Add dev_wos build option for permissive mode

Usage: gbs <your favourite flags> --define "dev_wos 1".

In the permissive mode, the smack label of a client will be set to "/System".
So no sandboxing is applied to data stored in key-manager.

If flag is not set, is disabled by default.

Change-Id: I0d13049f6bc0cf74b88c15633f2564593bdcdb56

diff --git a/CMakeLists.txt b/CMakeLists.txt
index ecfc13d0445986e7a0a0d6a0f80d0b13835b2779..744b67dcc7174e0e4d958fd7594013bc693db1fa 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -67,6 +67,10 @@ ADD_DEFINITIONS("-DINITIAL_VALUES_DIR_RW=\"${INITIAL_VALUES_DIR_RW}\"")
 ADD_DEFINITIONS("-DCA_CERTS_DIR=\"${CA_CERTS_DIR}\"")
 ADD_DEFINITIONS("-DSYSTEMD_ENV_FILE=\"${SYSTEMD_ENV_FILE}\"")
 
+IF(CKM_PERMISSIVE_MODE)
+    ADD_DEFINITIONS("-DCKM_PERMISSIVE_MODE")
+ENDIF(CKM_PERMISSIVE_MODE)
+
 SET(KEY_MANAGER_PATH ${PROJECT_SOURCE_DIR}/src/manager)
 
 IF(NOT DEFINED COVERAGE_DIR)

diff --git a/packaging/key-manager.spec b/packaging/key-manager.spec
index f8dc2775fff0792c198d7351176c94795bea3eda..1f91aa4842d31185c8f827144a844238b49459a6 100644 (file)
--- a/packaging/key-manager.spec
+++ b/packaging/key-manager.spec
@@ -78,6 +78,7 @@ BuildRequires: liboqs
 %global initial_values_dir_rw %{rw_data_dir}/initial_values
 %global ca_certs_dir %{?TZ_SYS_CA_CERTS:%TZ_SYS_CA_CERTS}%{!?TZ_SYS_CA_CERTS:%ro_etc_dir/ssl/certs}
 %global dump_legacy_db_libname key-manager-dump-legacy-database
+%global ckm_permissive_mode %{?dev_wos:%dev_wos}%{!?dev_wos:0}
 
 %description
 Central Key Manager daemon could be used as secure storage
@@ -225,6 +226,9 @@ export LDFLAGS+="-Wl,--rpath=%{_libdir},-Bsymbolic-functions"
         -DCOVERAGE_DIR=%{coverage_dir} \
 %if %{coverage_only}
         -DCOVERAGE_ONLY=ON \
+%endif
+%if %{ckm_permissive_mode} == 1
+        -DCKM_PERMISSIVE_MODE="ON"          \
 %endif
         -DDUMP_LEGACY_DB_LIBNAME=%{dump_legacy_db_libname}
 

diff --git a/src/manager/main/socket-2-id.cpp b/src/manager/main/socket-2-id.cpp
index 8d4f712ff1efbdf694ef431df72c22c090479840..2718c11e31e7d7087da3a0999f31d9ad4d24eae7 100644 (file)
--- a/src/manager/main/socket-2-id.cpp
+++ b/src/manager/main/socket-2-id.cpp
@@ -30,6 +30,7 @@
 
 namespace CKM {
 
+#ifndef CKM_PERMISSIVE_MODE
 namespace {
 
 int getPkgIdFromSocket(int sock, std::string &pkgId)
@@ -95,6 +96,7 @@ int Socket2Id::getCredentialsFromSocket(int sock, std::string &res)
 
        return assignToString(result, length, res);
 }
+#endif
 
 void Socket2Id::mapToDomainClient(std::string &pkgId)
 {
@@ -113,8 +115,12 @@ void Socket2Id::resetCache()
        m_stringMap.clear();
 }
 
-int Socket2Id::translate(int sock, std::string &result)
+int Socket2Id::translate(__attribute__((unused)) int sock, std::string &result)
 {
+#ifdef CKM_PERMISSIVE_MODE
+       result = "/System";
+       return 0;
+#else
        std::string smack;
 
        if (0 > getCredentialsFromSocket(sock, smack))
@@ -143,6 +149,7 @@ int Socket2Id::translate(int sock, std::string &result)
        result = pkgId;
        m_stringMap.emplace(std::move(smack), std::move(pkgId));
        return 0;
+#endif
 }
 
 } // namespace CKM