Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 0f05840

Browse files
robertmhaasrobertmhaas
committed
Allow sepgsql labels to depend on object name.
The main change here is to call security_compute_create_name_raw() rather than security_compute_create_raw(). This ups the minimum requirement for libselinux from 2.0.99 to 2.1.10, but it looks like most distributions will have picked that up before 9.3 is out. KaiGai Kohei
1 parent ae7f1c3 commit 0f05840

File tree

13 files changed

+104
-40
lines changed

13 files changed

+104
-40
lines changed

‎configure

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9710,9 +9710,9 @@ fi
97109710
# for contrib/sepgsql
97119711
if test "$with_selinux" = yes; then
97129712

9713-
{ $as_echo "$as_me:$LINENO: checking for selinux_status_open in -lselinux" >&5
9714-
$as_echo_n "checking for selinux_status_open in -lselinux... " >&6; }
9715-
if test "${ac_cv_lib_selinux_selinux_status_open+set}" = set; then
9713+
{ $as_echo "$as_me:$LINENO: checking for security_compute_create_name in -lselinux" >&5
9714+
$as_echo_n "checking for security_compute_create_name in -lselinux... " >&6; }
9715+
if test "${ac_cv_lib_selinux_security_compute_create_name+set}" = set; then
97169716
$as_echo_n "(cached) " >&6
97179717
else
97189718
ac_check_lib_save_LIBS=$LIBS
@@ -9730,11 +9730,11 @@ cat >>conftest.$ac_ext <<_ACEOF
97309730
#ifdef __cplusplus
97319731
extern "C"
97329732
#endif
9733-
char selinux_status_open ();
9733+
char security_compute_create_name ();
97349734
int
97359735
main ()
97369736
{
9737-
return selinux_status_open ();
9737+
return security_compute_create_name ();
97389738
;
97399739
return 0;
97409740
}
@@ -9760,31 +9760,31 @@ $as_echo "$ac_try_echo") >&5
97609760
test "$cross_compiling" = yes ||
97619761
$as_test_x conftest$ac_exeext
97629762
}; then
9763-
ac_cv_lib_selinux_selinux_status_open=yes
9763+
ac_cv_lib_selinux_security_compute_create_name=yes
97649764
else
97659765
$as_echo "$as_me: failed program was:" >&5
97669766
sed 's/^/| /' conftest.$ac_ext >&5
97679767

9768-
ac_cv_lib_selinux_selinux_status_open=no
9768+
ac_cv_lib_selinux_security_compute_create_name=no
97699769
fi
97709770

97719771
rm -rf conftest.dSYM
97729772
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
97739773
conftest$ac_exeext conftest.$ac_ext
97749774
LIBS=$ac_check_lib_save_LIBS
97759775
fi
9776-
{ $as_echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_selinux_status_open" >&5
9777-
$as_echo "$ac_cv_lib_selinux_selinux_status_open" >&6; }
9778-
if test "x$ac_cv_lib_selinux_selinux_status_open" = x""yes; then
9776+
{ $as_echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_security_compute_create_name" >&5
9777+
$as_echo "$ac_cv_lib_selinux_security_compute_create_name" >&6; }
9778+
if test "x$ac_cv_lib_selinux_security_compute_create_name" = x""yes; then
97799779
cat >>confdefs.h <<_ACEOF
97809780
#define HAVE_LIBSELINUX 1
97819781
_ACEOF
97829782

97839783
LIBS="-lselinux $LIBS"
97849784

97859785
else
9786-
{ { $as_echo "$as_me:$LINENO: error: library 'libselinux', version 2.0.99 or newer, is required for SELinux support" >&5
9787-
$as_echo "$as_me: error: library 'libselinux', version 2.0.99 or newer, is required for SELinux support" >&2;}
9786+
{ { $as_echo "$as_me:$LINENO: error: library 'libselinux', version 2.1.10 or newer, is required for SELinux support" >&5
9787+
$as_echo "$as_me: error: library 'libselinux', version 2.1.10 or newer, is required for SELinux support" >&2;}
97889788
{ (exit 1); exit 1; }; }
97899789
fi
97909790

‎configure.in

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -952,8 +952,8 @@ fi
952952

953953
# for contrib/sepgsql
954954
if test "$with_selinux" = yes; then
955-
AC_CHECK_LIB(selinux, selinux_status_open, [],
956-
[AC_MSG_ERROR([library 'libselinux', version 2.0.99 or newer, is required for SELinux support])])
955+
AC_CHECK_LIB(selinux, security_compute_create_name, [],
956+
[AC_MSG_ERROR([library 'libselinux', version 2.1.10 or newer, is required for SELinux support])])
957957
fi
958958

959959
# for contrib/uuid-ossp

‎contrib/sepgsql/database.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,8 @@ sepgsql_database_post_create(Oid databaseId, const char *dtemplate)
9292

9393
ncontext = sepgsql_compute_create(sepgsql_get_client_label(),
9494
tcontext,
95-
SEPG_CLASS_DB_DATABASE);
95+
SEPG_CLASS_DB_DATABASE,
96+
NameStr(datForm->datname));
9697

9798
/*
9899
* check db_database:{create} permission

‎contrib/sepgsql/expected/label.out

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,45 @@ SELECT sepgsql_getcon(); -- confirm client privilege
6464

6565
CREATE TABLE t3 (s int, t text);
6666
INSERT INTO t3 VALUES (1, 'sss'), (2, 'ttt'), (3, 'uuu');
67+
SELECT sepgsql_getcon(); -- confirm client privilege
68+
sepgsql_getcon
69+
----------------------------------------------------
70+
unconfined_u:unconfined_r:sepgsql_regtest_dba_t:s0
71+
(1 row)
72+
73+
CREATE TABLE t4 (m int, n text);
74+
INSERT INTO t4 VALUES (1,'mmm'), (2,'nnn'), (3,'ooo');
6775
SELECT objtype, objname, label FROM pg_seclabels
68-
WHERE provider = 'selinux'
69-
AND objtype in ('table', 'column')
70-
AND objname in ('t1', 't2', 't3');
76+
WHERE provider = 'selinux' AND objtype = 'table' AND objname in ('t1', 't2', 't3');
7177
objtype | objname | label
7278
---------+---------+-----------------------------------------------
7379
table | t1 | unconfined_u:object_r:sepgsql_table_t:s0
7480
table | t2 | unconfined_u:object_r:sepgsql_table_t:s0
7581
table | t3 | unconfined_u:object_r:user_sepgsql_table_t:s0
7682
(3 rows)
7783

84+
SELECT objtype, objname, label FROM pg_seclabels
85+
WHERE provider = 'selinux' AND objtype = 'column' AND (objname like 't3.%' OR objname like 't4.%');
86+
objtype | objname | label
87+
---------+-------------+-----------------------------------------------
88+
column | t3.t | unconfined_u:object_r:user_sepgsql_table_t:s0
89+
column | t3.s | unconfined_u:object_r:user_sepgsql_table_t:s0
90+
column | t3.ctid | unconfined_u:object_r:user_sepgsql_table_t:s0
91+
column | t3.xmin | unconfined_u:object_r:user_sepgsql_table_t:s0
92+
column | t3.cmin | unconfined_u:object_r:user_sepgsql_table_t:s0
93+
column | t3.xmax | unconfined_u:object_r:user_sepgsql_table_t:s0
94+
column | t3.cmax | unconfined_u:object_r:user_sepgsql_table_t:s0
95+
column | t3.tableoid | unconfined_u:object_r:user_sepgsql_table_t:s0
96+
column | t4.n | unconfined_u:object_r:sepgsql_table_t:s0
97+
column | t4.m | unconfined_u:object_r:sepgsql_table_t:s0
98+
column | t4.ctid | unconfined_u:object_r:sepgsql_sysobj_t:s0
99+
column | t4.xmin | unconfined_u:object_r:sepgsql_sysobj_t:s0
100+
column | t4.cmin | unconfined_u:object_r:sepgsql_sysobj_t:s0
101+
column | t4.xmax | unconfined_u:object_r:sepgsql_sysobj_t:s0
102+
column | t4.cmax | unconfined_u:object_r:sepgsql_sysobj_t:s0
103+
column | t4.tableoid | unconfined_u:object_r:sepgsql_sysobj_t:s0
104+
(16 rows)
105+
78106
--
79107
-- Tests for SECURITY LABEL
80108
--
@@ -456,6 +484,7 @@ SELECT sepgsql_getcon(); -- confirm client privilege
456484
DROP TABLE IF EXISTS t1 CASCADE;
457485
DROP TABLE IF EXISTS t2 CASCADE;
458486
DROP TABLE IF EXISTS t3 CASCADE;
487+
DROP TABLE IF EXISTS t4 CASCADE;
459488
DROP FUNCTION IF EXISTS f1() CASCADE;
460489
DROP FUNCTION IF EXISTS f2() CASCADE;
461490
DROP FUNCTION IF EXISTS f3() CASCADE;

‎contrib/sepgsql/proc.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,8 @@ sepgsql_proc_post_create(Oid functionId)
9595
tcontext = sepgsql_get_label(NamespaceRelationId,
9696
proForm->pronamespace, 0);
9797
ncontext = sepgsql_compute_create(scontext, tcontext,
98-
SEPG_CLASS_DB_PROCEDURE);
98+
SEPG_CLASS_DB_PROCEDURE,
99+
NameStr(proForm->proname));
99100

100101
/*
101102
* check db_procedure:{create (install)} permission

‎contrib/sepgsql/relation.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,8 @@ sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum)
8888
scontext = sepgsql_get_client_label();
8989
tcontext = sepgsql_get_label(RelationRelationId, relOid, 0);
9090
ncontext = sepgsql_compute_create(scontext, tcontext,
91-
SEPG_CLASS_DB_COLUMN);
91+
SEPG_CLASS_DB_COLUMN,
92+
NameStr(attForm->attname));
9293

9394
/*
9495
* check db_column:{create} permission
@@ -309,7 +310,8 @@ sepgsql_relation_post_create(Oid relOid)
309310
scontext = sepgsql_get_client_label();
310311
tcontext = sepgsql_get_label(NamespaceRelationId,
311312
classForm->relnamespace, 0);
312-
rcontext = sepgsql_compute_create(scontext, tcontext, tclass);
313+
rcontext = sepgsql_compute_create(scontext, tcontext, tclass,
314+
NameStr(classForm->relname));
313315

314316
/*
315317
* check db_xxx:{create} permission
@@ -363,7 +365,8 @@ sepgsql_relation_post_create(Oid relOid)
363365

364366
ccontext = sepgsql_compute_create(scontext,
365367
rcontext,
366-
SEPG_CLASS_DB_COLUMN);
368+
SEPG_CLASS_DB_COLUMN,
369+
NameStr(attForm->attname));
367370

368371
/*
369372
* check db_column:{create} permission

‎contrib/sepgsql/schema.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ sepgsql_schema_post_create(Oid namespaceId)
4242
char *tcontext;
4343
char *ncontext;
4444
char audit_name[NAMEDATALEN + 20];
45+
const char *nsp_name;
4546
ObjectAddress object;
4647
Form_pg_namespace nspForm;
4748

@@ -67,17 +68,21 @@ sepgsql_schema_post_create(Oid namespaceId)
6768
elog(ERROR, "catalog lookup failed for namespace %u", namespaceId);
6869

6970
nspForm = (Form_pg_namespace) GETSTRUCT(tuple);
71+
nsp_name = NameStr(nspForm->nspname);
72+
if (strncmp(nsp_name, "pg_temp_", 8) == 0)
73+
nsp_name = "pg_temp";
74+
else if (strncmp(nsp_name, "pg_toast_temp_", 14) == 0)
75+
nsp_name = "pg_toast_temp";
7076

7177
tcontext = sepgsql_get_label(DatabaseRelationId, MyDatabaseId, 0);
7278
ncontext = sepgsql_compute_create(sepgsql_get_client_label(),
7379
tcontext,
74-
SEPG_CLASS_DB_SCHEMA);
75-
80+
SEPG_CLASS_DB_SCHEMA,
81+
nsp_name);
7682
/*
7783
* check db_schema:{create}
7884
*/
79-
snprintf(audit_name, sizeof(audit_name),
80-
"schema %s", NameStr(nspForm->nspname));
85+
snprintf(audit_name, sizeof(audit_name), "schema %s", nsp_name);
8186
sepgsql_avc_check_perms_label(ncontext,
8287
SEPG_CLASS_DB_SCHEMA,
8388
SEPG_DB_SCHEMA__CREATE,

‎contrib/sepgsql/selinux.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -836,7 +836,8 @@ sepgsql_compute_avd(const char *scontext,
836836
char *
837837
sepgsql_compute_create(const char *scontext,
838838
const char *tcontext,
839-
uint16 tclass)
839+
uint16 tclass,
840+
const char *objname)
840841
{
841842
security_context_t ncontext;
842843
security_class_t tclass_ex;
@@ -853,9 +854,11 @@ sepgsql_compute_create(const char *scontext,
853854
* Ask SELinux what is the default context for the given object class on a
854855
* pair of security contexts
855856
*/
856-
if (security_compute_create_raw((security_context_t) scontext,
857-
(security_context_t) tcontext,
858-
tclass_ex, &ncontext) < 0)
857+
if (security_compute_create_name_raw((security_context_t) scontext,
858+
(security_context_t) tcontext,
859+
tclass_ex,
860+
objname,
861+
&ncontext) < 0)
859862
ereport(ERROR,
860863
(errcode(ERRCODE_INTERNAL_ERROR),
861864
errmsg("SELinux could not compute a new context: "

‎contrib/sepgsql/sepgsql-regtest.te

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
policy_module(sepgsql-regtest, 1.04)
1+
policy_module(sepgsql-regtest, 1.05)
22

33
gen_require(`
44
all_userspace_class_perms
@@ -43,6 +43,21 @@ allow sepgsql_regtest_dba_t sepgsql_regtest_user_t : process { dyntransition };
4343
allow sepgsql_regtest_dba_t sepgsql_regtest_foo_t : process { dyntransition };
4444
allow sepgsql_regtest_dba_t sepgsql_regtest_var_t : process { dyntransition };
4545

46+
# special rule for system columns
47+
optional_policy(`
48+
gen_require(`
49+
attribute sepgsql_table_type;
50+
type sepgsql_sysobj_t;
51+
')
52+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "ctid";
53+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "oid";
54+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "xmin";
55+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "xmax";
56+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "cmin";
57+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "cmax";
58+
type_transition sepgsql_regtest_dba_t sepgsql_table_type:db_column sepgsql_sysobj_t "tableoid";
59+
')
60+
4661
#
4762
# Dummy domain for unpriv users
4863
#

‎contrib/sepgsql/sepgsql.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,8 @@ extern void sepgsql_compute_avd(const char *scontext,
239239

240240
extern char *sepgsql_compute_create(const char *scontext,
241241
const char *tcontext,
242-
uint16 tclass);
242+
uint16 tclass,
243+
const char *objname);
243244

244245
extern bool sepgsql_check_perms(const char *scontext,
245246
const char *tcontext,

‎contrib/sepgsql/sql/label.sql

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,14 @@ SECURITY LABEL ON TABLE var_tbl
7171
CREATE TABLE t3 (s int, t text);
7272
INSERT INTO t3 VALUES (1, 'sss'), (2, 'ttt'), (3, 'uuu');
7373

74+
-- @SECURITY-CONTEXT=unconfined_u:unconfined_r:sepgsql_regtest_dba_t:s0
75+
CREATE TABLE t4 (m int, n text);
76+
INSERT INTO t4 VALUES (1,'mmm'), (2,'nnn'), (3,'ooo');
77+
78+
SELECT objtype, objname, label FROM pg_seclabels
79+
WHERE provider = 'selinux' AND objtype = 'table' AND objname in ('t1', 't2', 't3');
7480
SELECT objtype, objname, label FROM pg_seclabels
75-
WHERE provider = 'selinux'
76-
AND objtype in ('table', 'column')
77-
AND objname in ('t1', 't2', 't3');
81+
WHERE provider = 'selinux' AND objtype = 'column' AND (objname like 't3.%' OR objname like 't4.%');
7882

7983
--
8084
-- Tests for SECURITY LABEL
@@ -229,6 +233,7 @@ SELECT sepgsql_getcon();
229233
DROP TABLE IF EXISTS t1 CASCADE;
230234
DROP TABLE IF EXISTS t2 CASCADE;
231235
DROP TABLE IF EXISTS t3 CASCADE;
236+
DROP TABLE IF EXISTS t4 CASCADE;
232237
DROP FUNCTION IF EXISTS f1() CASCADE;
233238
DROP FUNCTION IF EXISTS f2() CASCADE;
234239
DROP FUNCTION IF EXISTS f3() CASCADE;

‎contrib/sepgsql/uavc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,10 +250,10 @@ sepgsql_avc_compute(const char *scontext, const char *tcontext, uint16 tclass)
250250
{
251251
if (!ucontext)
252252
ncontext = sepgsql_compute_create(scontext, tcontext,
253-
SEPG_CLASS_PROCESS);
253+
SEPG_CLASS_PROCESS, NULL);
254254
else
255255
ncontext = sepgsql_compute_create(scontext, ucontext,
256-
SEPG_CLASS_PROCESS);
256+
SEPG_CLASS_PROCESS, NULL);
257257
if (strcmp(scontext, ncontext) == 0)
258258
{
259259
pfree(ncontext);

‎doc/src/sgml/sepgsql.sgml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@
6363
<filename>sepgsql</> can only be used on <productname>Linux</productname>
6464
2.6.28 or higher with <productname>SELinux</productname> enabled.
6565
It is not available on any other platform. You will also need
66-
<productname>libselinux</> 2.0.99 or higher and
66+
<productname>libselinux</> 2.1.10 or higher and
6767
<productname>selinux-policy</> 3.9.13 or higher (although some
6868
distributions may backport the necessary rules into older policy
6969
versions).
@@ -326,8 +326,9 @@ $ sudo semodule -r sepgsql-regtest
326326
When <filename>sepgsql</filename> is in use, security labels are
327327
automatically assigned to supported database objects at creation time.
328328
This label is called a default security label, and is decided according
329-
to the system security policy, which takes as input the creator's label
330-
and the label assigned to the new object's parent object.
329+
to the system security policy, which takes as input the creator's label,
330+
the label assigned to the new object's parent object and optionally name
331+
of the constructed object.
331332
</para>
332333

333334
<para>

0 commit comments

Comments
 (0)