Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita64bdf5

Browse files
committed
Allow sepgsql regression tests to be run from a user homedir.
KaiGai Kohei, with some changes by me.
1 parent00a7c90 commita64bdf5

File tree

2 files changed

+53
-12
lines changed

2 files changed

+53
-12
lines changed

‎contrib/sepgsql/chkselinuxenv

Lines changed: 50 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,33 @@ PG_DATADIR="$2"
99

1010
echo
1111
echo"============== checking selinux environment =============="
12+
#
13+
# Test.0 - necessary commands for environment checks
14+
#
15+
echo -n"test installed commands ..."
16+
if! which --help>&/dev/null;then
17+
echo"failed"
18+
echo
19+
echo"'which' command was not found, executable or installed."
20+
echo"Please make sure your PATH, or install this command at first."
21+
echo
22+
echo"If yum is available on your system, it will suggest packages"
23+
echo"to be installed:"
24+
echo" # yum provides which"
25+
exit 1
26+
fi
27+
if! matchpathcon -n />&/dev/null;then
28+
echo"failed"
29+
echo
30+
echo"'matchpathcon' command was not found, executable or installed."
31+
echo"Please make sure your PATH, or install this command at first."
32+
echo
33+
echo"If yum is available on your system, it will suggest packages"
34+
echo"to be installed:"
35+
echo" # yum provides which"
36+
exit 1
37+
fi
38+
echo"ok"
1239

1340
#
1441
# Test.1 - must be launched at unconfined_t domain
@@ -164,24 +191,36 @@ fi
164191
echo"ok"
165192

166193
#
167-
# Test.8 - 'psql' command must belabeled as 'bin_t' type
194+
# Test.8 - 'psql' command must beexecutable by test domain
168195
#
169-
echo -n"testlabel of psql ..."
196+
echo -n"testexecution of psql ..."
170197

171198
CMD_PSQL="${PG_BINDIR}/psql"
172-
LABEL_PSQL=`stat -c'%C'${CMD_PSQL}| sed's/:/ /g'| awk'{print $3}'`
173-
if ["${LABEL_PSQL}"!="bin_t" ];then
199+
${CMD_RUNCON} -t sepgsql_regtest_user_t${CMD_PSQL}--help>& /dev/null
200+
if [$?-ne 0 ];then
174201
echo"failed"
175202
echo
176-
echo"The${CMD_PSQL} must be labeled as bin_t type."
177-
echo"You can assign right label using restorecon, as follows:"
203+
echo"The${CMD_PSQL} must be executable by sepgsql_regtest_user_t"
204+
echo"domain. It has restricted privileges compared to unconfined_t,"
205+
echo"so you should ensure whether this command is labeled correctly."
178206
echo
179207
echo"\$ su - (not needed, if you owns installation directory)"
180-
echo" # restorecon -R${PG_BINDIR}"
181-
echo
182-
echo"Or, using chcon"
183-
echo
184-
echo" # chcon -t bin_t${CMD_PSQL}"
208+
EXPECT_PSQL=`matchpathcon -n${CMD_PSQL}| sed's/:/ /g'| awk'{print $3}'`
209+
if ["${EXPECT_PSQL}"="user_home_t" ];then
210+
## Case of installation on /home directory
211+
echo" # restorecon -R${PG_BINDIR}"
212+
echo
213+
echo"Or, using chcon"
214+
echo
215+
echo" # chcon -t user_home_t${CMD_PSQL}"
216+
else
217+
echo"\$ su - (not needed, if you own the installation directory)"
218+
echo" # restorecon -R${PG_BINDIR}"
219+
echo
220+
echo"Or, using chcon"
221+
echo
222+
echo" # chcon -t bin_t${CMD_PSQL}"
223+
fi
185224
echo
186225
exit 1
187226
fi

‎contrib/sepgsql/sepgsql-regtest.te

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
policy_module(sepgsql-regtest,1.02)
1+
policy_module(sepgsql-regtest,1.03)
22

33
gen_require(`
44
all_userspace_class_perms
@@ -24,6 +24,7 @@ postgresql_procedure_object(sepgsql_regtest_trusted_proc_exec_t)
2424
role sepgsql_regtest_dba_r;
2525
userdom_base_user_template(sepgsql_regtest_dba)
2626
userdom_manage_home_role(sepgsql_regtest_dba_r, sepgsql_regtest_dba_t)
27+
userdom_exec_user_home_content_files(sepgsql_regtest_dba_t)
2728
userdom_write_user_tmp_sockets(sepgsql_regtest_user_t)
2829
optional_policy(`
2930
postgresql_admin(sepgsql_regtest_dba_t, sepgsql_regtest_dba_r)
@@ -40,6 +41,7 @@ optional_policy(`
4041
role sepgsql_regtest_user_r;
4142
userdom_base_user_template(sepgsql_regtest_user)
4243
userdom_manage_home_role(sepgsql_regtest_user_r, sepgsql_regtest_user_t)
44+
userdom_exec_user_home_content_files(sepgsql_regtest_user_t)
4345
userdom_write_user_tmp_sockets(sepgsql_regtest_user_t)
4446
optional_policy(`
4547
postgresql_role(sepgsql_regtest_user_r, sepgsql_regtest_user_t)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp