label_selinux.go 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207
  1. // +build selinux,linux
  2. package label
  3. import (
  4. "fmt"
  5. "os"
  6. "os/user"
  7. "strings"
  8. "github.com/opencontainers/selinux/go-selinux"
  9. "github.com/pkg/errors"
  10. )
  11. // Valid Label Options
  12. var validOptions = map[string]bool{
  13. "disable": true,
  14. "type": true,
  15. "filetype": true,
  16. "user": true,
  17. "role": true,
  18. "level": true,
  19. }
  20. var ErrIncompatibleLabel = errors.New("Bad SELinux option z and Z can not be used together")
  21. // InitLabels returns the process label and file labels to be used within
  22. // the container. A list of options can be passed into this function to alter
  23. // the labels. The labels returned will include a random MCS String, that is
  24. // guaranteed to be unique.
  25. func InitLabels(options []string) (plabel string, mlabel string, Err error) {
  26. if !selinux.GetEnabled() {
  27. return "", "", nil
  28. }
  29. processLabel, mountLabel := selinux.ContainerLabels()
  30. if processLabel != "" {
  31. defer func() {
  32. if Err != nil {
  33. selinux.ReleaseLabel(mountLabel)
  34. }
  35. }()
  36. pcon, err := selinux.NewContext(processLabel)
  37. if err != nil {
  38. return "", "", err
  39. }
  40. mcon, err := selinux.NewContext(mountLabel)
  41. if err != nil {
  42. return "", "", err
  43. }
  44. for _, opt := range options {
  45. if opt == "disable" {
  46. return "", mountLabel, nil
  47. }
  48. if i := strings.Index(opt, ":"); i == -1 {
  49. return "", "", errors.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
  50. }
  51. con := strings.SplitN(opt, ":", 2)
  52. if !validOptions[con[0]] {
  53. return "", "", errors.Errorf("Bad label option %q, valid options 'disable, user, role, level, type, filetype'", con[0])
  54. }
  55. if con[0] == "filetype" {
  56. mcon["type"] = con[1]
  57. }
  58. pcon[con[0]] = con[1]
  59. if con[0] == "level" || con[0] == "user" {
  60. mcon[con[0]] = con[1]
  61. }
  62. }
  63. selinux.ReleaseLabel(processLabel)
  64. processLabel = pcon.Get()
  65. mountLabel = mcon.Get()
  66. selinux.ReserveLabel(processLabel)
  67. }
  68. return processLabel, mountLabel, nil
  69. }
  70. // Deprecated: The GenLabels function is only to be used during the transition
  71. // to the official API. Use InitLabels(strings.Fields(options)) instead.
  72. func GenLabels(options string) (string, string, error) {
  73. return InitLabels(strings.Fields(options))
  74. }
  75. // FormatMountLabel returns a string to be used by the mount command.
  76. // The format of this string will be used to alter the labeling of the mountpoint.
  77. // The string returned is suitable to be used as the options field of the mount command.
  78. // If you need to have additional mount point options, you can pass them in as
  79. // the first parameter. Second parameter is the label that you wish to apply
  80. // to all content in the mount point.
  81. func FormatMountLabel(src, mountLabel string) string {
  82. if mountLabel != "" {
  83. switch src {
  84. case "":
  85. src = fmt.Sprintf("context=%q", mountLabel)
  86. default:
  87. src = fmt.Sprintf("%s,context=%q", src, mountLabel)
  88. }
  89. }
  90. return src
  91. }
  92. // SetFileLabel modifies the "path" label to the specified file label
  93. func SetFileLabel(path string, fileLabel string) error {
  94. if !selinux.GetEnabled() || fileLabel == "" {
  95. return nil
  96. }
  97. return selinux.SetFileLabel(path, fileLabel)
  98. }
  99. // SetFileCreateLabel tells the kernel the label for all files to be created
  100. func SetFileCreateLabel(fileLabel string) error {
  101. if !selinux.GetEnabled() {
  102. return nil
  103. }
  104. return selinux.SetFSCreateLabel(fileLabel)
  105. }
  106. // Relabel changes the label of path to the filelabel string.
  107. // It changes the MCS label to s0 if shared is true.
  108. // This will allow all containers to share the content.
  109. func Relabel(path string, fileLabel string, shared bool) error {
  110. if !selinux.GetEnabled() || fileLabel == "" {
  111. return nil
  112. }
  113. exclude_paths := map[string]bool{
  114. "/": true,
  115. "/bin": true,
  116. "/boot": true,
  117. "/dev": true,
  118. "/etc": true,
  119. "/etc/passwd": true,
  120. "/etc/pki": true,
  121. "/etc/shadow": true,
  122. "/home": true,
  123. "/lib": true,
  124. "/lib64": true,
  125. "/media": true,
  126. "/opt": true,
  127. "/proc": true,
  128. "/root": true,
  129. "/run": true,
  130. "/sbin": true,
  131. "/srv": true,
  132. "/sys": true,
  133. "/tmp": true,
  134. "/usr": true,
  135. "/var": true,
  136. "/var/lib": true,
  137. "/var/log": true,
  138. }
  139. if home := os.Getenv("HOME"); home != "" {
  140. exclude_paths[home] = true
  141. }
  142. if sudoUser := os.Getenv("SUDO_USER"); sudoUser != "" {
  143. if usr, err := user.Lookup(sudoUser); err == nil {
  144. exclude_paths[usr.HomeDir] = true
  145. }
  146. }
  147. if path != "/" {
  148. path = strings.TrimSuffix(path, "/")
  149. }
  150. if exclude_paths[path] {
  151. return errors.Errorf("SELinux relabeling of %s is not allowed", path)
  152. }
  153. if shared {
  154. c, err := selinux.NewContext(fileLabel)
  155. if err != nil {
  156. return err
  157. }
  158. c["level"] = "s0"
  159. fileLabel = c.Get()
  160. }
  161. if err := selinux.Chcon(path, fileLabel, true); err != nil {
  162. return err
  163. }
  164. return nil
  165. }
  166. // DisableSecOpt returns a security opt that can disable labeling
  167. // support for future container processes
  168. // Deprecated: use selinux.DisableSecOpt
  169. var DisableSecOpt = selinux.DisableSecOpt
  170. // Validate checks that the label does not include unexpected options
  171. func Validate(label string) error {
  172. if strings.Contains(label, "z") && strings.Contains(label, "Z") {
  173. return ErrIncompatibleLabel
  174. }
  175. return nil
  176. }
  177. // RelabelNeeded checks whether the user requested a relabel
  178. func RelabelNeeded(label string) bool {
  179. return strings.Contains(label, "z") || strings.Contains(label, "Z")
  180. }
  181. // IsShared checks that the label includes a "shared" mark
  182. func IsShared(label string) bool {
  183. return strings.Contains(label, "z")
  184. }