Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0f05840

Browse files
committed
Allow sepgsql labels to depend on object name.
The main change here is to call security_compute_create_name_raw()rather than security_compute_create_raw(). This ups the minimumrequirement for libselinux from 2.0.99 to 2.1.10, but it lookslike most distributions will have picked that up before 9.3 is out.KaiGai Kohei
1 parentae7f1c3 commit0f05840

File tree

13 files changed

+104
-40
lines changed

13 files changed

+104
-40
lines changed

‎configure

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9710,9 +9710,9 @@ fi
97109710
# for contrib/sepgsql
97119711
if test "$with_selinux" = yes; then
97129712

9713-
{ $as_echo "$as_me:$LINENO: checking forselinux_status_open in -lselinux" >&5
9714-
$as_echo_n "checking forselinux_status_open in -lselinux... " >&6; }
9715-
if test "${ac_cv_lib_selinux_selinux_status_open+set}" = set; then
9713+
{ $as_echo "$as_me:$LINENO: checking forsecurity_compute_create_name in -lselinux" >&5
9714+
$as_echo_n "checking forsecurity_compute_create_name in -lselinux... " >&6; }
9715+
if test "${ac_cv_lib_selinux_security_compute_create_name+set}" = set; then
97169716
$as_echo_n "(cached) " >&6
97179717
else
97189718
ac_check_lib_save_LIBS=$LIBS
@@ -9730,11 +9730,11 @@ cat >>conftest.$ac_ext <<_ACEOF
97309730
#ifdef __cplusplus
97319731
extern "C"
97329732
#endif
9733-
charselinux_status_open ();
9733+
charsecurity_compute_create_name ();
97349734
int
97359735
main ()
97369736
{
9737-
returnselinux_status_open ();
9737+
returnsecurity_compute_create_name ();
97389738
;
97399739
return 0;
97409740
}
@@ -9760,31 +9760,31 @@ $as_echo "$ac_try_echo") >&5
97609760
test "$cross_compiling" = yes ||
97619761
$as_test_x conftest$ac_exeext
97629762
}; then
9763-
ac_cv_lib_selinux_selinux_status_open=yes
9763+
ac_cv_lib_selinux_security_compute_create_name=yes
97649764
else
97659765
$as_echo "$as_me: failed program was:" >&5
97669766
sed 's/^/| /' conftest.$ac_ext >&5
97679767

9768-
ac_cv_lib_selinux_selinux_status_open=no
9768+
ac_cv_lib_selinux_security_compute_create_name=no
97699769
fi
97709770

97719771
rm -rf conftest.dSYM
97729772
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
97739773
conftest$ac_exeext conftest.$ac_ext
97749774
LIBS=$ac_check_lib_save_LIBS
97759775
fi
9776-
{ $as_echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_selinux_status_open" >&5
9777-
$as_echo "$ac_cv_lib_selinux_selinux_status_open" >&6; }
9778-
if test "x$ac_cv_lib_selinux_selinux_status_open" = x""yes; then
9776+
{ $as_echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_security_compute_create_name" >&5
9777+
$as_echo "$ac_cv_lib_selinux_security_compute_create_name" >&6; }
9778+
if test "x$ac_cv_lib_selinux_security_compute_create_name" = x""yes; then
97799779
cat >>confdefs.h <<_ACEOF
97809780
#define HAVE_LIBSELINUX 1
97819781
_ACEOF
97829782

97839783
LIBS="-lselinux $LIBS"
97849784

97859785
else
9786-
{ { $as_echo "$as_me:$LINENO: error: library 'libselinux', version 2.0.99 or newer, is required for SELinux support" >&5
9787-
$as_echo "$as_me: error: library 'libselinux', version 2.0.99 or newer, is required for SELinux support" >&2;}
9786+
{ { $as_echo "$as_me:$LINENO: error: library 'libselinux', version 2.1.10 or newer, is required for SELinux support" >&5
9787+
$as_echo "$as_me: error: library 'libselinux', version 2.1.10 or newer, is required for SELinux support" >&2;}
97889788
{ (exit 1); exit 1; }; }
97899789
fi
97909790

‎configure.in

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -952,8 +952,8 @@ fi
952952

953953
# for contrib/sepgsql
954954
if test "$with_selinux" = yes; then
955-
AC_CHECK_LIB(selinux,selinux_status_open, [],
956-
[AC_MSG_ERROR([library 'libselinux', version 2.0.99 or newer, is required for SELinux support])])
955+
AC_CHECK_LIB(selinux,security_compute_create_name, [],
956+
[AC_MSG_ERROR([library 'libselinux', version 2.1.10 or newer, is required for SELinux support])])
957957
fi
958958

959959
# for contrib/uuid-ossp

‎contrib/sepgsql/database.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,8 @@ sepgsql_database_post_create(Oid databaseId, const char *dtemplate)
9292

9393
ncontext=sepgsql_compute_create(sepgsql_get_client_label(),
9494
tcontext,
95-
SEPG_CLASS_DB_DATABASE);
95+
SEPG_CLASS_DB_DATABASE,
96+
NameStr(datForm->datname));
9697

9798
/*
9899
* check db_database:{create} permission

‎contrib/sepgsql/expected/label.out

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,45 @@ SELECT sepgsql_getcon();-- confirm client privilege
6464

6565
CREATE TABLE t3 (s int, t text);
6666
INSERT INTO t3 VALUES (1, 'sss'), (2, 'ttt'), (3, 'uuu');
67+
SELECT sepgsql_getcon();-- confirm client privilege
68+
sepgsql_getcon
69+
----------------------------------------------------
70+
unconfined_u:unconfined_r:sepgsql_regtest_dba_t:s0
71+
(1 row)
72+
73+
CREATE TABLE t4 (m int, n text);
74+
INSERT INTO t4 VALUES (1,'mmm'), (2,'nnn'), (3,'ooo');
6775
SELECT objtype, objname, label FROM pg_seclabels
68-
WHERE provider = 'selinux'
69-
AND objtype in ('table', 'column')
70-
AND objname in ('t1', 't2', 't3');
76+
WHERE provider = 'selinux' AND objtype = 'table' AND objname in ('t1', 't2', 't3');
7177
objtype | objname | label
7278
---------+---------+-----------------------------------------------
7379
table | t1 | unconfined_u:object_r:sepgsql_table_t:s0
7480
table | t2 | unconfined_u:object_r:sepgsql_table_t:s0
7581
table | t3 | unconfined_u:object_r:user_sepgsql_table_t:s0
7682
(3 rows)
7783

84+
SELECT objtype, objname, label FROM pg_seclabels
85+
WHERE provider = 'selinux' AND objtype = 'column' AND (objname like 't3.%' OR objname like 't4.%');
86+
objtype | objname | label
87+
---------+-------------+-----------------------------------------------
88+
column | t3.t | unconfined_u:object_r:user_sepgsql_table_t:s0
89+
column | t3.s | unconfined_u:object_r:user_sepgsql_table_t:s0
90+
column | t3.ctid | unconfined_u:object_r:user_sepgsql_table_t:s0
91+
column | t3.xmin | unconfined_u:object_r:user_sepgsql_table_t:s0
92+
column | t3.cmin | unconfined_u:object_r:user_sepgsql_table_t:s0
93+
column | t3.xmax | unconfined_u:object_r:user_sepgsql_table_t:s0
94+
column | t3.cmax | unconfined_u:object_r:user_sepgsql_table_t:s0
95+
column | t3.tableoid | unconfined_u:object_r:user_sepgsql_table_t:s0
96+
column | t4.n | unconfined_u:object_r:sepgsql_table_t:s0
97+
column | t4.m | unconfined_u:object_r:sepgsql_table_t:s0
98+
column | t4.ctid | unconfined_u:object_r:sepgsql_sysobj_t:s0
99+
column | t4.xmin | unconfined_u:object_r:sepgsql_sysobj_t:s0
100+
column | t4.cmin | unconfined_u:object_r:sepgsql_sysobj_t:s0
101+
column | t4.xmax | unconfined_u:object_r:sepgsql_sysobj_t:s0
102+
column | t4.cmax | unconfined_u:object_r:sepgsql_sysobj_t:s0
103+
column | t4.tableoid | unconfined_u:object_r:sepgsql_sysobj_t:s0
104+
(16 rows)
105+
78106
--
79107
-- Tests for SECURITY LABEL
80108
--
@@ -456,6 +484,7 @@ SELECT sepgsql_getcon();-- confirm client privilege
456484
DROP TABLE IF EXISTS t1 CASCADE;
457485
DROP TABLE IF EXISTS t2 CASCADE;
458486
DROP TABLE IF EXISTS t3 CASCADE;
487+
DROP TABLE IF EXISTS t4 CASCADE;
459488
DROP FUNCTION IF EXISTS f1() CASCADE;
460489
DROP FUNCTION IF EXISTS f2() CASCADE;
461490
DROP FUNCTION IF EXISTS f3() CASCADE;

‎contrib/sepgsql/proc.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,8 @@ sepgsql_proc_post_create(Oid functionId)
9595
tcontext=sepgsql_get_label(NamespaceRelationId,
9696
proForm->pronamespace,0);
9797
ncontext=sepgsql_compute_create(scontext,tcontext,
98-
SEPG_CLASS_DB_PROCEDURE);
98+
SEPG_CLASS_DB_PROCEDURE,
99+
NameStr(proForm->proname));
99100

100101
/*
101102
* check db_procedure:{create (install)} permission

‎contrib/sepgsql/relation.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,8 @@ sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum)
8888
scontext=sepgsql_get_client_label();
8989
tcontext=sepgsql_get_label(RelationRelationId,relOid,0);
9090
ncontext=sepgsql_compute_create(scontext,tcontext,
91-
SEPG_CLASS_DB_COLUMN);
91+
SEPG_CLASS_DB_COLUMN,
92+
NameStr(attForm->attname));
9293

9394
/*
9495
* check db_column:{create} permission
@@ -309,7 +310,8 @@ sepgsql_relation_post_create(Oid relOid)
309310
scontext=sepgsql_get_client_label();
310311
tcontext=sepgsql_get_label(NamespaceRelationId,
311312
classForm->relnamespace,0);
312-
rcontext=sepgsql_compute_create(scontext,tcontext,tclass);
313+
rcontext=sepgsql_compute_create(scontext,tcontext,tclass,
314+
NameStr(classForm->relname));
313315

314316
/*
315317
* check db_xxx:{create} permission
@@ -363,7 +365,8 @@ sepgsql_relation_post_create(Oid relOid)
363365

364366
ccontext=sepgsql_compute_create(scontext,
365367
rcontext,
366-
SEPG_CLASS_DB_COLUMN);
368+
SEPG_CLASS_DB_COLUMN,
369+
NameStr(attForm->attname));
367370

368371
/*
369372
* check db_column:{create} permission

‎contrib/sepgsql/schema.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ sepgsql_schema_post_create(Oid namespaceId)
4242
char*tcontext;
4343
char*ncontext;
4444
charaudit_name[NAMEDATALEN+20];
45+
constchar*nsp_name;
4546
ObjectAddressobject;
4647
Form_pg_namespacenspForm;
4748

@@ -67,17 +68,21 @@ sepgsql_schema_post_create(Oid namespaceId)
6768
elog(ERROR,"catalog lookup failed for namespace %u",namespaceId);
6869

6970
nspForm= (Form_pg_namespace)GETSTRUCT(tuple);
71+
nsp_name=NameStr(nspForm->nspname);
72+
if (strncmp(nsp_name,"pg_temp_",8)==0)
73+
nsp_name="pg_temp";
74+
elseif (strncmp(nsp_name,"pg_toast_temp_",14)==0)
75+
nsp_name="pg_toast_temp";
7076

7177
tcontext=sepgsql_get_label(DatabaseRelationId,MyDatabaseId,0);
7278
ncontext=sepgsql_compute_create(sepgsql_get_client_label(),
7379
tcontext,
74-
SEPG_CLASS_DB_SCHEMA);
75-
80+
SEPG_CLASS_DB_SCHEMA,
81+
nsp_name);
7682
/*
7783
* check db_schema:{create}
7884
*/
79-
snprintf(audit_name,sizeof(audit_name),
80-
"schema %s",NameStr(nspForm->nspname));
85+
snprintf(audit_name,sizeof(audit_name),"schema %s",nsp_name);
8186
sepgsql_avc_check_perms_label(ncontext,
8287
SEPG_CLASS_DB_SCHEMA,
8388
SEPG_DB_SCHEMA__CREATE,

‎contrib/sepgsql/selinux.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -836,7 +836,8 @@ sepgsql_compute_avd(const char *scontext,
836836
char*
837837
sepgsql_compute_create(constchar*scontext,
838838
constchar*tcontext,
839-
uint16tclass)
839+
uint16tclass,
840+
constchar*objname)
840841
{
841842
security_context_tncontext;
842843
security_class_ttclass_ex;
@@ -853,9 +854,11 @@ sepgsql_compute_create(const char *scontext,
853854
* Ask SELinux what is the default context for the given object class on a
854855
* pair of security contexts
855856
*/
856-
if (security_compute_create_raw((security_context_t)scontext,
857-
(security_context_t)tcontext,
858-
tclass_ex,&ncontext)<0)
857+
if (security_compute_create_name_raw((security_context_t)scontext,
858+
(security_context_t)tcontext,
859+
tclass_ex,
860+
objname,
861+
&ncontext)<0)
859862
ereport(ERROR,
860863
(errcode(ERRCODE_INTERNAL_ERROR),
861864
errmsg("SELinux could not compute a new context: "

‎contrib/sepgsql/sepgsql-regtest.te

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
policy_module(sepgsql-regtest,1.04)
1+
policy_module(sepgsql-regtest,1.05)
22

33
gen_require(`
44
all_userspace_class_perms
@@ -43,6 +43,21 @@ allow sepgsql_regtest_dba_t sepgsql_regtest_user_t : process { dyntransition };
4343
allow sepgsql_regtest_dba_t sepgsql_regtest_foo_t : process { dyntransition };
4444
allow sepgsql_regtest_dba_t sepgsql_regtest_var_t : process { dyntransition };
4545

46+
# special rule for system columns
47+
optional_policy(`
48+
gen_require(`
49+
attributesepgsql_table_type;
50+
typesepgsql_sysobj_t;
51+
')
52+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "ctid";
53+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "oid";
54+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "xmin";
55+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "xmax";
56+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "cmin";
57+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "cmax";
58+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "tableoid";
59+
')
60+
4661
#
4762
# Dummy domain for unpriv users
4863
#

‎contrib/sepgsql/sepgsql.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,8 @@ extern void sepgsql_compute_avd(const char *scontext,
239239

240240
externchar*sepgsql_compute_create(constchar*scontext,
241241
constchar*tcontext,
242-
uint16tclass);
242+
uint16tclass,
243+
constchar*objname);
243244

244245
externboolsepgsql_check_perms(constchar*scontext,
245246
constchar*tcontext,

‎contrib/sepgsql/sql/label.sql

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,14 @@ SECURITY LABEL ON TABLE var_tbl
7171
CREATETABLEt3 (sint, ttext);
7272
INSERT INTO t3VALUES (1,'sss'), (2,'ttt'), (3,'uuu');
7373

74+
-- @SECURITY-CONTEXT=unconfined_u:unconfined_r:sepgsql_regtest_dba_t:s0
75+
CREATETABLEt4 (mint, ntext);
76+
INSERT INTO t4VALUES (1,'mmm'), (2,'nnn'), (3,'ooo');
77+
78+
SELECT objtype, objname, labelFROM pg_seclabels
79+
WHERE provider='selinux'AND objtype='table'AND objnamein ('t1','t2','t3');
7480
SELECT objtype, objname, labelFROM pg_seclabels
75-
WHERE provider='selinux'
76-
AND objtypein ('table','column')
77-
AND objnamein ('t1','t2','t3');
81+
WHERE provider='selinux'AND objtype='column'AND (objnamelike't3.%'OR objnamelike't4.%');
7882

7983
--
8084
-- Tests for SECURITY LABEL
@@ -229,6 +233,7 @@ SELECT sepgsql_getcon();
229233
DROPTABLE IF EXISTS t1 CASCADE;
230234
DROPTABLE IF EXISTS t2 CASCADE;
231235
DROPTABLE IF EXISTS t3 CASCADE;
236+
DROPTABLE IF EXISTS t4 CASCADE;
232237
DROPFUNCTION IF EXISTS f1() CASCADE;
233238
DROPFUNCTION IF EXISTS f2() CASCADE;
234239
DROPFUNCTION IF EXISTS f3() CASCADE;

‎contrib/sepgsql/uavc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,10 +250,10 @@ sepgsql_avc_compute(const char *scontext, const char *tcontext, uint16 tclass)
250250
{
251251
if (!ucontext)
252252
ncontext=sepgsql_compute_create(scontext,tcontext,
253-
SEPG_CLASS_PROCESS);
253+
SEPG_CLASS_PROCESS,NULL);
254254
else
255255
ncontext=sepgsql_compute_create(scontext,ucontext,
256-
SEPG_CLASS_PROCESS);
256+
SEPG_CLASS_PROCESS,NULL);
257257
if (strcmp(scontext,ncontext)==0)
258258
{
259259
pfree(ncontext);

‎doc/src/sgml/sepgsql.sgml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@
6363
<filename>sepgsql</> can only be used on <productname>Linux</productname>
6464
2.6.28 or higher with <productname>SELinux</productname> enabled.
6565
It is not available on any other platform. You will also need
66-
<productname>libselinux</> 2.0.99 or higher and
66+
<productname>libselinux</> 2.1.10 or higher and
6767
<productname>selinux-policy</> 3.9.13 or higher (although some
6868
distributions may backport the necessary rules into older policy
6969
versions).
@@ -326,8 +326,9 @@ $ sudo semodule -r sepgsql-regtest
326326
When <filename>sepgsql</filename> is in use, security labels are
327327
automatically assigned to supported database objects at creation time.
328328
This label is called a default security label, and is decided according
329-
to the system security policy, which takes as input the creator's label
330-
and the label assigned to the new object's parent object.
329+
to the system security policy, which takes as input the creator's label,
330+
the label assigned to the new object's parent object and optionally name
331+
of the constructed object.
331332
</para>
332333

333334
<para>

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp