add_library(${PROJECT_NAME} SHARED ${SRC})
-target_link_libraries(${PROJECT_NAME} libsystemd.so)
+target_link_libraries(${PROJECT_NAME}
+ libsystemd.so
+ libsmack.so
+)
install(TARGETS ${PROJECT_NAME} DESTINATION ${LIBDIR})
#include <stdio.h>
#include <unistd.h>
#include <string.h>
+#include <sys/smack.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
throw std::runtime_error("Cannot find sd_unix socket");
}
+static std::string get_socket_smack_label(int sock_fd)
+{
+ char *label;
+ int ret = smack_new_label_from_socket(sock_fd, &label);
+ if (ret < 0)
+ return "";
+
+ std::string out(label);
+ ::free(label);
+
+ return out;
+}
+
namespace Unix {
if (sock_fd == -1)
throw std::runtime_error("Server accept error, errno=" + std::to_string(errno));
+ /* Workaround: Check SMACK permission of connected client */
+ std::string label = get_socket_smack_label(sock_fd);
+ if (label != "System") {
+ ::close(sock_fd);
+ throw std::runtime_error("Unauthorized access attempt, SMACK label='" + label + "'");
+ }
+
return new Socket(sock_fd);
}