label_selinux.go 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287
  1. // +build selinux,linux
  2. package label
  3. import (
  4. "fmt"
  5. "os"
  6. "os/user"
  7. "strings"
  8. "github.com/opencontainers/selinux/go-selinux"
  9. )
  10. // Valid Label Options
  11. var validOptions = map[string]bool{
  12. "disable": true,
  13. "type": true,
  14. "user": true,
  15. "role": true,
  16. "level": true,
  17. }
  18. var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be used together")
  19. // InitLabels returns the process label and file labels to be used within
  20. // the container. A list of options can be passed into this function to alter
  21. // the labels. The labels returned will include a random MCS String, that is
  22. // guaranteed to be unique.
  23. func InitLabels(options []string) (plabel string, mlabel string, Err error) {
  24. if !selinux.GetEnabled() {
  25. return "", "", nil
  26. }
  27. processLabel, mountLabel := selinux.ContainerLabels()
  28. if processLabel != "" {
  29. defer func() {
  30. if Err != nil {
  31. ReleaseLabel(mountLabel)
  32. }
  33. }()
  34. pcon, err := selinux.NewContext(processLabel)
  35. if err != nil {
  36. return "", "", err
  37. }
  38. mcon, err := selinux.NewContext(mountLabel)
  39. if err != nil {
  40. return "", "", err
  41. }
  42. for _, opt := range options {
  43. if opt == "disable" {
  44. return "", mountLabel, nil
  45. }
  46. if i := strings.Index(opt, ":"); i == -1 {
  47. return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
  48. }
  49. con := strings.SplitN(opt, ":", 2)
  50. if !validOptions[con[0]] {
  51. return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])
  52. }
  53. pcon[con[0]] = con[1]
  54. if con[0] == "level" || con[0] == "user" {
  55. mcon[con[0]] = con[1]
  56. }
  57. }
  58. _ = ReleaseLabel(processLabel)
  59. processLabel = pcon.Get()
  60. mountLabel = mcon.Get()
  61. _ = ReserveLabel(processLabel)
  62. }
  63. return processLabel, mountLabel, nil
  64. }
  65. func ROMountLabel() string {
  66. return selinux.ROFileLabel()
  67. }
  68. // DEPRECATED: The GenLabels function is only to be used during the transition to the official API.
  69. func GenLabels(options string) (string, string, error) {
  70. return InitLabels(strings.Fields(options))
  71. }
  72. // FormatMountLabel returns a string to be used by the mount command.
  73. // The format of this string will be used to alter the labeling of the mountpoint.
  74. // The string returned is suitable to be used as the options field of the mount command.
  75. // If you need to have additional mount point options, you can pass them in as
  76. // the first parameter. Second parameter is the label that you wish to apply
  77. // to all content in the mount point.
  78. func FormatMountLabel(src, mountLabel string) string {
  79. if mountLabel != "" {
  80. switch src {
  81. case "":
  82. src = fmt.Sprintf("context=%q", mountLabel)
  83. default:
  84. src = fmt.Sprintf("%s,context=%q", src, mountLabel)
  85. }
  86. }
  87. return src
  88. }
  89. // SetProcessLabel takes a process label and tells the kernel to assign the
  90. // label to the next program executed by the current process.
  91. func SetProcessLabel(processLabel string) error {
  92. return selinux.SetExecLabel(processLabel)
  93. }
  94. // SetSocketLabel takes a process label and tells the kernel to assign the
  95. // label to the next socket that gets created
  96. func SetSocketLabel(processLabel string) error {
  97. return selinux.SetSocketLabel(processLabel)
  98. }
  99. // SocketLabel retrieves the current default socket label setting
  100. func SocketLabel() (string, error) {
  101. return selinux.SocketLabel()
  102. }
  103. // SetKeyLabel takes a process label and tells the kernel to assign the
  104. // label to the next kernel keyring that gets created
  105. func SetKeyLabel(processLabel string) error {
  106. return selinux.SetKeyLabel(processLabel)
  107. }
  108. // KeyLabel retrieves the current default kernel keyring label setting
  109. func KeyLabel() (string, error) {
  110. return selinux.KeyLabel()
  111. }
  112. // ProcessLabel returns the process label that the kernel will assign
  113. // to the next program executed by the current process. If "" is returned
  114. // this indicates that the default labeling will happen for the process.
  115. func ProcessLabel() (string, error) {
  116. return selinux.ExecLabel()
  117. }
  118. // FileLabel returns the label for specified path
  119. func FileLabel(path string) (string, error) {
  120. return selinux.FileLabel(path)
  121. }
  122. // SetFileLabel modifies the "path" label to the specified file label
  123. func SetFileLabel(path string, fileLabel string) error {
  124. if selinux.GetEnabled() && fileLabel != "" {
  125. return selinux.SetFileLabel(path, fileLabel)
  126. }
  127. return nil
  128. }
  129. // SetFileCreateLabel tells the kernel the label for all files to be created
  130. func SetFileCreateLabel(fileLabel string) error {
  131. if selinux.GetEnabled() {
  132. return selinux.SetFSCreateLabel(fileLabel)
  133. }
  134. return nil
  135. }
  136. // Relabel changes the label of path to the filelabel string.
  137. // It changes the MCS label to s0 if shared is true.
  138. // This will allow all containers to share the content.
  139. func Relabel(path string, fileLabel string, shared bool) error {
  140. if !selinux.GetEnabled() {
  141. return nil
  142. }
  143. if fileLabel == "" {
  144. return nil
  145. }
  146. exclude_paths := map[string]bool{
  147. "/": true,
  148. "/bin": true,
  149. "/boot": true,
  150. "/dev": true,
  151. "/etc": true,
  152. "/etc/passwd": true,
  153. "/etc/pki": true,
  154. "/etc/shadow": true,
  155. "/home": true,
  156. "/lib": true,
  157. "/lib64": true,
  158. "/media": true,
  159. "/opt": true,
  160. "/proc": true,
  161. "/root": true,
  162. "/run": true,
  163. "/sbin": true,
  164. "/srv": true,
  165. "/sys": true,
  166. "/tmp": true,
  167. "/usr": true,
  168. "/var": true,
  169. "/var/lib": true,
  170. "/var/log": true,
  171. }
  172. if home := os.Getenv("HOME"); home != "" {
  173. exclude_paths[home] = true
  174. }
  175. if sudoUser := os.Getenv("SUDO_USER"); sudoUser != "" {
  176. if usr, err := user.Lookup(sudoUser); err == nil {
  177. exclude_paths[usr.HomeDir] = true
  178. }
  179. }
  180. if path != "/" {
  181. path = strings.TrimSuffix(path, "/")
  182. }
  183. if exclude_paths[path] {
  184. return fmt.Errorf("SELinux relabeling of %s is not allowed", path)
  185. }
  186. if shared {
  187. c, err := selinux.NewContext(fileLabel)
  188. if err != nil {
  189. return err
  190. }
  191. c["level"] = "s0"
  192. fileLabel = c.Get()
  193. }
  194. if err := selinux.Chcon(path, fileLabel, true); err != nil {
  195. return err
  196. }
  197. return nil
  198. }
  199. // PidLabel will return the label of the process running with the specified pid
  200. func PidLabel(pid int) (string, error) {
  201. return selinux.PidLabel(pid)
  202. }
  203. // Init initialises the labeling system
  204. func Init() {
  205. selinux.GetEnabled()
  206. }
  207. // ClearLabels will clear all reserved labels
  208. func ClearLabels() {
  209. selinux.ClearLabels()
  210. }
  211. // ReserveLabel will record the fact that the MCS label has already been used.
  212. // This will prevent InitLabels from using the MCS label in a newly created
  213. // container
  214. func ReserveLabel(label string) error {
  215. selinux.ReserveLabel(label)
  216. return nil
  217. }
  218. // ReleaseLabel will remove the reservation of the MCS label.
  219. // This will allow InitLabels to use the MCS label in a newly created
  220. // containers
  221. func ReleaseLabel(label string) error {
  222. selinux.ReleaseLabel(label)
  223. return nil
  224. }
  225. // DupSecOpt takes a process label and returns security options that
  226. // can be used to set duplicate labels on future container processes
  227. func DupSecOpt(src string) ([]string, error) {
  228. return selinux.DupSecOpt(src)
  229. }
  230. // DisableSecOpt returns a security opt that can disable labeling
  231. // support for future container processes
  232. func DisableSecOpt() []string {
  233. return selinux.DisableSecOpt()
  234. }
  235. // Validate checks that the label does not include unexpected options
  236. func Validate(label string) error {
  237. if strings.Contains(label, "z") && strings.Contains(label, "Z") {
  238. return ErrIncompatibleLabel
  239. }
  240. return nil
  241. }
  242. // RelabelNeeded checks whether the user requested a relabel
  243. func RelabelNeeded(label string) bool {
  244. return strings.Contains(label, "z") || strings.Contains(label, "Z")
  245. }
  246. // IsShared checks that the label includes a "shared" mark
  247. func IsShared(label string) bool {
  248. return strings.Contains(label, "z")
  249. }