1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <errno.h>
4 #if HAVE_APPARMOR
5 # include <sys/apparmor.h>
6 #endif
7 #include <unistd.h>
8
9 #include "apparmor-setup.h"
10 #include "apparmor-util.h"
11 #include "fd-util.h"
12 #include "fileio.h"
13 #include "log.h"
14 #include "macro.h"
15 #include "string-util.h"
16 #include "strv.h"
17
18 #if HAVE_APPARMOR
19 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_policy_cache *, aa_policy_cache_unref, NULL);
20 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_features *, aa_features_unref, NULL);
21 #endif
22
mac_apparmor_setup(void)23 int mac_apparmor_setup(void) {
24 #if HAVE_APPARMOR
25 _cleanup_(aa_policy_cache_unrefp) aa_policy_cache *policy_cache = NULL;
26 _cleanup_(aa_features_unrefp) aa_features *features = NULL;
27 _cleanup_free_ char *current_profile = NULL, *cache_dir_path = NULL;
28 int r;
29
30 if (!mac_apparmor_use()) {
31 log_debug("AppArmor either not supported by the kernel or disabled.");
32 return 0;
33 }
34
35 /* To enable LSM stacking a patch to the kernel is proposed to create a
36 * per-LSM subdirectory to distinguish between the LSMs. Therefore, we
37 * read the file from the LSM specific directory first and only if that
38 * fails the one from the generic directory.
39 */
40 FOREACH_STRING(current_file, "/proc/self/attr/apparmor/current", "/proc/self/attr/current") {
41 r = read_one_line_file(current_file, ¤t_profile);
42 if (r == -ENOENT)
43 continue;
44 else if (r < 0)
45 log_warning_errno(r, "Failed to read current AppArmor profile from file %s, ignoring: %m", current_file);
46 else
47 break;
48 }
49 if (!current_profile) {
50 log_warning("Failed to get the current AppArmor profile of systemd from /proc/self/attr/apparmor/current or /proc/self/attr/current, ignoring.");
51 return 0;
52 }
53 if (!streq(current_profile, "unconfined")) {
54 log_debug("We are already confined in an AppArmor profile.");
55 return 0;
56 }
57
58 r = aa_features_new_from_kernel(&features);
59 if (r < 0) {
60 log_warning_errno(errno, "Failed to get the AppArmor feature set from the kernel, ignoring: %m");
61 return 0;
62 }
63 cache_dir_path = aa_policy_cache_dir_path_preview(features, AT_FDCWD, "/etc/apparmor/earlypolicy");
64 if (!cache_dir_path) {
65 log_debug_errno(errno, "Failed to get the path of the early AppArmor policy cache directory.");
66 return 0;
67 }
68
69 /* aa_policy_cache_new will internally use the same path as aa_policy_cache_dir_path_preview has returned. */
70 r = aa_policy_cache_new(&policy_cache, features, AT_FDCWD, "/etc/apparmor/earlypolicy", 0);
71 if (r < 0) {
72 if (errno == ENOENT) {
73 log_debug_errno(errno, "The early AppArmor policy cache directory %s does not exist.", cache_dir_path);
74 return 0;
75 }
76 log_warning_errno(errno, "Failed to create a new AppArmor policy cache, ignoring: %m");
77 return 0;
78 }
79 r = aa_policy_cache_replace_all(policy_cache, NULL);
80 if (r < 0) {
81 log_warning_errno(errno, "Failed to load the profiles from the early AppArmor policy cache directory %s, ignoring: %m", cache_dir_path);
82 return 0;
83 }
84
85 log_info("Successfully loaded all binary profiles from AppArmor early policy cache at %s.", cache_dir_path);
86
87 r = aa_change_profile("systemd");
88 if (r < 0) {
89 if (errno == ENOENT)
90 log_debug_errno(errno, "Failed to change to AppArmor profile 'systemd'. Please ensure that one of the binary profile files in policy cache directory %s contains a profile with that name.", cache_dir_path);
91 else
92 log_error_errno(errno, "Failed to change to AppArmor profile 'systemd': %m");
93 return 0;
94 }
95
96 log_info("Changed to AppArmor profile systemd.");
97 #endif
98 return 0;
99 }
100