty_ctx = NULL;
139 security_context_t user_ctx = NULL;
140 security_context_t old_tty_ctx = NULL;
141 security_class_t chrclass;
143 if (!ssh_selinux_enabled())
146 debug3("%s: setting TTY context on %s", __func__, tty);
148 user_ctx = ssh_selinux_getctxbyname(pwname);
150 /* XXX: should these calls fatal() upon failure in enforcing mode? */
152 if (getfilecon(tty, &old_tty_ctx) == -1) {
153 error("%s: getfilecon: %s", __func__, strerror(errno));
156 if ((chrclass = string_to_security_class("chr_file")) == 0) {
157 error("%s: couldn't get security class for chr_file", __func__);
160 if (security_compute_relabel(user_ctx, old_tty_ctx,
161 chrclass, &new_tty_ctx) != 0) {
162 error("%s: security_compute_relabel: %s",
163 __func__, strerror(errno));
167 if (setfilecon(tty, new_tty_ctx) != 0)
168 error("%s: setfilecon: %s", __func__, strerror(errno));
170 if (new_tty_ctx != NULL)
171 freecon(new_tty_ctx);
172 if (old_tty_ctx != NULL)
173 freecon(old_tty_ctx);
174 if (user_ctx != NULL)
176 debug3("%s: done", __func__);
180 ssh_selinux_change_context(const char *newname)
183 char *oldctx, *newctx, *cx;
184 void (*switchlog) (const char *fmt,...) = logit;
186 if (!ssh_selinux_enabled())
189 if (getcon((security_context_t *)&oldctx) < 0) {
190 logit("%s: getcon failed with %s", __func__, strerror(errno));
193 if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) ==
195 logit ("%s: unparseable context %s", __func__, oldctx);
200 * Check whether we are attempting to switch away from an unconfined
203 if (strncmp(cx, SSH_SELINUX_UNCONFINED_TYPE,
204 sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0)
207 newlen = strlen(oldctx) + strlen(newname) + 1;
208 newctx = xmalloc(newlen);
209 len = cx - oldctx + 1;
210 memcpy(newctx, oldctx, len);
211 strlcpy(newctx + len, newname, newlen - len);
212 if ((cx = index(cx + 1, ':')))
213 strlcat(newctx, cx, newlen);
214 debug3("%s: setting context from '%s' to '%s'", __func__,
216 if (setcon(newctx) < 0)
217 switchlog("%s: setcon %s from %s failed with %s", __func__,
218 newctx, oldctx, strerror(errno));
224 ssh_selinux_setfscreatecon(const char *path)
226 security_context_t context;
228 if (!ssh_selinux_enabled())
231 setfscreatecon(NULL);
234 if (matchpathcon(path, 0700, &context) == 0)
235 setfscreatecon(context);
238 #endif /* WITH_SELINUX */
240 #ifdef LINUX_OOM_ADJUST
242 * The magic "don't kill me" values, old and new, as documented in eg:
243 * http://lxr.linux.no/#linux+v2.6.32/Documentation/filesystems/proc.txt
244 * http://lxr.linux.no/#linux+v2.6.36/Documentation/filesystems/proc.txt
247 static int oom_adj_save = INT_MIN;
248 static char *oom_adj_path = NULL;
253 {"/proc/self/oom_score_adj", -1000}, /* kernels >= 2.6.36 */
254 {"/proc/self/oom_adj", -17}, /* kernels <= 2.6.35 */
259 * Tell the kernel's out-of-memory killer to avoid sshd.
260 * Returns the previous oom_adj value or zero.
263 oom_adjust_setup(void)
268 debug3("%s", __func__);
269 for (i = 0; oom_adjust[i].path != NULL; i++) {
270 oom_adj_path = oom_adjust[i].path;
271 value = oom_adjust[i].value;
272 if ((fp = fopen(oom_adj_path, "r+")) != NULL) {
273 if (fscanf(fp, "%d", &oom_adj_save) != 1)
274 verbose("error reading %s: %s", oom_adj_path,
278 if (fprintf(fp, "%d\n", value) <= 0)
279 verbose("error writing %s: %s",
280 oom_adj_path, strerror(errno));
282 debug("Set %s from %d to %d",
283 oom_adj_path, oom_adj_save, value);
292 /* Restore the saved OOM adjustment */
294 oom_adjust_restore(void)
298 debug3("%s", __func__);
299 if (oom_adj_save == INT_MIN || oom_adj_path == NULL ||
300 (fp = fopen(oom_adj_path, "w")) == NULL)
303 if (fprintf(fp, "%d\n", oom_adj_save) <= 0)
304 verbose("error writing %s: %s", oom_adj_path, strerror(errno));
306 debug("Set %s to %d", oom_adj_path, oom_adj_save);
311 #endif /* LINUX_OOM_ADJUST */
312 #endif /* WITH_SELINUX || LINUX_OOM_ADJUST */