Skip to content

Commit 291873c

Browse files
robertmhaasrobertmhaas
committed
Teach sepgsql about database labels.
This is still a bit of a hack, but it's better than the old way, for sure. KaiGai Kohei, with one change by me to make it compile
1 parent a5e94ea commit 291873c

File tree

6 files changed

+128
-13
lines changed

6 files changed

+128
-13
lines changed

‎contrib/sepgsql/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
MODULE_big = sepgsql
44
OBJS = hooks.o selinux.o uavc.o label.o dml.o \
5-
schema.o relation.o proc.o
5+
database.o schema.o relation.o proc.o
66
DATA_built = sepgsql.sql
77

88
REGRESS = label dml misc

‎contrib/sepgsql/database.c

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/* -------------------------------------------------------------------------
2+
*
3+
* contrib/sepgsql/database.c
4+
*
5+
* Routines corresponding to database objects
6+
*
7+
* Copyright (c) 2010-2011, PostgreSQL Global Development Group
8+
*
9+
* -------------------------------------------------------------------------
10+
*/
11+
#include "postgres.h"
12+
13+
#include "catalog/dependency.h"
14+
#include "catalog/pg_database.h"
15+
#include "commands/seclabel.h"
16+
#include "sepgsql.h"
17+
18+
void
19+
sepgsql_database_post_create(Oid databaseId)
20+
{
21+
char *scontext = sepgsql_get_client_label();
22+
char *tcontext;
23+
char *ncontext;
24+
ObjectAddress object;
25+
26+
/*
27+
* Compute a default security label of the newly created database
28+
* based on a pair of security label of client and source database.
29+
*
30+
* XXX - Right now, this logic uses "template1" as its source, because
31+
* here is no way to know the Oid of source database.
32+
*/
33+
object.classId = DatabaseRelationId;
34+
object.objectId = TemplateDbOid;
35+
object.objectSubId = 0;
36+
tcontext = GetSecurityLabel(&object, SEPGSQL_LABEL_TAG);
37+
38+
ncontext = sepgsql_compute_create(scontext, tcontext,
39+
SEPG_CLASS_DB_DATABASE);
40+
41+
/*
42+
* Assign the default security label on the new database
43+
*/
44+
object.classId = DatabaseRelationId;
45+
object.objectId = databaseId;
46+
object.objectSubId = 0;
47+
48+
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
49+
50+
pfree(ncontext);
51+
pfree(tcontext);
52+
}
53+
54+
/*
55+
* sepgsql_database_relabel
56+
*
57+
* It checks privileges to relabel the supplied database with the `seclabel'
58+
*/
59+
void
60+
sepgsql_database_relabel(Oid databaseId, const char *seclabel)
61+
{
62+
ObjectAddress object;
63+
char *audit_name;
64+
65+
object.classId = DatabaseRelationId;
66+
object.objectId = databaseId;
67+
object.objectSubId = 0;
68+
audit_name = getObjectDescription(&object);
69+
70+
/*
71+
* check db_database:{setattr relabelfrom} permission
72+
*/
73+
sepgsql_avc_check_perms(&object,
74+
SEPG_CLASS_DB_DATABASE,
75+
SEPG_DB_DATABASE__SETATTR |
76+
SEPG_DB_DATABASE__RELABELFROM,
77+
audit_name,
78+
true);
79+
/*
80+
* check db_database:{relabelto} permission
81+
*/
82+
sepgsql_avc_check_perms_label(seclabel,
83+
SEPG_CLASS_DB_DATABASE,
84+
SEPG_DB_DATABASE__RELABELTO,
85+
audit_name,
86+
true);
87+
pfree(audit_name);
88+
}

‎contrib/sepgsql/hooks.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
#include "catalog/objectaccess.h"
1414
#include "catalog/pg_class.h"
15+
#include "catalog/pg_database.h"
1516
#include "catalog/pg_namespace.h"
1617
#include "catalog/pg_proc.h"
1718
#include "commands/seclabel.h"
@@ -125,6 +126,10 @@ sepgsql_object_access(ObjectAccessType access,
125126
case OAT_POST_CREATE:
126127
switch (classId)
127128
{
129+
case DatabaseRelationId:
130+
sepgsql_database_post_create(objectId);
131+
break;
132+
128133
case NamespaceRelationId:
129134
sepgsql_schema_post_create(objectId);
130135
break;

‎contrib/sepgsql/label.c

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
#include "catalog/indexing.h"
1818
#include "catalog/pg_attribute.h"
1919
#include "catalog/pg_class.h"
20+
#include "catalog/pg_database.h"
2021
#include "catalog/pg_namespace.h"
2122
#include "catalog/pg_proc.h"
2223
#include "commands/dbcommands.h"
@@ -121,9 +122,14 @@ sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
121122
*/
122123
switch (object->classId)
123124
{
125+
case DatabaseRelationId:
126+
sepgsql_database_relabel(object->objectId, seclabel);
127+
break;
128+
124129
case NamespaceRelationId:
125130
sepgsql_schema_relabel(object->objectId, seclabel);
126131
break;
132+
127133
case RelationRelationId:
128134
if (object->objectSubId == 0)
129135
sepgsql_relation_relabel(object->objectId,
@@ -133,6 +139,7 @@ sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
133139
object->objectSubId,
134140
seclabel);
135141
break;
142+
136143
case ProcedureRelationId:
137144
sepgsql_proc_relabel(object->objectId, seclabel);
138145
break;
@@ -315,6 +322,7 @@ exec_object_restorecon(struct selabel_handle * sehnd, Oid catalogId)
315322
SnapshotNow, 0, NULL);
316323
while (HeapTupleIsValid(tuple = systable_getnext(sscan)))
317324
{
325+
Form_pg_database datForm;
318326
Form_pg_namespace nspForm;
319327
Form_pg_class relForm;
320328
Form_pg_attribute attForm;
@@ -330,6 +338,19 @@ exec_object_restorecon(struct selabel_handle * sehnd, Oid catalogId)
330338
*/
331339
switch (catalogId)
332340
{
341+
case DatabaseRelationId:
342+
datForm = (Form_pg_database) GETSTRUCT(tuple);
343+
344+
objtype = SELABEL_DB_DATABASE;
345+
346+
objname = quote_object_name(NameStr(datForm->datname),
347+
NULL, NULL, NULL);
348+
349+
object.classId = DatabaseRelationId;
350+
object.objectId = HeapTupleGetOid(tuple);
351+
object.objectSubId = 0;
352+
break;
353+
333354
case NamespaceRelationId:
334355
nspForm = (Form_pg_namespace) GETSTRUCT(tuple);
335356

@@ -506,10 +527,7 @@ sepgsql_restorecon(PG_FUNCTION_ARGS)
506527
errmsg("SELinux: failed to initialize labeling handle: %m")));
507528
PG_TRY();
508529
{
509-
/*
510-
* Right now, we have no support labeling on the shared database
511-
* objects, such as database, role, or tablespace.
512-
*/
530+
exec_object_restorecon(sehnd, DatabaseRelationId);
513531
exec_object_restorecon(sehnd, NamespaceRelationId);
514532
exec_object_restorecon(sehnd, RelationRelationId);
515533
exec_object_restorecon(sehnd, AttributeRelationId);

‎contrib/sepgsql/schema.c

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111
#include "postgres.h"
1212

1313
#include "catalog/dependency.h"
14+
#include "catalog/pg_database.h"
1415
#include "catalog/pg_namespace.h"
1516
#include "commands/seclabel.h"
17+
#include "miscadmin.h"
1618
#include "utils/lsyscache.h"
1719

1820
#include "sepgsql.h"
@@ -26,22 +28,17 @@
2628
void
2729
sepgsql_schema_post_create(Oid namespaceId)
2830
{
29-
char *scontext = sepgsql_get_client_label();
31+
char *scontext;
3032
char *tcontext;
3133
char *ncontext;
3234
ObjectAddress object;
3335

34-
/*
35-
* FIXME: Right now, we assume pg_database object has a fixed security
36-
* label, because pg_seclabel does not support to store label of shared
37-
* database objects.
38-
*/
39-
tcontext = "system_u:object_r:sepgsql_db_t:s0";
40-
4136
/*
4237
* Compute a default security label when we create a new schema object
4338
* under the working database.
4439
*/
40+
scontext = sepgsql_get_client_label();
41+
tcontext = sepgsql_get_label(DatabaseRelationId, MyDatabaseId, 0);
4542
ncontext = sepgsql_compute_create(scontext, tcontext,
4643
SEPG_CLASS_DB_SCHEMA);
4744

@@ -54,6 +51,7 @@ sepgsql_schema_post_create(Oid namespaceId)
5451
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
5552

5653
pfree(ncontext);
54+
pfree(tcontext);
5755
}
5856

5957
/*

‎contrib/sepgsql/sepgsql.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,12 @@ extern Datum sepgsql_restorecon(PG_FUNCTION_ARGS);
283283
*/
284284
extern bool sepgsql_dml_privileges(List *rangeTabls, bool abort);
285285

286+
/*
287+
* database.c
288+
*/
289+
extern void sepgsql_database_post_create(Oid databaseId);
290+
extern void sepgsql_database_relabel(Oid databaseId, const char *seclabel);
291+
286292
/*
287293
* schema.c
288294
*/

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy