Skip to content

Commit 291873c

Browse files
robertmhaasrobertmhaas
committed
Teach sepgsql about database labels.
This is still a bit of a hack, but it's better than the old way, for sure. KaiGai Kohei, with one change by me to make it compile
1 parent a5e94ea commit 291873c

File tree

6 files changed

+128
-13
lines changed

6 files changed

+128
-13
lines changed

‎contrib/sepgsql/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
MODULE_big = sepgsql
44
OBJS = hooks.o selinux.o uavc.o label.o dml.o \
5-
schema.o relation.o proc.o
5+
database.o schema.o relation.o proc.o
66
DATA_built = sepgsql.sql
77

88
REGRESS = label dml misc

‎contrib/sepgsql/database.c‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/* -------------------------------------------------------------------------
2+
*
3+
* contrib/sepgsql/database.c
4+
*
5+
* Routines corresponding to database objects
6+
*
7+
* Copyright (c) 2010-2011, PostgreSQL Global Development Group
8+
*
9+
* -------------------------------------------------------------------------
10+
*/
11+
#include "postgres.h"
12+
13+
#include "catalog/dependency.h"
14+
#include "catalog/pg_database.h"
15+
#include "commands/seclabel.h"
16+
#include "sepgsql.h"
17+
18+
void
19+
sepgsql_database_post_create(Oid databaseId)
20+
{
21+
char *scontext = sepgsql_get_client_label();
22+
char *tcontext;
23+
char *ncontext;
24+
ObjectAddress object;
25+
26+
/*
27+
* Compute a default security label of the newly created database
28+
* based on a pair of security label of client and source database.
29+
*
30+
* XXX - Right now, this logic uses "template1" as its source, because
31+
* here is no way to know the Oid of source database.
32+
*/
33+
object.classId = DatabaseRelationId;
34+
object.objectId = TemplateDbOid;
35+
object.objectSubId = 0;
36+
tcontext = GetSecurityLabel(&object, SEPGSQL_LABEL_TAG);
37+
38+
ncontext = sepgsql_compute_create(scontext, tcontext,
39+
SEPG_CLASS_DB_DATABASE);
40+
41+
/*
42+
* Assign the default security label on the new database
43+
*/
44+
object.classId = DatabaseRelationId;
45+
object.objectId = databaseId;
46+
object.objectSubId = 0;
47+
48+
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
49+
50+
pfree(ncontext);
51+
pfree(tcontext);
52+
}
53+
54+
/*
55+
* sepgsql_database_relabel
56+
*
57+
* It checks privileges to relabel the supplied database with the `seclabel'
58+
*/
59+
void
60+
sepgsql_database_relabel(Oid databaseId, const char *seclabel)
61+
{
62+
ObjectAddress object;
63+
char *audit_name;
64+
65+
object.classId = DatabaseRelationId;
66+
object.objectId = databaseId;
67+
object.objectSubId = 0;
68+
audit_name = getObjectDescription(&object);
69+
70+
/*
71+
* check db_database:{setattr relabelfrom} permission
72+
*/
73+
sepgsql_avc_check_perms(&object,
74+
SEPG_CLASS_DB_DATABASE,
75+
SEPG_DB_DATABASE__SETATTR |
76+
SEPG_DB_DATABASE__RELABELFROM,
77+
audit_name,
78+
true);
79+
/*
80+
* check db_database:{relabelto} permission
81+
*/
82+
sepgsql_avc_check_perms_label(seclabel,
83+
SEPG_CLASS_DB_DATABASE,
84+
SEPG_DB_DATABASE__RELABELTO,
85+
audit_name,
86+
true);
87+
pfree(audit_name);
88+
}

‎contrib/sepgsql/hooks.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
#include "catalog/objectaccess.h"
1414
#include "catalog/pg_class.h"
15+
#include "catalog/pg_database.h"
1516
#include "catalog/pg_namespace.h"
1617
#include "catalog/pg_proc.h"
1718
#include "commands/seclabel.h"
@@ -125,6 +126,10 @@ sepgsql_object_access(ObjectAccessType access,
125126
case OAT_POST_CREATE:
126127
switch (classId)
127128
{
129+
case DatabaseRelationId:
130+
sepgsql_database_post_create(objectId);
131+
break;
132+
128133
case NamespaceRelationId:
129134
sepgsql_schema_post_create(objectId);
130135
break;

‎contrib/sepgsql/label.c‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
#include "catalog/indexing.h"
1818
#include "catalog/pg_attribute.h"
1919
#include "catalog/pg_class.h"
20+
#include "catalog/pg_database.h"
2021
#include "catalog/pg_namespace.h"
2122
#include "catalog/pg_proc.h"
2223
#include "commands/dbcommands.h"
@@ -121,9 +122,14 @@ sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
121122
*/
122123
switch (object->classId)
123124
{
125+
case DatabaseRelationId:
126+
sepgsql_database_relabel(object->objectId, seclabel);
127+
break;
128+
124129
case NamespaceRelationId:
125130
sepgsql_schema_relabel(object->objectId, seclabel);
126131
break;
132+
127133
case RelationRelationId:
128134
if (object->objectSubId == 0)
129135
sepgsql_relation_relabel(object->objectId,
@@ -133,6 +139,7 @@ sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
133139
object->objectSubId,
134140
seclabel);
135141
break;
142+
136143
case ProcedureRelationId:
137144
sepgsql_proc_relabel(object->objectId, seclabel);
138145
break;
@@ -315,6 +322,7 @@ exec_object_restorecon(struct selabel_handle * sehnd, Oid catalogId)
315322
SnapshotNow, 0, NULL);
316323
while (HeapTupleIsValid(tuple = systable_getnext(sscan)))
317324
{
325+
Form_pg_database datForm;
318326
Form_pg_namespace nspForm;
319327
Form_pg_class relForm;
320328
Form_pg_attribute attForm;
@@ -330,6 +338,19 @@ exec_object_restorecon(struct selabel_handle * sehnd, Oid catalogId)
330338
*/
331339
switch (catalogId)
332340
{
341+
case DatabaseRelationId:
342+
datForm = (Form_pg_database) GETSTRUCT(tuple);
343+
344+
objtype = SELABEL_DB_DATABASE;
345+
346+
objname = quote_object_name(NameStr(datForm->datname),
347+
NULL, NULL, NULL);
348+
349+
object.classId = DatabaseRelationId;
350+
object.objectId = HeapTupleGetOid(tuple);
351+
object.objectSubId = 0;
352+
break;
353+
333354
case NamespaceRelationId:
334355
nspForm = (Form_pg_namespace) GETSTRUCT(tuple);
335356

@@ -506,10 +527,7 @@ sepgsql_restorecon(PG_FUNCTION_ARGS)
506527
errmsg("SELinux: failed to initialize labeling handle: %m")));
507528
PG_TRY();
508529
{
509-
/*
510-
* Right now, we have no support labeling on the shared database
511-
* objects, such as database, role, or tablespace.
512-
*/
530+
exec_object_restorecon(sehnd, DatabaseRelationId);
513531
exec_object_restorecon(sehnd, NamespaceRelationId);
514532
exec_object_restorecon(sehnd, RelationRelationId);
515533
exec_object_restorecon(sehnd, AttributeRelationId);

‎contrib/sepgsql/schema.c‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111
#include "postgres.h"
1212

1313
#include "catalog/dependency.h"
14+
#include "catalog/pg_database.h"
1415
#include "catalog/pg_namespace.h"
1516
#include "commands/seclabel.h"
17+
#include "miscadmin.h"
1618
#include "utils/lsyscache.h"
1719

1820
#include "sepgsql.h"
@@ -26,22 +28,17 @@
2628
void
2729
sepgsql_schema_post_create(Oid namespaceId)
2830
{
29-
char *scontext = sepgsql_get_client_label();
31+
char *scontext;
3032
char *tcontext;
3133
char *ncontext;
3234
ObjectAddress object;
3335

34-
/*
35-
* FIXME: Right now, we assume pg_database object has a fixed security
36-
* label, because pg_seclabel does not support to store label of shared
37-
* database objects.
38-
*/
39-
tcontext = "system_u:object_r:sepgsql_db_t:s0";
40-
4136
/*
4237
* Compute a default security label when we create a new schema object
4338
* under the working database.
4439
*/
40+
scontext = sepgsql_get_client_label();
41+
tcontext = sepgsql_get_label(DatabaseRelationId, MyDatabaseId, 0);
4542
ncontext = sepgsql_compute_create(scontext, tcontext,
4643
SEPG_CLASS_DB_SCHEMA);
4744

@@ -54,6 +51,7 @@ sepgsql_schema_post_create(Oid namespaceId)
5451
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
5552

5653
pfree(ncontext);
54+
pfree(tcontext);
5755
}
5856

5957
/*

‎contrib/sepgsql/sepgsql.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,12 @@ extern Datum sepgsql_restorecon(PG_FUNCTION_ARGS);
283283
*/
284284
extern bool sepgsql_dml_privileges(List *rangeTabls, bool abort);
285285

286+
/*
287+
* database.c
288+
*/
289+
extern void sepgsql_database_post_create(Oid databaseId);
290+
extern void sepgsql_database_relabel(Oid databaseId, const char *seclabel);
291+
286292
/*
287293
* schema.c
288294
*/

0 commit comments

Comments
 (0)