diff options
Diffstat (limited to 'meta-security/recipes-security/smacknet/files')
| -rw-r--r-- | meta-security/recipes-security/smacknet/files/smacknet | 184 | ||||
| -rw-r--r-- | meta-security/recipes-security/smacknet/files/smacknet.service | 11 |
2 files changed, 0 insertions, 195 deletions
diff --git a/meta-security/recipes-security/smacknet/files/smacknet b/meta-security/recipes-security/smacknet/files/smacknet deleted file mode 100644 index 3818d30ae..000000000 --- a/meta-security/recipes-security/smacknet/files/smacknet +++ /dev/null @@ -1,184 +0,0 @@ -#!/usr/bin/python -# Copyright (c) 2012, 2013, Intel Corporation -# Copyright (c) 2009 David Wolinsky <davidiw@ufl.edu), University of Florida -# All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions -# are met: -# 1. Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# 2. Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# 3. The name of the author may not be used to endorse or promote products -# derived from this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR -# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. -# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, -# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT -# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -import socket,fcntl, struct, thread -import os.path -import sys - -SMACKFS_LOAD="/sys/fs/smackfs/load2" -SMACKFS_NETLABEL="/sys/fs/smackfs/netlabel" -SIOCGIFADDR = 0x8915 -SIOCGIFNETMASK = 0x891b - -def get_ip_address(ifname): - s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - return fcntl.ioctl(s.fileno(), SIOCGIFADDR, - struct.pack('256s', ifname.encode("utf-8")))[20:24] - -def get_netmask(ifname): - s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - return fcntl.ioctl(s.fileno(), SIOCGIFNETMASK, - struct.pack('256s', ifname.encode("utf-8")))[20:24] - -def applynetlabeltags(interface, addr): - if not interface.startswith("lo"): - bmask = get_netmask(interface.encode("utf-8")) - prefix = bin(struct.unpack(">L", bmask)[0]).count("1") - tags = [ - addr+"/"+str(prefix)+" Network::Local\n", - "0.0.0.0/0 Network::Cloud\n", - "127.0.0.1/8 -CIPSO\n"] - smackfs_netlabel(tags) - -def loadnetlabelrules(): - rulesSystem = [ - "System Network::Cloud w\n", - "System Network::Local w\n", - "Network::Cloud System w\n", - "Network::Local System w\n"] - smackfs_load2(rulesSystem) - -def smackfs_load2 (rules): - with open(SMACKFS_LOAD, "w") as load2: - for rule in rules: - load2.write(rule) - -def smackfs_netlabel (tags): - for tag in tags: - with open(SMACKFS_NETLABEL, "w") as netlabel: - netlabel.write(tag) - -""" - Source of: Class ip monitor, and other functions named bellow. - Original author: David Wolinsky <davidiw@ufl.edu - Copied from: https://github.com/davidiw/Grid-Appliance/blob/master/scripts/ip_monitor.py - -""" - -"""4 byte alignment""" - -def align(inc): - diff = inc % 4 - return inc + ((4 - diff) % 4) - -class ifaddr: - """Parse an ifaddr packet""" - LOCAL = 2 - LABEL = 3 - - def __init__(self, packet): - self.family, self.prefixlen, self.flags, self.scope, self.index = \ - struct.unpack("BBBBI", packet[:8]) - -class rtattr: - """Parse a rtattr packet""" - GRP_IPV4_IFADDR = 0x10 - - NEWADDR = 20 - DELADDR = 21 - GETADDR = 22 - - def __init__(self, packet): - self.len, self.type = struct.unpack("HH", packet[:4]) - if self.type == ifaddr.LOCAL: - addr = struct.unpack("BBBB", packet[4:self.len]) - self.payload = "%s.%s.%s.%s" % (addr[0], addr[1], addr[2], addr[3]) - elif self.type == ifaddr.LABEL: - self.payload = packet[4:self.len].strip("\0") - else: - self.payload = packet[4:self.len] - -class netlink: - """Parse a netlink packet""" - REQUEST = 1 - ROOT = 0x100 - MATCH = 0x200 - DONE = 3 - - def __init__(self, packet): - self.msglen, self.msgtype, self.flags, self.seq, self.pid = \ - struct.unpack("IHHII", packet[:16]) - self.ifa = None - try: - self.ifa = ifaddr(packet[16:24]) - except: - return - - self.rtas = {} - pos = 24 - while pos < self.msglen: - try: - rta = rtattr(packet[pos:]) - except: - break - pos += align(rta.len) - self.rtas[rta.type] = rta.payload - -class ip_monitor: - def __init__(self, callback = None): - if callback == None: - callback = self.print_cb - self._callback = callback - - def print_cb(self, label, addr): - print (label + " => " + addr) - - def request_addrs(self, sock): - sock.send(struct.pack("IHHIIBBBBI", 24, rtattr.GETADDR, \ - netlink.REQUEST | netlink.ROOT | netlink.MATCH, 0, sock.getsockname()[0], \ - socket.AF_INET, 0, 0, 0, 0)) - - def start_thread(self): - thread.start_new_thread(self.run, ()) - - def run(self): - sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, socket.NETLINK_ROUTE) - sock.bind((0, rtattr.GRP_IPV4_IFADDR)) - self.request_addrs(sock) - - while True: - data = sock.recv(4096) - pos = 0 - while pos < len(data): - nl = netlink(data[pos:]) - if nl.msgtype == netlink.DONE: - break - pos += align(nl.msglen) - if nl.msgtype != rtattr.NEWADDR: - continue - self._callback(nl.rtas[ifaddr.LABEL], nl.rtas[ifaddr.LOCAL]) - -def main(): - if not os.path.isfile(SMACKFS_LOAD): - print ("Smack not found.") - return -1 - loadnetlabelrules() - - ip_monitor(applynetlabeltags).run() - -if __name__ == "__main__": - main() diff --git a/meta-security/recipes-security/smacknet/files/smacknet.service b/meta-security/recipes-security/smacknet/files/smacknet.service deleted file mode 100644 index 218d8b896..000000000 --- a/meta-security/recipes-security/smacknet/files/smacknet.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=netlabels configuration for SMACK -Wants=network.target network-online.target -After=network.target network-online.target - -[Service] -TimeoutStartSec=0 -ExecStart=@BINDIR@/smacknet - -[Install] -WantedBy=multi-user.target |