Commit595a441

committed

Add missing check on invocation of trusted procedures.

KaiGai Kohei

1 parenta0e50e6 commit595a441Copy full SHA for 595a441

File tree

+57

-1

lines changed

+57

-1

lines changed

Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,11 @@ CREATE FUNCTION f3 () RETURNS text`
`22`	`22`	`END;' LANGUAGE plpgsql;`
`23`	`23`	`SECURITY LABEL ON FUNCTION f3()`
`24`	`24`	`IS 'system_u:object_r:sepgsql_trusted_proc_exec_t:s0';`
	`25`	`+CREATE FUNCTION f4 () RETURNS text`
	`26`	`+ AS 'SELECT sepgsql_getcon()'`
	`27`	`+ LANGUAGE sql;`
	`28`	`+SECURITY LABEL ON FUNCTION f4()`
	`29`	`+ IS 'system_u:object_r:sepgsql_regtest_trusted_proc_exec_t:s0';`
`25`	`30`	`--`
`26`	`31`	`-- Tests for default labeling behavior`
`27`	`32`	`--`
`@@ -86,6 +91,8 @@ SELECT f2();-- trusted procedure`
`86`	`91`
`87`	`92`	`SELECT f3();-- trusted procedure that raises an error`
`88`	`93`	`ERROR: an exception from f3()`
	`94`	`+SELECT f4();-- failed on domain transition`
	`95`	`+ERROR: SELinux: security policy violation`
`89`	`96`	`SELECT sepgsql_getcon();-- client's label must be restored`
`90`	`97`	`sepgsql_getcon`
`91`	`98`	`-----------------------------------------------------`
`@@ -107,3 +114,4 @@ DROP TABLE IF EXISTS t3 CASCADE;`
`107`	`114`	`DROP FUNCTION IF EXISTS f1() CASCADE;`
`108`	`115`	`DROP FUNCTION IF EXISTS f2() CASCADE;`
`109`	`116`	`DROP FUNCTION IF EXISTS f3() CASCADE;`
	`117`	`+DROP FUNCTION IF EXISTS f4() CASCADE;`

Lines changed: 14 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -251,6 +251,7 @@ sepgsql_fmgr_hook(FmgrHookEventType event,`
`251`	`251`	`if (!stack)`
`252`	`252`	`{`
`253`	`253`	`MemoryContextoldcxt;`
	`254`	`+constchar*cur_label=sepgsql_get_client_label();`
`254`	`255`
`255`	`256`	`oldcxt=MemoryContextSwitchTo(flinfo->fn_mcxt);`
`256`	`257`	`stack=palloc(sizeof(*stack));`
`@@ -260,6 +261,19 @@ sepgsql_fmgr_hook(FmgrHookEventType event,`
`260`	`261`
`261`	`262`	`MemoryContextSwitchTo(oldcxt);`
`262`	`263`
	`264`	`+if (strcmp(cur_label,stack->new_label)!=0)`
	`265`	`+{`
	`266`	`+/*`
	`267`	`+ * process:transition permission between old and new`
	`268`	`+ * label, when user tries to switch security label of`
	`269`	`+ * the client on execution of trusted procedure.`
	`270`	`+ */`
	`271`	`+sepgsql_check_perms(cur_label,stack->new_label,`
	`272`	`+SEPG_CLASS_PROCESS,`
	`273`	`+SEPG_PROCESS__TRANSITION,`
	`274`	`+NULL, true);`
	`275`	`+}`
	`276`	`+`
`263`	`277`	`*private=PointerGetDatum(stack);`
`264`	`278`	`}`
`265`	`279`	`Assert(!stack->old_label);`

Lines changed: 27 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,8 @@`
`1`		`-policy_module(sepgsql-regtest,1.01)`
	`1`	`+policy_module(sepgsql-regtest,1.02)`
	`2`	`+`
	`3`	+gen_require(`
	`4`	`+all_userspace_class_perms`
	`5`	`+')`
`2`	`6`
`3`	`7`	`## <desc>`
`4`	`8`	`## <p>`
`@@ -8,6 +12,12 @@ policy_module(sepgsql-regtest, 1.01)`
`8`	`12`	`## </desc>`
`9`	`13`	`gen_tunable(sepgsql_regression_test_mode,false)`
`10`	`14`
	`15`	`+#`
	`16`	`+# Type definitions for regression test`
	`17`	`+#`
	`18`	`+type sepgsql_regtest_trusted_proc_exec_t;`
	`19`	`+postgresql_procedure_object(sepgsql_regtest_trusted_proc_exec_t)`
	`20`	`+`
`11`	`21`	`#`
`12`	`22`	`# Test domains for database administrators`
`13`	`23`	`#`
@@ -57,3 +67,19 @@ optional_policy(`
`57`	`67`	`role unconfined_rtypes sepgsql_regtest_user_t;`
`58`	`68`	`role unconfined_rtypes sepgsql_trusted_proc_t;`
`59`	`69`	`')`
	`70`	`+`
	`71`	`+#`
	`72`	`+# Rule to check`
	`73`	`+#`
	`74`	+optional_policy(`
	`75`	`+# These rules intends sepgsql_regtest_user_t domain to translate`
	`76`	`+# sepgsql_regtest_dba_t on execution of procedures labeled as`
	`77`	`+# sepgsql_regtest_trusted_proc_exec_t, but does not allow transition`
	`78`	`+# permission from sepgsql_regtest_user_t to sepgsql_regtest_dba_t.`
	`79`	`+#`
	`80`	+gen_require(`
	`81`	`+attribute sepgsql_client_type;`
	`82`	`+')`
	`83`	`+allow sepgsql_client_type sepgsql_regtest_trusted_proc_exec_t:db_procedure { getattr execute install };`
	`84`	`+type_transition sepgsql_regtest_user_t sepgsql_regtest_trusted_proc_exec_t:process sepgsql_regtest_dba_t;`
	`85`	`+')`

Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,12 @@ CREATE FUNCTION f3 () RETURNS text`
`27`	`27`	`SECURITY LABELON FUNCTION f3()`
`28`	`28`	`IS'system_u:object_r:sepgsql_trusted_proc_exec_t:s0';`
`29`	`29`
	`30`	`+CREATEFUNCTIONf4 () RETURNStext`
	`31`	`+AS'SELECT sepgsql_getcon()'`
	`32`	`+ LANGUAGE sql;`
	`33`	`+SECURITY LABELON FUNCTION f4()`
	`34`	`+ IS'system_u:object_r:sepgsql_regtest_trusted_proc_exec_t:s0';`
	`35`	`+`
`30`	`36`	`--`
`31`	`37`	`-- Tests for default labeling behavior`
`32`	`38`	`--`
`@@ -59,6 +65,7 @@ SECURITY LABEL ON COLUMN t2.b`
`59`	`65`	`SELECT f1();-- normal procedure`
`60`	`66`	`SELECT f2();-- trusted procedure`
`61`	`67`	`SELECT f3();-- trusted procedure that raises an error`
	`68`	`+SELECT f4();-- failed on domain transition`
`62`	`69`	`SELECT sepgsql_getcon();-- client's label must be restored`
`63`	`70`
`64`	`71`	`--`
`@@ -71,3 +78,4 @@ DROP TABLE IF EXISTS t3 CASCADE;`
`71`	`78`	`DROPFUNCTION IF EXISTS f1() CASCADE;`
`72`	`79`	`DROPFUNCTION IF EXISTS f2() CASCADE;`
`73`	`80`	`DROPFUNCTION IF EXISTS f3() CASCADE;`
	`81`	`+DROPFUNCTION IF EXISTS f4() CASCADE;`

Comments

(0)