Change runtime Smack check in dev_wos cases to compile-time

Previous patch didn't work for PontusM smack-enabled environment.

Now this patch ensures that WITHOUT dev_wos flag, there is definitely
no difference in logic of security-manager, even in the absence of Smack
(ie. during image creation).

Change-Id: If37d9ceae8bcb5727e82f7310acff0358b820240

diff --git a/src/client/client-security-manager.cpp b/src/client/client-security-manager.cpp
index bb584f901ceef462698df0176c5da40dc1637cea..6a61030af05c213861c781e3ce385129dbc3fb35 100644 (file)
--- a/src/client/client-security-manager.cpp
+++ b/src/client/client-security-manager.cpp
@@ -1017,7 +1017,7 @@ int security_manager_drop_process_privileges(void)
 {
     LogDebug("security_manager_drop_process_privileges() called");
 
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, not dropping capabilities");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1124,7 +1124,7 @@ int security_manager_prepare_app_candidate(void)
 {
     LogDebug("security_manager_prepare_app_candidate() called");
 
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, exiting earlier without setting up namespaces");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1233,7 +1233,7 @@ int security_manager_prepare_app2(const char *app_name, const char *subsession_i
             return ret;
         }
 
-        if (!smack_check()) {
+        if (!smack_simple_check()) {
             LogWarning("Running in no-smack mode, exiting with success from prepare_app2 - not setting namespaces any further, or Smack, or caps");
             return (int)SECURITY_MANAGER_SUCCESS;
         }
@@ -1269,7 +1269,7 @@ int security_manager_cleanup_app(const char *app_name, uid_t uid, pid_t pid)
             return SECURITY_MANAGER_ERROR_INPUT_PARAM;
         }
 
-        if (!smack_check()) {
+        if (!smack_simple_check()) {
             LogWarning("Running in no-smack mode, not cleaning namespaces");
             return SECURITY_MANAGER_SUCCESS;
         }
@@ -1770,7 +1770,7 @@ SECURITY_MANAGER_API
 int security_manager_identify_app_from_socket(int sockfd, char **pkg_name, char **app_name)
 {
     return try_catch([&] {
-        if(!smack_check()) {
+        if(!smack_simple_check()) {
             LogWarning("Running in no-smack mode, returning static pkg_name default_app_no_Smack_mode & empty app_name");
             *pkg_name = strdup("default_app_no_Smack_mode");
             return *pkg_name ? (int)SECURITY_MANAGER_SUCCESS : (int)SECURITY_MANAGER_ERROR_MEMORY;
@@ -1785,7 +1785,7 @@ SECURITY_MANAGER_API
 int security_manager_identify_app_from_pid(pid_t pid, char **pkg_name, char **app_name)
 {
     return try_catch([&] {
-        if(!smack_check()) {
+        if(!smack_simple_check()) {
             LogWarning("Running in no-smack mode, returning static pkg_name default_app_no_Smack_mode & empty app_name");
             *pkg_name = strdup("default_app_no_Smack_mode");
             return *pkg_name ? (int)SECURITY_MANAGER_SUCCESS : (int)SECURITY_MANAGER_ERROR_MEMORY;
@@ -1801,7 +1801,7 @@ int security_manager_self_is_app(bool *app)
 {
     if (!app)
         return SECURITY_MANAGER_ERROR_INPUT_PARAM;
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, can't (yet) determine if a process is an app or not");
         return SECURITY_MANAGER_ERROR_NO_SUCH_OBJECT;
     }
@@ -1859,7 +1859,7 @@ int security_manager_app_has_privilege(const char *app_name, const char *privile
     if (!result || !app_name || !privilege) {
         return SECURITY_MANAGER_ERROR_INPUT_PARAM;
     }
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, treating all apps as having all privileges");
         *result = 1;
         return SECURITY_MANAGER_SUCCESS;
@@ -1880,7 +1880,7 @@ int security_manager_app_has_privilege(const char *app_name, const char *privile
 SECURITY_MANAGER_API
 int security_manager_private_sharing_req_new(private_sharing_req **pp_req)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1900,7 +1900,7 @@ int security_manager_private_sharing_req_new(private_sharing_req **pp_req)
 SECURITY_MANAGER_API
 void security_manager_private_sharing_req_free(private_sharing_req *p_req)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return;
     }
@@ -1911,7 +1911,7 @@ SECURITY_MANAGER_API
 int security_manager_private_sharing_req_set_owner_appid(
     private_sharing_req *p_req, const char *app_name)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1928,7 +1928,7 @@ SECURITY_MANAGER_API
 int security_manager_private_sharing_req_set_target_appid(
     private_sharing_req *p_req, const char *app_name)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1946,7 +1946,7 @@ int security_manager_private_sharing_req_add_paths(private_sharing_req *p_req,
                                                    const char **pp_paths,
                                                    size_t path_count)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1964,7 +1964,7 @@ int security_manager_private_sharing_req_add_paths(private_sharing_req *p_req,
 SECURITY_MANAGER_API
 int security_manager_private_sharing_apply(const private_sharing_req *p_req)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -1984,7 +1984,7 @@ int security_manager_private_sharing_apply(const private_sharing_req *p_req)
 SECURITY_MANAGER_API
 int security_manager_private_sharing_drop(const private_sharing_req *p_req)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, private sharing is a no-op, due to no Smack");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -2278,7 +2278,7 @@ int security_manager_set_identity(
         process_type type,
         const char *app_id = nullptr)
 {
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, exiting with success from security_manager_set_identity - not setting Smack");
         return SECURITY_MANAGER_SUCCESS;
     }

diff --git a/src/common/credentials.cpp b/src/common/credentials.cpp
index 9005282697ef4eb73c7c56b10357a2cb9391f23f..f83764b958aa2d1badde7c6a71495de98c5075ca 100644 (file)
--- a/src/common/credentials.cpp
+++ b/src/common/credentials.cpp
@@ -49,7 +49,7 @@ Credentials Credentials::getCredentialsFromSocket(int sock)
     if (getsockopt(sock, SOL_SOCKET, SO_PEERCRED, &cr, &len) == -1)
         ThrowMsg(Exception::SocketError, "Failed to read peer credentials for sockfd " << sock);
 
-    return Credentials(cr.pid, cr.uid, cr.gid, smack_check() ? SmackLabels::getSmackLabelFromSocket(sock) : "");
+    return Credentials(cr.pid, cr.uid, cr.gid, smack_simple_check() ? SmackLabels::getSmackLabelFromSocket(sock) : "");
 }
 
 Credentials Credentials::getCredentialsFromFd(int fd)
@@ -58,7 +58,7 @@ Credentials Credentials::getCredentialsFromFd(int fd)
     if (-1 == fstat(fd, &buf))
         ThrowMsg(Exception::FdError, "Failed to read credentials from filefd " << fd);
 
-    return Credentials(-1, buf.st_uid, buf.st_gid, smack_check() ? SmackLabels::getSmackLabelFromFd(fd) : "");
+    return Credentials(-1, buf.st_uid, buf.st_gid, smack_simple_check() ? SmackLabels::getSmackLabelFromFd(fd) : "");
 }
 
 } // namespace SecurityManager

diff --git a/src/common/include/smack-check.h b/src/common/include/smack-check.h
index ee82087780e644480a0d67375308ea33a59719af..39b2c777b4c6a298003a30edfa27538037b4975c 100644 (file)
--- a/src/common/include/smack-check.h
+++ b/src/common/include/smack-check.h
@@ -31,10 +31,16 @@ namespace SecurityManager {
 int smack_runtime_check(void);
 
 /*
- * A very simple runtime check for SMACK on the platform
+ * A very simple runtime check for SMACK support on the platform.
  * Returns 1 if SMACK is present, 0 otherwise. If SMACK_ENABLED is not defined
- * It returns 0.
+ * always returns 0.
  */
 int smack_check(void);
 
+/*
+ * An even simpler check for SMACK being enabled at build-time.
+ * Returns 1 if SMACK_ENABLED was defined at built time, 0 otherwise.
+ */
+int smack_simple_check(void);
+
 } // namespace SecurityManager

diff --git a/src/common/service_impl.cpp b/src/common/service_impl.cpp
index 6eaf67663d9f24a6278ebbdf9f5469a4aa763d04..208a6b244fc0bdd35bb8d3497babae88c7fd3bae 100644 (file)
--- a/src/common/service_impl.cpp
+++ b/src/common/service_impl.cpp
@@ -177,7 +177,7 @@ ServiceImpl::ServiceImpl(Offline offline) :
     m_privilegeDb.GetGroupsRelatedPrivileges(group_privileges);
     m_privilegeGids.init(group_privileges);
 
-    if (!underlying(offline) && smack_check()) {
+    if (!underlying(offline) && smack_simple_check()) {
         const auto checkProperDropFlags = CheckProperDrop::computeFlags();
         if (checkProperDropFlags < 0)
             ThrowMsg(FS::Exception::FileError, "Error computing CheckProperDrop flags."
@@ -351,7 +351,7 @@ int ServiceImpl::labelPaths(const pkg_paths &paths,
 {
     try {
 
-        if (!smack_check()) {
+        if (!smack_simple_check()) {
             LogWarning("Running in no-smack mode, not labeling any paths");
             if (!m_privilegeDb.PkgNameExists(pkgName)) {
                 LogError("No such package: " << pkgName);
@@ -516,7 +516,7 @@ int ServiceImpl::appInstallSmackRules(app_inst_req &req, InstallHelper &ih)
     std::string authorHash = std::string();
     Smack::Labels pkgLabels;
 
-    if (!smack_check()) {
+    if (!smack_simple_check()) {
         LogWarning("Running in no-smack mode, not installing any Smack rules");
         return SECURITY_MANAGER_SUCCESS;
     }
@@ -2423,7 +2423,7 @@ int ServiceImpl::prepareApp(const Credentials &creds, const std::string &appName
 
         LogWarning("GetPkgAuthorHash returned : " << authorHash);
 
-        if (m_smackRules.isPrivilegeMappingEnabled() && smack_check()) {
+        if (m_smackRules.isPrivilegeMappingEnabled() && smack_simple_check()) {
             // We have to remove all possible privilege related Smack rules, because application
             // policy might have changed from last prepareApp
             // (e.g. application new version was installed)
@@ -2444,7 +2444,7 @@ int ServiceImpl::prepareApp(const Credentials &creds, const std::string &appName
 
         LogWarning("getForbiddenAndAllowedGroups returned: " << ret);
 
-        if (!smack_check()) {
+        if (!smack_simple_check()) {
             LogWarning("Running in no-smack mode, exiting without setting up namespaces");
             return ret;
         }

diff --git a/src/common/smack-check.cpp b/src/common/smack-check.cpp
index dd2700e01c1ceca57af47486d5f3834c0ef63eb7..b94f960a4686ab183c83f8a9ee0ee021ddf83e22 100644 (file)
--- a/src/common/smack-check.cpp
+++ b/src/common/smack-check.cpp
@@ -53,4 +53,13 @@ int smack_check(void)
 #endif
 }
 
+int smack_simple_check(void)
+{
+#ifndef SMACK_ENABLED
+    return 0;
+ #else
+    return 1;
+ #endif
+ }
+
 } // namespace SecurityManager

diff --git a/src/common/smack-rules.cpp b/src/common/smack-rules.cpp
index 58a288506fdca342a03a0db6d99f0d8cba84d0df..8910634ee92f21a65a62108d8c1d741beff8ef39 100644 (file)
--- a/src/common/smack-rules.cpp
+++ b/src/common/smack-rules.cpp
@@ -302,7 +302,7 @@ void SmackRules::uninstallPackageRules(const std::string &pkgName,
     addFromTemplate(smackRules, TemplateManager::Type::PKG_RULES_TEMPLATE,
                     std::string(), pkgName, std::string());
     generatePackageCrossDeps(smackRules, pkgLabels);
-    if (smack_check())
+    if (smack_simple_check())
         smackRules.clear();
 }
 
@@ -316,7 +316,7 @@ void SmackRules::uninstallApplicationRules(
                     appLabel, pkgName, authorHash);
     if (isPrivilegeMappingEnabled())
         addPrivilegesRules(smackRules, appLabel, pkgName, authorHash, m_templateMgr.getAllMappedPrivs());
-    if (smack_check()) {
+    if (smack_simple_check()) {
         smackRules.clear();
         SmackLabels::revokeSubject(appLabel);
     }
@@ -327,7 +327,7 @@ void SmackRules::uninstallAuthorRules(const std::string &authorHash)
     SmackAccesses smackRules;
     addFromTemplate(smackRules, TemplateManager::Type::AUTHOR_RULES_TEMPLATE,
                     std::string(), std::string(), authorHash);
-    if (smack_check())
+    if (smack_simple_check())
         smackRules.clear();
 }
 
@@ -355,7 +355,7 @@ void SmackRules::applyPrivateSharingRules(
         rules.add(SMACK_SYSTEM_PRIVILEGED, pathLabel, SMACK_APP_PATH_SYSTEM_PERMS);
     }
     rules.add(targetLabel, pathLabel, SMACK_APP_PATH_TARGET_PERMS);
-    if (smack_check())
+    if (smack_simple_check())
         rules.apply();
 }
 
@@ -382,7 +382,7 @@ void SmackRules::dropPrivateSharingRules(
         rules.addModify(SMACK_SYSTEM_PRIVILEGED, pathLabel, "", SMACK_APP_PATH_SYSTEM_PERMS);
     }
     rules.addModify(targetLabel, pathLabel, "", SMACK_APP_PATH_TARGET_PERMS);
-    if (smack_check())
+    if (smack_simple_check())
         rules.apply();
 }
 

diff --git a/src/server/service/service.cpp b/src/server/service/service.cpp
index fe0a19b2b22d8ae2c792d26712c269db4eb00fc4..79d317658444dffedf2b583027a985aad18b6f6c 100644 (file)
--- a/src/server/service/service.cpp
+++ b/src/server/service/service.cpp
@@ -59,7 +59,7 @@ void Service::processEvent(Event &&msg)
         int call_type_int;
         Deserialization::Deserialize(msg.buffer, call_type_int);
         SecurityModuleCall call_type = static_cast<SecurityModuleCall>(call_type_int);
-        if (!smack_check()) {
+        if (!smack_simple_check()) {
             LogWarning("Running in no-smack mode, treating connection as authenticated - privileges will not be checked!");
             msg.creds.authenticated = true;
         }