1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package android.os;
18
19import android.util.Slog;
20
21import java.io.IOException;
22import java.io.File;
23import java.io.FileDescriptor;
24
25/**
26 * This class provides access to the centralized jni bindings for
27 * SELinux interaction.
28 * {@hide}
29 */
30public class SELinux {
31    private static final String TAG = "SELinux";
32
33    /** Keep in sync with ./external/libselinux/include/selinux/android.h */
34    private static final int SELINUX_ANDROID_RESTORECON_NOCHANGE = 1;
35    private static final int SELINUX_ANDROID_RESTORECON_VERBOSE = 2;
36    private static final int SELINUX_ANDROID_RESTORECON_RECURSE = 4;
37    private static final int SELINUX_ANDROID_RESTORECON_FORCE = 8;
38    private static final int SELINUX_ANDROID_RESTORECON_DATADATA = 16;
39
40    /**
41     * Determine whether SELinux is disabled or enabled.
42     * @return a boolean indicating whether SELinux is enabled.
43     */
44    public static final native boolean isSELinuxEnabled();
45
46    /**
47     * Determine whether SELinux is permissive or enforcing.
48     * @return a boolean indicating whether SELinux is enforcing.
49     */
50    public static final native boolean isSELinuxEnforced();
51
52    /**
53     * Sets the security context for newly created file objects.
54     * @param context a security context given as a String.
55     * @return a boolean indicating whether the operation succeeded.
56     */
57    public static final native boolean setFSCreateContext(String context);
58
59    /**
60     * Change the security context of an existing file object.
61     * @param path representing the path of file object to relabel.
62     * @param context new security context given as a String.
63     * @return a boolean indicating whether the operation succeeded.
64     */
65    public static final native boolean setFileContext(String path, String context);
66
67    /**
68     * Get the security context of a file object.
69     * @param path the pathname of the file object.
70     * @return a security context given as a String.
71     */
72    public static final native String getFileContext(String path);
73
74    /**
75     * Get the security context of a peer socket.
76     * @param fd FileDescriptor class of the peer socket.
77     * @return a String representing the peer socket security context.
78     */
79    public static final native String getPeerContext(FileDescriptor fd);
80
81    /**
82     * Gets the security context of the current process.
83     * @return a String representing the security context of the current process.
84     */
85    public static final native String getContext();
86
87    /**
88     * Gets the security context of a given process id.
89     * @param pid an int representing the process id to check.
90     * @return a String representing the security context of the given pid.
91     */
92    public static final native String getPidContext(int pid);
93
94    /**
95     * Check permissions between two security contexts.
96     * @param scon The source or subject security context.
97     * @param tcon The target or object security context.
98     * @param tclass The object security class name.
99     * @param perm The permission name.
100     * @return a boolean indicating whether permission was granted.
101     */
102    public static final native boolean checkSELinuxAccess(String scon, String tcon, String tclass, String perm);
103
104    /**
105     * Restores a file to its default SELinux security context.
106     * If the system is not compiled with SELinux, then {@code true}
107     * is automatically returned.
108     * If SELinux is compiled in, but disabled, then {@code true} is
109     * returned.
110     *
111     * @param pathname The pathname of the file to be relabeled.
112     * @return a boolean indicating whether the relabeling succeeded.
113     * @exception NullPointerException if the pathname is a null object.
114     */
115    public static boolean restorecon(String pathname) throws NullPointerException {
116        if (pathname == null) { throw new NullPointerException(); }
117        return native_restorecon(pathname, 0);
118    }
119
120    /**
121     * Restores a file to its default SELinux security context.
122     * If the system is not compiled with SELinux, then {@code true}
123     * is automatically returned.
124     * If SELinux is compiled in, but disabled, then {@code true} is
125     * returned.
126     *
127     * @param pathname The pathname of the file to be relabeled.
128     * @return a boolean indicating whether the relabeling succeeded.
129     */
130    private static native boolean native_restorecon(String pathname, int flags);
131
132    /**
133     * Restores a file to its default SELinux security context.
134     * If the system is not compiled with SELinux, then {@code true}
135     * is automatically returned.
136     * If SELinux is compiled in, but disabled, then {@code true} is
137     * returned.
138     *
139     * @param file The File object representing the path to be relabeled.
140     * @return a boolean indicating whether the relabeling succeeded.
141     * @exception NullPointerException if the file is a null object.
142     */
143    public static boolean restorecon(File file) throws NullPointerException {
144        try {
145            return native_restorecon(file.getCanonicalPath(), 0);
146        } catch (IOException e) {
147            Slog.e(TAG, "Error getting canonical path. Restorecon failed for " +
148                    file.getPath(), e);
149            return false;
150        }
151    }
152
153    /**
154     * Recursively restores all files under the given path to their default
155     * SELinux security context. If the system is not compiled with SELinux,
156     * then {@code true} is automatically returned. If SELinux is compiled in,
157     * but disabled, then {@code true} is returned.
158     *
159     * @return a boolean indicating whether the relabeling succeeded.
160     */
161    public static boolean restoreconRecursive(File file) {
162        try {
163            return native_restorecon(file.getCanonicalPath(), SELINUX_ANDROID_RESTORECON_RECURSE);
164        } catch (IOException e) {
165            Slog.e(TAG, "Error getting canonical path. Restorecon failed for " +
166                    file.getPath(), e);
167            return false;
168        }
169    }
170}
171