diff --git a/.cvsignore b/.cvsignore index f5b0107..19279bd 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -postgresql-8.4.0.tar.bz2 +postgresql-8.4.1.tar.bz2 diff --git a/sepostgresql-8.4.patch b/sepostgresql-8.4.patch index 2e7ff11..4e35401 100644 --- a/sepostgresql-8.4.patch +++ b/sepostgresql-8.4.patch @@ -1,6 +1,6 @@ diff -Nrpc base/configure sepgsql/configure -*** base/configure Tue Jun 30 01:26:47 2009 ---- sepgsql/configure Wed Jul 15 21:17:18 2009 +*** base/configure Sun Sep 6 19:40:49 2009 +--- sepgsql/configure Sun Sep 6 19:53:10 2009 *************** with_libxml *** 710,715 **** --- 710,716 ---- @@ -189,8 +189,8 @@ diff -Nrpc base/configure sepgsql/configure elif $ac_last_try; then { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 diff -Nrpc base/configure.in sepgsql/configure.in -*** base/configure.in Tue Jun 30 01:26:47 2009 ---- sepgsql/configure.in Wed Jul 15 19:35:52 2009 +*** base/configure.in Sun Sep 6 19:40:49 2009 +--- sepgsql/configure.in Sun Sep 6 19:53:10 2009 *************** PGAC_ARG_BOOL(with, zlib, yes, *** 764,769 **** --- 764,782 ---- @@ -262,7 +262,7 @@ diff -Nrpc base/src/backend/Makefile sepgsql/src/backend/Makefile all: submake-libpgport postgres $(POSTGRES_IMP) diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access/common/heaptuple.c *** base/src/backend/access/common/heaptuple.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/access/common/heaptuple.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/access/common/heaptuple.c Thu Sep 10 15:18:03 2009 *************** *** 60,65 **** --- 60,66 ---- @@ -279,7 +279,7 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access case MinCommandIdAttributeNumber: case MaxTransactionIdAttributeNumber: case MaxCommandIdAttributeNumber: -+ case SecurityLabelAttributeNumber: ++ case SecurityAttributeNumber: /* these are never null */ break; @@ -289,8 +289,8 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access case TableOidAttributeNumber: result = ObjectIdGetDatum(tup->t_tableOid); break; -+ case SecurityLabelAttributeNumber: -+ result = securityHeapGetSecLabelSysattr(tup); ++ case SecurityAttributeNumber: ++ result = securitySysattSecLabelOut(tup->t_tableOid, tup); + break; default: elog(ERROR, "invalid attnum: %d", attnum); @@ -301,7 +301,7 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access if (tupleDescriptor->tdhasoid) len += sizeof(Oid); -+ if (tupleDescriptor->tdhasseclabel) ++ if (tupleDescriptor->tdhassecid) + len += sizeof(Oid); hoff = len = MAXALIGN(len); /* align user data safely */ @@ -312,8 +312,8 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access if (tupleDescriptor->tdhasoid) /* else leave infomask = 0 */ td->t_infomask = HEAP_HASOID; -+ if (tupleDescriptor->tdhasseclabel) -+ td->t_infomask |= HEAP_HAS_SECLABEL; ++ if (tupleDescriptor->tdhassecid) ++ td->t_infomask |= HEAP_HASSECID; heap_fill_tuple(tupleDescriptor, values, @@ -323,8 +323,8 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access newTuple->t_tableOid = tuple->t_tableOid; if (tupleDesc->tdhasoid) HeapTupleSetOid(newTuple, HeapTupleGetOid(tuple)); -+ if (HeapTupleHasSecLabel(newTuple)) -+ HeapTupleSetSecLabel(newTuple, HeapTupleGetSecLabel(tuple)); ++ if (HeapTupleHasSecid(newTuple)) ++ HeapTupleSetSecid(newTuple, HeapTupleGetSecid(tuple)); return newTuple; } @@ -334,7 +334,7 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access if (tupleDescriptor->tdhasoid) len += sizeof(Oid); -+ if (tupleDescriptor->tdhasseclabel) ++ if (tupleDescriptor->tdhassecid) + len += sizeof(Oid); hoff = len = MAXALIGN(len); /* align user data safely */ @@ -345,21 +345,21 @@ diff -Nrpc base/src/backend/access/common/heaptuple.c sepgsql/src/backend/access if (tupleDescriptor->tdhasoid) /* else leave infomask = 0 */ tuple->t_infomask = HEAP_HASOID; -+ if (tupleDescriptor->tdhasseclabel) -+ tuple->t_infomask |= HEAP_HAS_SECLABEL; ++ if (tupleDescriptor->tdhassecid) ++ tuple->t_infomask |= HEAP_HASSECID; heap_fill_tuple(tupleDescriptor, values, diff -Nrpc base/src/backend/access/common/tupdesc.c sepgsql/src/backend/access/common/tupdesc.c *** base/src/backend/access/common/tupdesc.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/access/common/tupdesc.c Wed Jul 15 19:30:50 2009 +--- sepgsql/src/backend/access/common/tupdesc.c Wed Sep 9 13:14:37 2009 *************** CreateTemplateTupleDesc(int natts, bool *** 88,93 **** --- 88,94 ---- desc->tdtypeid = RECORDOID; desc->tdtypmod = -1; desc->tdhasoid = hasoid; -+ desc->tdhasseclabel = false; ++ desc->tdhassecid = false; desc->tdrefcount = -1; /* assume not reference-counted */ return desc; @@ -369,7 +369,7 @@ diff -Nrpc base/src/backend/access/common/tupdesc.c sepgsql/src/backend/access/c desc->tdtypeid = RECORDOID; desc->tdtypmod = -1; desc->tdhasoid = hasoid; -+ desc->tdhasseclabel = false; ++ desc->tdhassecid = false; desc->tdrefcount = -1; /* assume not reference-counted */ return desc; @@ -379,7 +379,7 @@ diff -Nrpc base/src/backend/access/common/tupdesc.c sepgsql/src/backend/access/c desc->tdtypeid = tupdesc->tdtypeid; desc->tdtypmod = tupdesc->tdtypmod; -+ desc->tdhasseclabel = tupdesc->tdhasseclabel; ++ desc->tdhassecid = tupdesc->tdhassecid; return desc; } @@ -389,7 +389,7 @@ diff -Nrpc base/src/backend/access/common/tupdesc.c sepgsql/src/backend/access/c desc->tdtypeid = tupdesc->tdtypeid; desc->tdtypmod = tupdesc->tdtypmod; -+ desc->tdhasseclabel = tupdesc->tdhasseclabel; ++ desc->tdhassecid = tupdesc->tdhassecid; return desc; } @@ -399,14 +399,14 @@ diff -Nrpc base/src/backend/access/common/tupdesc.c sepgsql/src/backend/access/c return false; if (tupdesc1->tdhasoid != tupdesc2->tdhasoid) return false; -+ if (tupdesc1->tdhasseclabel != tupdesc2->tdhasseclabel) ++ if (tupdesc1->tdhassecid != tupdesc2->tdhassecid) + return false; for (i = 0; i < tupdesc1->natts; i++) { diff -Nrpc base/src/backend/access/heap/heapam.c sepgsql/src/backend/access/heap/heapam.c -*** base/src/backend/access/heap/heapam.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/access/heap/heapam.c Wed Jul 15 19:39:56 2009 +*** base/src/backend/access/heap/heapam.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/access/heap/heapam.c Tue Sep 8 23:55:48 2009 *************** *** 54,59 **** --- 54,60 ---- @@ -418,8 +418,8 @@ diff -Nrpc base/src/backend/access/heap/heapam.c sepgsql/src/backend/access/heap #include "storage/freespace.h" #include "storage/lmgr.h" *************** heap_insert(Relation relation, HeapTuple -*** 2015,2020 **** ---- 2016,2027 ---- +*** 2016,2021 **** +--- 2017,2028 ---- Oid simple_heap_insert(Relation relation, HeapTuple tup) { @@ -433,29 +433,29 @@ diff -Nrpc base/src/backend/access/heap/heapam.c sepgsql/src/backend/access/heap } *************** l2: -*** 2557,2562 **** ---- 2564,2574 ---- +*** 2558,2563 **** +--- 2565,2575 ---- Assert(!(newtup->t_data->t_infomask & HEAP_HASOID)); } -+ /* Preserve SecLabel, if not changed */ -+ if (HeapTupleHasSecLabel(newtup) && -+ !OidIsValid(HeapTupleGetSecLabel(newtup))) -+ HeapTupleSetSecLabel(newtup, HeapTupleGetSecLabel(&oldtup)); ++ /* Preserve SecurityId, if not changed */ ++ if (HeapTupleHasSecid(newtup) && ++ !OidIsValid(HeapTupleGetSecid(newtup))) ++ HeapTupleSetSecid(newtup, HeapTupleGetSecid(&oldtup)); + newtup->t_data->t_infomask &= ~(HEAP_XACT_MASK); newtup->t_data->t_infomask2 &= ~(HEAP2_XACT_MASK); newtup->t_data->t_infomask |= (HEAP_XMAX_INVALID | HEAP_UPDATED); diff -Nrpc base/src/backend/access/heap/tuptoaster.c sepgsql/src/backend/access/heap/tuptoaster.c *** base/src/backend/access/heap/tuptoaster.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/access/heap/tuptoaster.c Wed Jul 15 19:39:56 2009 +--- sepgsql/src/backend/access/heap/tuptoaster.c Tue Sep 8 23:55:48 2009 *************** toast_insert_or_update(Relation rel, Hea *** 591,596 **** --- 591,598 ---- hoff += BITMAPLEN(numAttrs); if (newtup->t_data->t_infomask & HEAP_HASOID) hoff += sizeof(Oid); -+ if (HeapTupleHasSecLabel(newtup)) ++ if (HeapTupleHasSecid(newtup)) + hoff += sizeof(Oid); hoff = MAXALIGN(hoff); Assert(hoff == newtup->t_data->t_hoff); @@ -466,7 +466,7 @@ diff -Nrpc base/src/backend/access/heap/tuptoaster.c sepgsql/src/backend/access/ new_len += BITMAPLEN(numAttrs); if (olddata->t_infomask & HEAP_HASOID) new_len += sizeof(Oid); -+ if (HeapTupleHeaderHasSecLabel(olddata)) ++ if (HeapTupleHeaderHasSecid(olddata)) + new_len += sizeof(Oid); new_len = MAXALIGN(new_len); Assert(new_len == olddata->t_hoff); @@ -477,7 +477,7 @@ diff -Nrpc base/src/backend/access/heap/tuptoaster.c sepgsql/src/backend/access/ new_len += BITMAPLEN(numAttrs); if (olddata->t_infomask & HEAP_HASOID) new_len += sizeof(Oid); -+ if (HeapTupleHeaderHasSecLabel(olddata)) ++ if (HeapTupleHeaderHasSecid(olddata)) + new_len += sizeof(Oid); new_len = MAXALIGN(new_len); Assert(new_len == olddata->t_hoff); @@ -499,20 +499,21 @@ diff -Nrpc base/src/backend/access/heap/tuptoaster.c sepgsql/src/backend/access/ /* diff -Nrpc base/src/backend/access/transam/xact.c sepgsql/src/backend/access/transam/xact.c *** base/src/backend/access/transam/xact.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/access/transam/xact.c Wed Jul 15 19:39:56 2009 +--- sepgsql/src/backend/access/transam/xact.c Sun Sep 6 19:31:39 2009 *************** *** 36,41 **** ---- 36,42 ---- +--- 36,43 ---- #include "libpq/be-fsstubs.h" #include "miscadmin.h" #include "pgstat.h" + #include "security/rowlevel.h" ++ #include "security/sepgsql.h" #include "storage/bufmgr.h" #include "storage/fd.h" #include "storage/lmgr.h" *************** typedef struct TransactionStateData *** 140,145 **** ---- 141,147 ---- +--- 142,148 ---- Oid prevUser; /* previous CurrentUserId setting */ bool prevSecDefCxt; /* previous SecurityDefinerContext setting */ bool prevXactReadOnly; /* entry-time xact r/o state */ @@ -522,7 +523,7 @@ diff -Nrpc base/src/backend/access/transam/xact.c sepgsql/src/backend/access/tra *************** static TransactionStateData TopTransacti *** 168,173 **** ---- 170,176 ---- +--- 171,177 ---- InvalidOid, /* previous CurrentUserId setting */ false, /* previous SecurityDefinerContext setting */ false, /* entry-time xact r/o state */ @@ -532,7 +533,7 @@ diff -Nrpc base/src/backend/access/transam/xact.c sepgsql/src/backend/access/tra *************** StartTransaction(void) *** 1524,1529 **** ---- 1527,1533 ---- +--- 1528,1534 ---- s->nChildXids = 0; s->maxChildXids = 0; GetUserIdAndContext(&s->prevUser, &s->prevSecDefCxt); @@ -542,7 +543,7 @@ diff -Nrpc base/src/backend/access/transam/xact.c sepgsql/src/backend/access/tra *************** AbortTransaction(void) *** 2030,2035 **** ---- 2034,2044 ---- +--- 2035,2050 ---- SetUserIdAndContext(s->prevUser, s->prevSecDefCxt); /* @@ -550,13 +551,18 @@ diff -Nrpc base/src/backend/access/transam/xact.c sepgsql/src/backend/access/tra + */ + rowlvSetPerformingMode(s->prevRowlv); + ++ /* ++ * Reset access vector cache on error ++ */ ++ sepgsqlAvcReset(); ++ + /* * do abort processing */ AfterTriggerEndXact(false); *************** AbortSubTransaction(void) *** 3873,3878 **** ---- 3882,3892 ---- +--- 3888,3903 ---- SetUserIdAndContext(s->prevUser, s->prevSecDefCxt); /* @@ -564,13 +570,18 @@ diff -Nrpc base/src/backend/access/transam/xact.c sepgsql/src/backend/access/tra + */ + rowlvSetPerformingMode(s->prevRowlv); + ++ /* ++ * Reset access vector cache on error ++ */ ++ sepgsqlAvcReset(); ++ + /* * We can skip all this stuff if the subxact failed before creating a * ResourceOwner... */ *************** PushTransaction(void) *** 4014,4019 **** ---- 4028,4034 ---- +--- 4039,4045 ---- s->blockState = TBLOCK_SUBBEGIN; GetUserIdAndContext(&s->prevUser, &s->prevSecDefCxt); s->prevXactReadOnly = XactReadOnly; @@ -625,7 +636,7 @@ diff -Nrpc base/src/backend/bootstrap/bootparse.y sepgsql/src/backend/bootstrap/ do_end(); diff -Nrpc base/src/backend/bootstrap/bootstrap.c sepgsql/src/backend/bootstrap/bootstrap.c *** base/src/backend/bootstrap/bootstrap.c Fri Feb 20 22:15:36 2009 ---- sepgsql/src/backend/bootstrap/bootstrap.c Thu Jul 16 22:14:45 2009 +--- sepgsql/src/backend/bootstrap/bootstrap.c Wed Sep 9 13:14:37 2009 *************** *** 26,31 **** --- 26,32 ---- @@ -656,7 +667,7 @@ diff -Nrpc base/src/backend/bootstrap/bootstrap.c sepgsql/src/backend/bootstrap/ tupDesc = CreateTupleDesc(numattr, RelationGetForm(boot_reldesc)->relhasoids, attrtypes); -+ tupDesc->tdhasseclabel = RelationGetDescr(boot_reldesc)->tdhasseclabel; ++ tupDesc->tdhassecid = RelationGetDescr(boot_reldesc)->tdhassecid; + tuple = heap_form_tuple(tupDesc, values, Nulls); if (objectid != (Oid) 0) @@ -700,10 +711,20 @@ diff -Nrpc base/src/backend/catalog/Makefile sepgsql/src/backend/catalog/Makefil toasting.h indexing.h \ diff -Nrpc base/src/backend/catalog/aclchk.c sepgsql/src/backend/catalog/aclchk.c *** base/src/backend/catalog/aclchk.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/catalog/aclchk.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/catalog/aclchk.c Wed Sep 9 21:29:33 2009 +*************** +*** 35,40 **** +--- 35,41 ---- + #include "catalog/pg_operator.h" + #include "catalog/pg_opfamily.h" + #include "catalog/pg_proc.h" ++ #include "catalog/pg_security.h" + #include "catalog/pg_tablespace.h" + #include "catalog/pg_type.h" + #include "catalog/pg_ts_config.h" *************** *** 43,48 **** ---- 43,49 ---- +--- 44,50 ---- #include "foreign/foreign.h" #include "miscadmin.h" #include "parser/parse_func.h" @@ -711,57 +732,44 @@ diff -Nrpc base/src/backend/catalog/aclchk.c sepgsql/src/backend/catalog/aclchk. #include "utils/acl.h" #include "utils/fmgroids.h" #include "utils/lsyscache.h" -*************** AclResult -*** 3045,3051 **** ---- 3046,3059 ---- - pg_database_aclcheck(Oid db_oid, Oid roleid, AclMode mode) - { - if (pg_database_aclmask(db_oid, roleid, mode, ACLMASK_ANY) != 0) -+ { -+ /* SELinux: db_database:{connect} permission */ -+ if ((mode & ACL_CONNECT) && -+ !sepgsqlCheckDatabaseConnect(db_oid)) -+ return ACLCHECK_NO_PRIV; +*************** expand_all_col_privileges(Oid table_oid, +*** 672,677 **** +--- 674,685 ---- + if (curr_att == ObjectIdAttributeNumber && !classForm->relhasoids) + continue; + ++ /* Skip OID column, if it doesn't exist */ ++ if (curr_att == SecurityAttributeNumber && ++ (classForm->relkind != RELKIND_RELATION || ++ table_oid == SecurityRelationId)) ++ continue; + - return ACLCHECK_OK; -+ } - else - return ACLCHECK_NO_PRIV; - } -*************** AclResult -*** 3057,3063 **** ---- 3065,3078 ---- - pg_proc_aclcheck(Oid proc_oid, Oid roleid, AclMode mode) - { - if (pg_proc_aclmask(proc_oid, roleid, mode, ACLMASK_ANY) != 0) -+ { -+ /* SELinux: db_procedure:{execute} permission */ -+ if ((mode & ACL_EXECUTE) && -+ !sepgsqlCheckProcedureExecute(proc_oid)) -+ return ACLCHECK_NO_PRIV; + /* Views don't have any system columns at all */ + if (classForm->relkind == RELKIND_VIEW && curr_att < 0) + continue; +*************** ExecGrant_Function(InternalGrant *istmt) +*** 1572,1577 **** +--- 1580,1587 ---- + funcId, grantorId, ACL_KIND_PROC, + NameStr(pg_proc_tuple->proname), + 0, NULL); ++ /* SELinux: db_procedure:{setattr} */ ++ sepgsqlCheckProcedureSetattr(funcId); + + /* + * Generate new ACL. +*************** ExecGrant_Namespace(InternalGrant *istmt +*** 1815,1820 **** +--- 1825,1833 ---- + NameStr(pg_namespace_tuple->nspname), + 0, NULL); + ++ /* SELinux: db_schema:{setattr} */ ++ sepgsqlCheckSchemaSetattr(nspid); + - return ACLCHECK_OK; -+ } - else - return ACLCHECK_NO_PRIV; - } -*************** AclResult -*** 3081,3087 **** ---- 3096,3109 ---- - pg_namespace_aclcheck(Oid nsp_oid, Oid roleid, AclMode mode) - { - if (pg_namespace_aclmask(nsp_oid, roleid, mode, ACLMASK_ANY) != 0) -+ { -+ /* SELinux: db_schema:{usage} permission */ -+ if ((mode & ACL_USAGE) && -+ !sepgsqlCheckSchemaUsage(nsp_oid)) -+ return ACLCHECK_NO_PRIV; -+ - return ACLCHECK_OK; -+ } - else - return ACLCHECK_NO_PRIV; - } + /* + * Generate new ACL. + * diff -Nrpc base/src/backend/catalog/catalog.c sepgsql/src/backend/catalog/catalog.c *** base/src/backend/catalog/catalog.c Thu Jun 18 10:20:52 2009 --- sepgsql/src/backend/catalog/catalog.c Wed Jul 15 19:30:50 2009 @@ -808,8 +816,8 @@ diff -Nrpc base/src/backend/catalog/catalog.c sepgsql/src/backend/catalog/catalo relationId == PgShdescriptionToastIndex) return true; diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dependency.c -*** base/src/backend/catalog/dependency.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/catalog/dependency.c Thu Jul 16 17:22:29 2009 +*** base/src/backend/catalog/dependency.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/catalog/dependency.c Mon Sep 7 00:55:45 2009 *************** *** 63,68 **** --- 63,69 ---- @@ -821,7 +829,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep #include "utils/builtins.h" #include "utils/fmgroids.h" *************** static void reportDependentObjects(const -*** 157,163 **** +*** 160,166 **** DropBehavior behavior, int msglevel, const ObjectAddress *origObject); @@ -829,7 +837,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep static void doDeletion(const ObjectAddress *object); static void AcquireDeletionLock(const ObjectAddress *object); static void ReleaseDeletionLock(const ObjectAddress *object); ---- 158,165 ---- +--- 161,168 ---- DropBehavior behavior, int msglevel, const ObjectAddress *origObject); @@ -839,7 +847,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep static void AcquireDeletionLock(const ObjectAddress *object); static void ReleaseDeletionLock(const ObjectAddress *object); *************** static void getOpFamilyDescription(Strin -*** 189,197 **** +*** 192,200 **** * are variants on the same theme; if you change anything here you'll likely * need to fix them too. */ @@ -849,7 +857,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep { Relation depRel; ObjectAddresses *targetObjects; ---- 191,199 ---- +--- 194,202 ---- * are variants on the same theme; if you change anything here you'll likely * need to fix them too. */ @@ -860,7 +868,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep Relation depRel; ObjectAddresses *targetObjects; *************** performDeletion(const ObjectAddress *obj -*** 237,243 **** +*** 240,246 **** { ObjectAddress *thisobj = targetObjects->refs + i; @@ -868,7 +876,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep } /* And clean up */ ---- 239,245 ---- +--- 242,248 ---- { ObjectAddress *thisobj = targetObjects->refs + i; @@ -877,8 +885,8 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep /* And clean up */ *************** performDeletion(const ObjectAddress *obj -*** 246,251 **** ---- 248,265 ---- +*** 249,254 **** +--- 251,268 ---- heap_close(depRel, RowExclusiveLock); } @@ -898,7 +906,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep * performMultipleDeletions: Similar to performDeletion, but act on multiple * objects at once. *************** performMultipleDeletions(const ObjectAdd -*** 319,325 **** +*** 322,328 **** { ObjectAddress *thisobj = targetObjects->refs + i; @@ -906,7 +914,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep } /* And clean up */ ---- 333,340 ---- +--- 336,343 ---- { ObjectAddress *thisobj = targetObjects->refs + i; @@ -916,7 +924,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep /* And clean up */ *************** deleteWhatDependsOn(const ObjectAddress -*** 390,396 **** +*** 393,399 **** if (thisextra->flags & DEPFLAG_ORIGINAL) continue; @@ -924,7 +932,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep } /* And clean up */ ---- 405,411 ---- +--- 408,414 ---- if (thisextra->flags & DEPFLAG_ORIGINAL) continue; @@ -933,7 +941,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep /* And clean up */ *************** reportDependentObjects(const ObjectAddre -*** 939,951 **** +*** 942,954 **** * depRel is the already-open pg_depend relation. */ static void @@ -947,7 +955,7 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep /* * First remove any pg_depend records that link from this object to * others. (Any records linking to this object should be gone already.) ---- 954,970 ---- +--- 957,973 ---- * depRel is the already-open pg_depend relation. */ static void @@ -960,14 +968,14 @@ diff -Nrpc base/src/backend/catalog/dependency.c sepgsql/src/backend/catalog/dep + /* SELinux checks db_xxx:{drop}, if necessary */ + if (permission) -+ sepgsqlCheckObjectDrop(object); ++ sepgsqlCheckSysobjDrop(object); + /* * First remove any pg_depend records that link from this object to * others. (Any records linking to this object should be gone already.) diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c *** base/src/backend/catalog/heap.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/catalog/heap.c Wed Jul 15 20:03:59 2009 +--- sepgsql/src/backend/catalog/heap.c Wed Sep 9 16:47:01 2009 *************** *** 43,48 **** --- 43,49 ---- @@ -1023,8 +1031,8 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c ! * System columns for enhanced security features ! */ ! static FormData_pg_attribute a8 = { -! 0, {SecurityLabelAttributeName}, TEXTOID, 0, -1, -! SecurityLabelAttributeNumber, 0, -1, -1, +! 0, {SecurityAttributeName}, TEXTOID, 0, -1, +! SecurityAttributeNumber, 0, -1, -1, ! false, 'x', 'i', true, false, false, true, 0, {0} ! }; ! @@ -1044,7 +1052,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c + bool + SystemAttributeIsWritable(AttrNumber attnum) + { -+ if (attnum == SecurityLabelAttributeNumber) ++ if (attnum == SecurityAttributeNumber) + return true; + + return false; @@ -1061,8 +1069,8 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c + /* + * Does the relation have security attribute? + */ -+ RelationGetDescr(rel)->tdhasseclabel -+ = securityTupleDescHasSecLabel(relid, relkind); ++ RelationGetDescr(rel)->tdhassecid ++ = securityTupleDescHasSecid(relid, relkind); /* * Have the storage manager create the relation's disk file, if needed. @@ -1090,8 +1098,8 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c tup = heap_form_tuple(RelationGetDescr(pg_attribute_rel), values, nulls); -+ if (HeapTupleHasSecLabel(tup)) -+ HeapTupleSetSecLabel(tup, new_att_secid); ++ if (HeapTupleHasSecid(tup)) ++ HeapTupleSetSecid(tup, new_att_secid); + /* finally insert the new tuple, update the indexes, and clean up */ simple_heap_insert(pg_attribute_rel, tup); @@ -1149,6 +1157,21 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c /* Add dependency info */ myself.classId = RelationRelationId; *************** AddNewAttributeTuples(Oid new_rel_oid, +*** 601,606 **** +--- 639,650 ---- + SysAtt[i]->attnum == ObjectIdAttributeNumber) + continue; + ++ /* skip Secid where appropriate */ ++ if (SysAtt[i]->attnum == SecurityAttributeNumber && ++ (relkind != RELKIND_RELATION || ++ new_rel_oid == SecurityRelationId)) ++ continue; ++ + memcpy(&attStruct, (char *) SysAtt[i], sizeof(FormData_pg_attribute)); + + /* Fill in the correct relation OID in the copied tuple */ +*************** AddNewAttributeTuples(Oid new_rel_oid, *** 613,619 **** attStruct.attinhcount = oidinhcount; } @@ -1157,7 +1180,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c } } ---- 651,661 ---- +--- 657,667 ---- attStruct.attinhcount = oidinhcount; } @@ -1178,7 +1201,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c { Form_pg_class rd_rel = new_rel_desc->rd_rel; Datum values[Natts_pg_class]; ---- 683,690 ---- +--- 689,696 ---- InsertPgClassTuple(Relation pg_class_desc, Relation new_rel_desc, Oid new_rel_oid, @@ -1189,12 +1212,12 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c Datum values[Natts_pg_class]; *************** InsertPgClassTuple(Relation pg_class_des *** 690,695 **** ---- 733,741 ---- +--- 739,747 ---- */ HeapTupleSetOid(tup, new_rel_oid); -+ if (HeapTupleHasSecLabel(tup)) -+ HeapTupleSetSecLabel(tup, new_rel_secid); ++ if (HeapTupleHasSecid(tup)) ++ HeapTupleSetSecid(tup, new_rel_secid); + /* finally insert the new tuple, update the indexes, and clean up */ simple_heap_insert(pg_class_desc, tup); @@ -1210,7 +1233,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c /* * first we update some of the information in our uncataloged relation's ---- 758,768 ---- +--- 764,774 ---- Oid new_type_oid, Oid relowner, char relkind, @@ -1232,7 +1255,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c } ---- 819,830 ---- +--- 825,836 ---- new_rel_desc->rd_att->tdtypeid = new_type_oid; @@ -1254,7 +1277,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c { Relation pg_class_desc; Relation new_rel_desc; ---- 895,902 ---- +--- 901,908 ---- int oidinhcount, OnCommitAction oncommit, Datum reloptions, @@ -1278,7 +1301,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c /* * Make a dependency link to force the relation to be deleted if its ---- 1072,1085 ---- +--- 1078,1091 ---- new_type_oid, ownerid, relkind, @@ -1295,7 +1318,7 @@ diff -Nrpc base/src/backend/catalog/heap.c sepgsql/src/backend/catalog/heap.c * Make a dependency link to force the relation to be deleted if its *************** heap_drop_with_catalog(Oid relid) *** 1484,1489 **** ---- 1538,1548 ---- +--- 1544,1554 ---- * delete relation tuple */ DeleteRelationTuple(relid); @@ -1448,7 +1471,7 @@ diff -Nrpc base/src/backend/catalog/index.c sepgsql/src/backend/catalog/index.c * update pg_index diff -Nrpc base/src/backend/catalog/namespace.c sepgsql/src/backend/catalog/namespace.c *** base/src/backend/catalog/namespace.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/catalog/namespace.c Wed Jul 15 19:35:52 2009 +--- sepgsql/src/backend/catalog/namespace.c Mon Sep 7 00:55:45 2009 *************** *** 39,44 **** --- 39,45 ---- @@ -1459,9 +1482,86 @@ diff -Nrpc base/src/backend/catalog/namespace.c sepgsql/src/backend/catalog/name #include "storage/backendid.h" #include "storage/ipc.h" #include "utils/acl.h" +*************** LookupExplicitNamespace(const char *nspn +*** 2105,2111 **** +--- 2106,2115 ---- + if (strcmp(nspname, "pg_temp") == 0) + { + if (OidIsValid(myTempNamespace)) ++ { ++ sepgsqlCheckSchemaSearch(myTempNamespace, true); + return myTempNamespace; ++ } + + /* + * Since this is used only for looking up existing objects, there is +*************** LookupExplicitNamespace(const char *nspn +*** 2127,2132 **** +--- 2131,2137 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_NAMESPACE, + nspname); ++ sepgsqlCheckSchemaSearch(namespaceId, true); + + return namespaceId; + } +*************** recomputeNamespacePath(void) +*** 2722,2728 **** + if (OidIsValid(namespaceId) && + !list_member_oid(oidlist, namespaceId) && + pg_namespace_aclcheck(namespaceId, roleid, +! ACL_USAGE) == ACLCHECK_OK) + oidlist = lappend_oid(oidlist, namespaceId); + } + } +--- 2727,2734 ---- + if (OidIsValid(namespaceId) && + !list_member_oid(oidlist, namespaceId) && + pg_namespace_aclcheck(namespaceId, roleid, +! ACL_USAGE) == ACLCHECK_OK && +! sepgsqlCheckSchemaSearch(namespaceId, false)) + oidlist = lappend_oid(oidlist, namespaceId); + } + } +*************** recomputeNamespacePath(void) +*** 2731,2737 **** + /* pg_temp --- substitute temp namespace, if any */ + if (OidIsValid(myTempNamespace)) + { +! if (!list_member_oid(oidlist, myTempNamespace)) + oidlist = lappend_oid(oidlist, myTempNamespace); + } + else +--- 2737,2744 ---- + /* pg_temp --- substitute temp namespace, if any */ + if (OidIsValid(myTempNamespace)) + { +! if (!list_member_oid(oidlist, myTempNamespace) && +! sepgsqlCheckSchemaSearch(myTempNamespace, false)) + oidlist = lappend_oid(oidlist, myTempNamespace); + } + else +*************** recomputeNamespacePath(void) +*** 2750,2756 **** + if (OidIsValid(namespaceId) && + !list_member_oid(oidlist, namespaceId) && + pg_namespace_aclcheck(namespaceId, roleid, +! ACL_USAGE) == ACLCHECK_OK) + oidlist = lappend_oid(oidlist, namespaceId); + } + } +--- 2757,2764 ---- + if (OidIsValid(namespaceId) && + !list_member_oid(oidlist, namespaceId) && + pg_namespace_aclcheck(namespaceId, roleid, +! ACL_USAGE) == ACLCHECK_OK && +! sepgsqlCheckSchemaSearch(namespaceId, false)) + oidlist = lappend_oid(oidlist, namespaceId); + } + } *************** InitTempTableNamespace(void) *** 2816,2821 **** ---- 2817,2823 ---- +--- 2824,2830 ---- char namespaceName[NAMEDATALEN]; Oid namespaceId; Oid toastspaceId; @@ -1471,11 +1571,11 @@ diff -Nrpc base/src/backend/catalog/namespace.c sepgsql/src/backend/catalog/name *************** InitTempTableNamespace(void) *** 2836,2841 **** ---- 2838,2846 ---- +--- 2845,2853 ---- errmsg("permission denied to create temporary tables in database \"%s\"", get_database_name(MyDatabaseId)))); -+ /* SELinux checks db_schema_temp:{create} */ ++ /* SELinux checks permission to create temp schema */ + nspsecid = sepgsqlCheckSchemaCreate(namespaceName, NULL, true); + snprintf(namespaceName, sizeof(namespaceName), "pg_temp_%d", MyBackendId); @@ -1490,7 +1590,7 @@ diff -Nrpc base/src/backend/catalog/namespace.c sepgsql/src/backend/catalog/name /* Advance command counter to make namespace visible */ CommandCounterIncrement(); } ---- 2856,2864 ---- +--- 2863,2871 ---- * temp tables. This works because the places that access the temp * namespace for my own backend skip permissions checks on it. */ @@ -1509,7 +1609,7 @@ diff -Nrpc base/src/backend/catalog/namespace.c sepgsql/src/backend/catalog/name /* Advance command counter to make namespace visible */ CommandCounterIncrement(); } ---- 2884,2892 ---- +--- 2891,2899 ---- 0, 0, 0); if (!OidIsValid(toastspaceId)) { @@ -1521,7 +1621,7 @@ diff -Nrpc base/src/backend/catalog/namespace.c sepgsql/src/backend/catalog/name } *************** RemoveTempRelations(Oid tempNamespaceId) *** 3030,3035 **** ---- 3039,3051 ---- +--- 3046,3058 ---- object.objectId = tempNamespaceId; object.objectSubId = 0; @@ -1595,7 +1695,7 @@ diff -Nrpc base/src/backend/catalog/pg_largeobject.c sepgsql/src/backend/catalog } diff -Nrpc base/src/backend/catalog/pg_namespace.c sepgsql/src/backend/catalog/pg_namespace.c *** base/src/backend/catalog/pg_namespace.c Sat Jan 3 13:01:35 2009 ---- sepgsql/src/backend/catalog/pg_namespace.c Wed Jul 15 19:35:52 2009 +--- sepgsql/src/backend/catalog/pg_namespace.c Tue Sep 8 23:55:48 2009 *************** *** 28,34 **** * --------------- @@ -1619,14 +1719,14 @@ diff -Nrpc base/src/backend/catalog/pg_namespace.c sepgsql/src/backend/catalog/p tupDesc = nspdesc->rd_att; tup = heap_form_tuple(tupDesc, values, nulls); -+ if (HeapTupleHasSecLabel(tup)) -+ HeapTupleSetSecLabel(tup, nspsecid); ++ if (HeapTupleHasSecid(tup)) ++ HeapTupleSetSecid(tup, nspsecid); nspoid = simple_heap_insert(nspdesc, tup); Assert(OidIsValid(nspoid)); diff -Nrpc base/src/backend/catalog/pg_proc.c sepgsql/src/backend/catalog/pg_proc.c *** base/src/backend/catalog/pg_proc.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/catalog/pg_proc.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/catalog/pg_proc.c Tue Sep 8 23:55:48 2009 *************** *** 29,34 **** --- 29,35 ---- @@ -1666,65 +1766,52 @@ diff -Nrpc base/src/backend/catalog/pg_proc.c sepgsql/src/backend/catalog/pg_pro TupleDesc tupDesc; bool is_update; *************** ProcedureCreate(const char *procedureNam -*** 357,362 **** ---- 360,377 ---- - aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PROC, - procedureName); +*** 343,348 **** +--- 346,361 ---- + ObjectIdGetDatum(procNamespace), + 0); -+ /* SELinux checks db_procedure:{setattr}, -+ * and db_procedure:{relabelfrom relabelto} if necessary. */ -+ if (!proseclabel) -+ sepgsqlCheckProcedureSetattr(HeapTupleGetOid(oldtup)); -+ else -+ prosecid = sepgsqlCheckProcedureRelabel(HeapTupleGetOid(oldtup), -+ (DefElem *)proseclabel); ++ /* Check permission to create/replace a function */ ++ prosecid = sepgsqlCheckProcedureCreate(procedureName, ++ HeapTupleIsValid(oldtup) ++ ? HeapTupleGetOid(oldtup) ++ : InvalidOid, ++ procNamespace, ++ languageObjectId, ++ (DefElem *)proseclabel); ++ sepgsqlCheckSchemaAddName(procNamespace); + -+ /* SELinux checks db_database:{install_module}, if necessary */ -+ if (probin && languageObjectId == ClanguageId) -+ sepgsqlCheckDatabaseInstallModule(probin, oldtup); -+ - /* - * Not okay to change the return type of the existing proc, since - * existing rules, views, etc may depend on the return type. + if (HeapTupleIsValid(oldtup)) + { + /* There is one; okay to replace it? */ *************** ProcedureCreate(const char *procedureNam *** 477,482 **** ---- 492,499 ---- +--- 490,497 ---- /* Okay, do it... */ tup = heap_modify_tuple(oldtup, tupDesc, values, nulls, replaces); -+ if (HeapTupleHasSecLabel(tup) && OidIsValid(prosecid)) -+ HeapTupleSetSecLabel(tup, prosecid); ++ if (HeapTupleHasSecid(tup) && OidIsValid(prosecid)) ++ HeapTupleSetSecid(tup, prosecid); simple_heap_update(rel, &tup->t_self, tup); ReleaseSysCache(oldtup); *************** ProcedureCreate(const char *procedureNam -*** 484,491 **** ---- 501,519 ---- - } - else +*** 486,491 **** +--- 501,508 ---- { -+ /* SELinux checks db_procedure:{create} */ -+ prosecid = sepgsqlCheckProcedureCreate(procedureName, -+ procNamespace, -+ (DefElem *)proseclabel); -+ -+ /* SELinux checks db_database:{install_module}, if necessary */ -+ if (probin && languageObjectId == ClanguageId) -+ sepgsqlCheckDatabaseInstallModule(probin, NULL); -+ /* Creating a new procedure */ tup = heap_form_tuple(tupDesc, values, nulls); -+ if (HeapTupleHasSecLabel(tup)) -+ HeapTupleSetSecLabel(tup, prosecid); ++ if (HeapTupleHasSecid(tup)) ++ HeapTupleSetSecid(tup, prosecid); simple_heap_insert(rel, tup); is_update = false; } diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg_security.c *** base/src/backend/catalog/pg_security.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/catalog/pg_security.c Fri Jul 17 16:31:54 2009 +--- sepgsql/src/backend/catalog/pg_security.c Thu Sep 10 15:18:03 2009 *************** *** 0 **** ---- 1,680 ---- +--- 1,637 ---- + /* + * src/backend/catalog/pg_security.c + * routines to support security label management @@ -1756,15 +1843,9 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + #include "utils/tqual.h" + + bool -+ securityTupleDescHasSecLabel(Oid relid, char relkind) ++ securityTupleDescHasSecid(Oid relid, char relkind) + { -+ return sepgsqlTupleDescHasSecLabel(relid, relkind); -+ } -+ -+ static char * -+ securityMetaSecurityLabel(void) -+ { -+ return sepgsqlMetaSecurityLabel(); ++ return sepgsqlTupleDescHasSecid(relid, relkind); + } + + /* @@ -1833,8 +1914,6 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + Relation rel; + HeapTuple tuple; + earlySecAttr *es; -+ char *meta_label; -+ Oid meta_secid = InvalidOid; + Datum values[Natts_pg_security]; + bool nulls[Natts_pg_security]; + @@ -1843,11 +1922,6 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + + StartTransactionCommand(); + -+ /* security_label on the pg_security */ -+ meta_label = securityMetaSecurityLabel(); -+ if (meta_label) -+ meta_secid = securityTransSecLabelIn(SecurityRelationId, meta_label); -+ + /* flush all the cached entries */ + rel = heap_open(SecurityRelationId, RowExclusiveLock); + for (es = earlySecAttrList; es; es = es->next) @@ -1860,8 +1934,6 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + values[Anum_pg_security_secattr - 1] = CStringGetTextDatum(es->secattr); + + tuple = heap_form_tuple(RelationGetDescr(rel), values, nulls); -+ if (HeapTupleHasSecLabel(tuple)) -+ HeapTupleSetSecLabel(tuple, meta_secid); + + simple_heap_insert(rel, tuple); + CatalogUpdateIndexes(rel, tuple); @@ -1964,8 +2036,6 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + HeapTuple tuple; + Oid datid; + Oid secid; -+ char *meta_label; -+ Oid meta_secid = InvalidOid; + Datum values[Natts_pg_security]; + bool nulls[Natts_pg_security]; + @@ -2005,21 +2075,7 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + values[Anum_pg_security_seckind - 1] = CharGetDatum(seckind); + values[Anum_pg_security_secattr - 1] = CStringGetTextDatum(secattr); + -+ meta_label = securityMetaSecurityLabel(); -+ if (meta_label) -+ { -+ if (datid == InvalidOid && -+ relid == SecurityRelationId && -+ seckind == SECKIND_SECURITY_LABEL && -+ strcmp(meta_label, secattr) == 0) -+ meta_secid = secid; -+ else -+ meta_secid = securityTransSecLabelIn(SecurityRelationId, meta_label); -+ } -+ + tuple = heap_form_tuple(RelationGetDescr(rel), values, nulls); -+ if (HeapTupleHasSecLabel(tuple)) -+ HeapTupleSetSecLabel(tuple, meta_secid); + + simple_heap_insert(rel, tuple); + CatalogUpdateIndexes(rel, tuple); @@ -2124,29 +2180,17 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + return sepgsqlTransSecLabelOut(seclabel); + } + -+ Oid -+ securityMoveSecLabel(Oid dstid, Oid srcid, Oid secid) -+ { -+ char *seclabel = securityRawSecLabelOut(srcid, secid); -+ -+ if (!seclabel) -+ return InvalidOid; -+ -+ return securityRawSecLabelIn(dstid, seclabel); -+ } -+ + /* + * Output handler for system columns + */ + Datum -+ securityHeapGetSecLabelSysattr(HeapTuple tuple) ++ securitySysattSecLabelOut(Oid relid, HeapTuple tuple) + { -+ Oid secid = HeapTupleGetSecLabel(tuple); + char *seclabel; + -+ seclabel = securityTransSecLabelOut(tuple->t_tableOid, secid); ++ seclabel = sepgsqlSysattSecLabelOut(relid, tuple); + if (!seclabel) -+ seclabel = pstrdup("unlabeled"); ++ seclabel = "unlabled"; + + return CStringGetTextDatum(seclabel); + } @@ -2403,8 +2447,136 @@ diff -Nrpc base/src/backend/catalog/pg_security.c sepgsql/src/backend/catalog/pg + { + HeapTupleHeader tuphdr = PG_GETARG_HEAPTUPLEHEADER(0); + -+ PG_RETURN_OID(HeapTupleHeaderGetSecLabel(tuphdr)); ++ PG_RETURN_OID(HeapTupleHeaderGetSecid(tuphdr)); + } +diff -Nrpc base/src/backend/catalog/pg_shdepend.c sepgsql/src/backend/catalog/pg_shdepend.c +*** base/src/backend/catalog/pg_shdepend.c Thu Jun 18 10:20:52 2009 +--- sepgsql/src/backend/catalog/pg_shdepend.c Tue Sep 8 23:55:48 2009 +*************** +*** 36,41 **** +--- 36,42 ---- + #include "commands/schemacmds.h" + #include "commands/tablecmds.h" + #include "commands/typecmds.h" ++ #include "security/sepgsql.h" + #include "storage/lmgr.h" + #include "miscadmin.h" + #include "utils/acl.h" +*************** shdepReassignOwned(List *roleids, Oid ne +*** 1336,1341 **** +--- 1337,1355 ---- + break; + + case TypeRelationId: ++ /* ++ * NOTE: SELinux does not check anything inside ++ * AlterTypeOwnerInternal() ++ */ ++ tuple = SearchSysCache(TYPEOID, ++ ObjectIdGetDatum(sdepForm->objid), ++ 0, 0, 0); ++ if (!HeapTupleIsValid(tuple)) ++ elog(ERROR, "cache lookup failed for type: %u", sdepForm->objid); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, ++ HeapTupleGetSecid(tuple), ++ NameStr(((Form_pg_type) GETSTRUCT(tuple))->typname)); ++ ReleaseSysCache(tuple); + AlterTypeOwnerInternal(sdepForm->objid, newrole, true); + break; + +*************** shdepReassignOwned(List *roleids, Oid ne +*** 1348,1354 **** + break; + + case RelationRelationId: +! + /* + * Pass recursing = true so that we don't fail on indexes, + * owned sequences, etc when we happen to visit them +--- 1362,1368 ---- + break; + + case RelationRelationId: +! sepgsqlCheckTableSetattr(sdepForm->objid); + /* + * Pass recursing = true so that we don't fail on indexes, + * owned sequences, etc when we happen to visit them +diff -Nrpc base/src/backend/catalog/pg_type.c sepgsql/src/backend/catalog/pg_type.c +*** base/src/backend/catalog/pg_type.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/catalog/pg_type.c Tue Sep 8 23:55:48 2009 +*************** +*** 25,30 **** +--- 25,31 ---- + #include "commands/typecmds.h" + #include "miscadmin.h" + #include "parser/scansup.h" ++ #include "security/sepgsql.h" + #include "utils/acl.h" + #include "utils/builtins.h" + #include "utils/fmgroids.h" +*************** TypeShellMake(const char *typeName, Oid +*** 56,65 **** +--- 57,72 ---- + Datum values[Natts_pg_type]; + bool nulls[Natts_pg_type]; + Oid typoid; ++ Oid typsid; + NameData name; + + Assert(PointerIsValid(typeName)); + ++ /* SELinux check permission to create a shell type */ ++ typsid = sepgsqlCheckSysobjCreate(TypeRelationId, typeName); ++ sepgsqlCheckProcedureInstall(F_SHELL_IN); ++ sepgsqlCheckProcedureInstall(F_SHELL_OUT); ++ + /* + * open pg_type + */ +*************** TypeCreate(Oid newTypeOid, +*** 201,206 **** +--- 208,214 ---- + { + Relation pg_type_desc; + Oid typeObjectId; ++ Oid typeSecid = InvalidOid; + bool rebuildDeps = false; + HeapTuple tup; + bool nulls[Natts_pg_type]; +*************** TypeCreate(Oid newTypeOid, +*** 367,372 **** +--- 375,394 ---- + CStringGetDatum(typeName), + ObjectIdGetDatum(typeNamespace), + 0, 0); ++ ++ /* SELinux checks to create/replace type */ ++ if (!isImplicitArray && typeType != TYPTYPE_COMPOSITE) ++ { ++ if (!HeapTupleIsValid(tup)) ++ typeSecid = sepgsqlCheckSysobjCreate(TypeRelationId, typeName); ++ else ++ { ++ typeSecid = HeapTupleGetSecid(tup); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, typeSecid, typeName); ++ } ++ sepgsqlCheckSchemaAddName(typeNamespace); ++ } ++ + if (HeapTupleIsValid(tup)) + { + /* +*************** TypeCreate(Oid newTypeOid, +*** 412,417 **** +--- 434,441 ---- + /* Force the OID if requested by caller, else heap_insert does it */ + if (OidIsValid(newTypeOid)) + HeapTupleSetOid(tup, newTypeOid); ++ if (HeapTupleHasSecid(tup)) ++ HeapTupleSetSecid(tup, typeSecid); + + typeObjectId = simple_heap_insert(pg_type_desc, tup); + } diff -Nrpc base/src/backend/catalog/toasting.c sepgsql/src/backend/catalog/toasting.c *** base/src/backend/catalog/toasting.c Thu Jun 18 10:20:52 2009 --- sepgsql/src/backend/catalog/toasting.c Wed Jul 15 19:35:52 2009 @@ -2461,7 +2633,7 @@ diff -Nrpc base/src/backend/catalog/toasting.c sepgsql/src/backend/catalog/toast CommandCounterIncrement(); diff -Nrpc base/src/backend/commands/aggregatecmds.c sepgsql/src/backend/commands/aggregatecmds.c *** base/src/backend/commands/aggregatecmds.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/aggregatecmds.c Wed Jul 15 19:35:52 2009 +--- sepgsql/src/backend/commands/aggregatecmds.c Mon Sep 7 00:55:45 2009 *************** *** 32,37 **** --- 32,38 ---- @@ -2474,12 +2646,14 @@ diff -Nrpc base/src/backend/commands/aggregatecmds.c sepgsql/src/backend/command #include "utils/lsyscache.h" *************** RenameAggregate(List *name, List *args, *** 311,316 **** ---- 312,320 ---- +--- 312,322 ---- aclcheck_error(aclresult, ACL_KIND_NAMESPACE, get_namespace_name(namespaceOid)); -+ /* SELinux checks db_procedure:{setattr} */ ++ /* SELinux permission checks */ + sepgsqlCheckProcedureSetattr(procOid); ++ sepgsqlCheckSchemaRemoveName(namespaceOid); ++ sepgsqlCheckSchemaAddName(namespaceOid); + /* rename */ namestrcpy(&(((Form_pg_proc) GETSTRUCT(tup))->proname), newname); @@ -2546,7 +2720,7 @@ diff -Nrpc base/src/backend/commands/alter.c sepgsql/src/backend/commands/alter. + } diff -Nrpc base/src/backend/commands/cluster.c sepgsql/src/backend/commands/cluster.c *** base/src/backend/commands/cluster.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/cluster.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/commands/cluster.c Tue Sep 8 23:55:48 2009 *************** *** 36,41 **** --- 36,42 ---- @@ -2601,9 +2775,9 @@ diff -Nrpc base/src/backend/commands/cluster.c sepgsql/src/backend/commands/clus if (NewHeap->rd_rel->relhasoids) HeapTupleSetOid(copiedTuple, HeapTupleGetOid(tuple)); -+ /* Preserve SecLabel, if any */ -+ if (HeapTupleHasSecLabel(copiedTuple)) -+ HeapTupleSetSecLabel(copiedTuple, HeapTupleGetSecLabel(tuple)); ++ /* Preserve SID, if any */ ++ if (HeapTupleHasSecid(copiedTuple)) ++ HeapTupleSetSecid(copiedTuple, HeapTupleGetSecid(tuple)); + /* The heap rewrite module does the rest */ rewrite_heap_tuple(rwstate, tuple, copiedTuple); @@ -2635,7 +2809,7 @@ diff -Nrpc base/src/backend/commands/conversioncmds.c sepgsql/src/backend/comman * and target encodings. We do that by calling the function with an empty diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c *** base/src/backend/commands/copy.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/copy.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/commands/copy.c Thu Sep 10 15:18:03 2009 *************** *** 21,28 **** --- 21,31 ---- @@ -2675,22 +2849,24 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c typedef CopyStateData *CopyState; *************** static const char BinarySignature[11] = -*** 243,249 **** +*** 243,250 **** /* non-export function prototypes */ static void DoCopyTo(CopyState cstate); static void CopyTo(CopyState cstate); ! static void CopyOneRowTo(CopyState cstate, Oid tupleOid, - Datum *values, bool *nulls); +! Datum *values, bool *nulls); static void CopyFrom(CopyState cstate); static bool CopyReadLine(CopyState cstate); ---- 252,258 ---- + static bool CopyReadLineText(CopyState cstate); +--- 252,259 ---- /* non-export function prototypes */ static void DoCopyTo(CopyState cstate); static void CopyTo(CopyState cstate); -! static void CopyOneRowTo(CopyState cstate, Oid tupleOid, Oid secLabelId, - Datum *values, bool *nulls); +! static void CopyOneRowTo(CopyState cstate, HeapTuple tuple, +! Datum *values, bool *nulls); static void CopyFrom(CopyState cstate); static bool CopyReadLine(CopyState cstate); + static bool CopyReadLineText(CopyState cstate); *************** DoCopy(const CopyStmt *stmt, const char *** 1090,1095 **** --- 1099,1107 ---- @@ -2738,7 +2914,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c ! ! switch (attnum) ! { -! case SecurityLabelAttributeNumber: +! case SecurityAttributeNumber: ! cstate->seclabel_force_quot = true; ! break; ! default: @@ -2823,7 +2999,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c + + switch (attnum) + { -+ case SecurityLabelAttributeNumber: ++ case SecurityAttributeNumber: + attForm = SystemAttributeDefinition(attnum, true); + out_fmgr = &cstate->seclabel_out_function; + break; @@ -2883,7 +3059,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c } heap_endscan(scandesc); ---- 1481,1498 ---- +--- 1481,1495 ---- { CHECK_FOR_INTERRUPTS(); @@ -2895,10 +3071,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c heap_deform_tuple(tuple, tupDesc, values, nulls); /* Format and send the data */ -! CopyOneRowTo(cstate, -! HeapTupleGetOid(tuple), -! HeapTupleGetSecLabel(tuple), -! values, nulls); +! CopyOneRowTo(cstate, tuple, values, nulls); } heap_endscan(scandesc); @@ -2911,16 +3084,50 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c { bool need_delim = false; FmgrInfo *out_functions = cstate->out_functions; ---- 1518,1525 ---- +--- 1515,1522 ---- * Emit one row during CopyTo(). */ static void -! CopyOneRowTo(CopyState cstate, Oid tupleOid, Oid secLabelId, +! CopyOneRowTo(CopyState cstate, HeapTuple tuple, ! Datum *values, bool *nulls) { bool need_delim = false; FmgrInfo *out_functions = cstate->out_functions; *************** CopyOneRowTo(CopyState cstate, Oid tuple +*** 1461,1467 **** + { + /* Hack --- assume Oid is same size as int32 */ + CopySendInt32(cstate, sizeof(int32)); +! CopySendInt32(cstate, tupleOid); + } + } + else +--- 1536,1542 ---- + { + /* Hack --- assume Oid is same size as int32 */ + CopySendInt32(cstate, sizeof(int32)); +! CopySendInt32(cstate, HeapTupleGetOid(tuple)); + } + } + else +*************** CopyOneRowTo(CopyState cstate, Oid tuple +*** 1471,1477 **** + if (cstate->oids) + { + string = DatumGetCString(DirectFunctionCall1(oidout, +! ObjectIdGetDatum(tupleOid))); + CopySendString(cstate, string); + need_delim = true; + } +--- 1546,1552 ---- + if (cstate->oids) + { + string = DatumGetCString(DirectFunctionCall1(oidout, +! ObjectIdGetDatum(HeapTupleGetOid(tuple)))); + CopySendString(cstate, string); + need_delim = true; + } +*************** CopyOneRowTo(CopyState cstate, Oid tuple *** 1480,1487 **** foreach(cur, cstate->attnumlist) { @@ -2930,7 +3137,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c if (!cstate->binary) { ---- 1558,1568 ---- +--- 1555,1565 ---- foreach(cur, cstate->attnumlist) { int attnum = lfirst_int(cur); @@ -2944,15 +3151,15 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c { *************** CopyOneRowTo(CopyState cstate, Oid tuple *** 1490,1495 **** ---- 1571,1594 ---- +--- 1568,1591 ---- need_delim = true; } + switch (attnum) + { -+ case SecurityLabelAttributeNumber: ++ case SecurityAttributeNumber: + relid = RelationGetRelid(cstate->rel); -+ value = CStringGetTextDatum(securityTransSecLabelOut(relid, secLabelId)); ++ value = securitySysattSecLabelOut(relid, tuple); + isnull = false; + force_quot = cstate->seclabel_force_quot; + out_fmgr = &cstate->seclabel_out_function; @@ -2982,7 +3189,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c list_length(cstate->attnumlist) == 1); else CopyAttributeOutText(cstate, string); ---- 1600,1608 ---- +--- 1597,1605 ---- { if (!cstate->binary) { @@ -3002,7 +3209,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c CopySendInt32(cstate, VARSIZE(outputbytes) - VARHDRSZ); CopySendData(cstate, VARDATA(outputbytes), VARSIZE(outputbytes) - VARHDRSZ); ---- 1611,1617 ---- +--- 1608,1614 ---- { bytea *outputbytes; @@ -3012,7 +3219,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c VARSIZE(outputbytes) - VARHDRSZ); *************** CopyFrom(CopyState cstate) *** 1649,1656 **** ---- 1745,1754 ---- +--- 1742,1751 ---- num_defaults; FmgrInfo *in_functions; FmgrInfo oid_in_function; @@ -3025,7 +3232,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c Oid in_func_oid; *************** CopyFrom(CopyState cstate) *** 1753,1758 **** ---- 1851,1859 ---- +--- 1848,1856 ---- ereport(ERROR, (errcode(ERRCODE_WRONG_OBJECT_TYPE), errmsg("\"%s\" is a directory", cstate->filename))); @@ -3037,12 +3244,12 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c tupDesc = RelationGetDescr(cstate->rel); *************** CopyFrom(CopyState cstate) *** 1888,1893 **** ---- 1989,2006 ---- +--- 1986,2003 ---- fmgr_info(in_func_oid, &oid_in_function); } + if (list_member_int(cstate->attnumlist, -+ SecurityLabelAttributeNumber)) ++ SecurityAttributeNumber)) + { + if (!cstate->binary) + getTypeInputInfo(TEXTOID, @@ -3058,7 +3265,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c *************** CopyFrom(CopyState cstate) *** 1922,1927 **** ---- 2035,2041 ---- +--- 2032,2038 ---- { bool skip_tuple; Oid loaded_oid = InvalidOid; @@ -3082,7 +3289,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c string = field_strings[fieldno++]; if (cstate->csv_mode && string == NULL && ---- 2107,2127 ---- +--- 2104,2124 ---- /* Loop to read the user attributes on the line. */ foreach(cur, cstate->attnumlist) { @@ -3120,7 +3327,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c cstate->cur_attname = NULL; cstate->cur_attval = NULL; } ---- 2131,2170 ---- +--- 2128,2167 ---- string = cstate->null_print; } @@ -3129,7 +3336,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c ! ! switch (attnum) ! { -! case SecurityLabelAttributeNumber: +! case SecurityAttributeNumber: ! if (!string) ! break; ! @@ -3180,7 +3387,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c cstate->cur_attname = NULL; } } ---- 2210,2250 ---- +--- 2207,2247 ---- i = 0; foreach(cur, cstate->attnumlist) { @@ -3199,7 +3406,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c ! ! switch (attnum) ! { -! case SecurityLabelAttributeNumber: +! case SecurityAttributeNumber: ! dat = CopyReadBinaryAttribute(cstate, i, ! &seclabel_in_function, ! seclabel_typioparam, @@ -3224,18 +3431,18 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c } *************** CopyFrom(CopyState cstate) *** 2094,2099 **** ---- 2265,2272 ---- +--- 2262,2269 ---- if (cstate->oids && file_has_oids) HeapTupleSetOid(tuple, loaded_oid); -+ if (HeapTupleHasSecLabel(tuple)) -+ HeapTupleSetSecLabel(tuple, loaded_seclabel); ++ if (HeapTupleHasSecid(tuple)) ++ HeapTupleSetSecid(tuple, loaded_seclabel); /* Triggers and stuff need to be invoked in query context. */ MemoryContextSwitchTo(oldcontext); *************** CopyFrom(CopyState cstate) *** 2118,2123 **** ---- 2291,2299 ---- +--- 2288,2296 ---- } if (!skip_tuple) @@ -3247,7 +3454,7 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c ExecStoreTuple(tuple, slot, InvalidBuffer, false); *************** CopyGetAttnums(TupleDesc tupDesc, Relati *** 3398,3403 **** ---- 3574,3586 ---- +--- 3571,3583 ---- } if (attnum == InvalidAttrNumber) { @@ -3270,18 +3477,18 @@ diff -Nrpc base/src/backend/commands/copy.c sepgsql/src/backend/commands/copy.c } /* ---- 3628,3635 ---- +--- 3625,3632 ---- slot_getallattrs(slot); /* And send the data */ -! CopyOneRowTo(cstate, InvalidOid, InvalidOid, +! CopyOneRowTo(cstate, slot->tts_tuple, ! slot->tts_values, slot->tts_isnull); } /* diff -Nrpc base/src/backend/commands/dbcommands.c sepgsql/src/backend/commands/dbcommands.c *** base/src/backend/commands/dbcommands.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/dbcommands.c Wed Jul 15 19:37:35 2009 +--- sepgsql/src/backend/commands/dbcommands.c Tue Sep 8 23:55:48 2009 *************** *** 33,38 **** --- 33,39 ---- @@ -3328,7 +3535,7 @@ diff -Nrpc base/src/backend/commands/dbcommands.c sepgsql/src/backend/commands/d errmsg("LOCATION is not supported anymore"), errhint("Consider using tablespaces instead."))); } -+ else if (strcmp(defel->defname, "security_label") == 0) ++ else if (strcmp(defel->defname, "security_context") == 0) + { + if (dseclabel) + ereport(ERROR, @@ -3357,8 +3564,8 @@ diff -Nrpc base/src/backend/commands/dbcommands.c sepgsql/src/backend/commands/d new_record, new_record_nulls); HeapTupleSetOid(tuple, dboid); -+ if (HeapTupleHasSecLabel(tuple)) -+ HeapTupleSetSecLabel(tuple, datsecid); ++ if (HeapTupleHasSecid(tuple)) ++ HeapTupleSetSecid(tuple, datsecid); simple_heap_insert(pg_database_rel, tuple); @@ -3505,11 +3712,11 @@ diff -Nrpc base/src/backend/commands/dbcommands.c sepgsql/src/backend/commands/d + + /* SELinux checks db_database:{setattr relabelfrom relabelto} */ + secid = sepgsqlCheckDatabaseRelabel(HeapTupleGetOid(newtup), seclabel); -+ if (!HeapTupleHasSecLabel(newtup)) ++ if (!HeapTupleHasSecid(newtup)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s\"", dbname))); -+ HeapTupleSetSecLabel(newtup, secid); ++ HeapTupleSetSecid(newtup, secid); + + simple_heap_update(rel, &newtup->t_self, newtup); + CatalogUpdateIndexes(rel, newtup); @@ -3560,7 +3767,7 @@ diff -Nrpc base/src/backend/commands/foreigncmds.c sepgsql/src/backend/commands/ { diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands/functioncmds.c *** base/src/backend/commands/functioncmds.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/functioncmds.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/commands/functioncmds.c Tue Sep 8 23:55:48 2009 *************** *** 53,58 **** --- 53,59 ---- @@ -3605,7 +3812,7 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands errmsg("conflicting or redundant options"))); windowfunc_item = defel; } -+ else if (strcmp(defel->defname, "security_label") == 0) ++ else if (strcmp(defel->defname, "security_context") == 0) + { + if (seclabel_item) + ereport(ERROR, @@ -3687,30 +3894,32 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands *************** RenameFunction(List *name, List *argtype *** 1112,1117 **** ---- 1128,1136 ---- +--- 1128,1138 ---- aclcheck_error(aclresult, ACL_KIND_NAMESPACE, get_namespace_name(namespaceOid)); -+ /* SELinux checks db_procedure:{setattr} */ ++ /* SELinux permission checks */ + sepgsqlCheckProcedureSetattr(procOid); ++ sepgsqlCheckSchemaRemoveName(namespaceOid); ++ sepgsqlCheckSchemaAddName(namespaceOid); + /* rename */ namestrcpy(&(procForm->proname), newname); simple_heap_update(rel, &tup->t_self, tup); *************** AlterFunctionOwner_internal(Relation rel *** 1220,1225 **** ---- 1239,1246 ---- +--- 1241,1248 ---- aclcheck_error(aclresult, ACL_KIND_NAMESPACE, get_namespace_name(procForm->pronamespace)); } -+ /* SELinux checks db_procedure:{setattr} */ ++ /* SELinux permission checks */ + sepgsqlCheckProcedureSetattr(procOid); memset(repl_null, false, sizeof(repl_null)); memset(repl_repl, false, sizeof(repl_repl)); *************** AlterFunctionOwner_internal(Relation rel *** 1258,1263 **** ---- 1279,1336 ---- +--- 1281,1337 ---- } /* @@ -3722,20 +3931,20 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands + Relation rel; + HeapTuple oldtup; + HeapTuple newtup; -+ Oid proc_oid; ++ Oid procOid; + Oid secid; + bool replaces[Natts_pg_proc]; + + /* open pg_proc system catalog */ + rel = heap_open(ProcedureRelationId, RowExclusiveLock); + -+ proc_oid = LookupFuncNameTypeNames(name, argtypes, false); ++ procOid = LookupFuncNameTypeNames(name, argtypes, false); + + oldtup = SearchSysCache(PROCOID, -+ ObjectIdGetDatum(proc_oid), ++ ObjectIdGetDatum(procOid), + 0, 0, 0); + if (!HeapTupleIsValid(oldtup)) -+ elog(ERROR, "cache lookup failed for function %u", proc_oid); ++ elog(ERROR, "cache lookup failed for function %u", procOid); + + memset(replaces, false, sizeof(replaces)); + newtup = heap_modify_tuple(oldtup, RelationGetDescr(rel), @@ -3747,15 +3956,14 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands + aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PROC, + get_func_name(HeapTupleGetOid(newtup))); + -+ /* SELinux checks db_procedure:{setattr relabelfrom relabelto} */ -+ secid = sepgsqlCheckProcedureRelabel(HeapTupleGetOid(newtup), seclabel); -+ -+ if (!HeapTupleHasSecLabel(newtup)) ++ /* SELinux permission checks */ ++ secid = sepgsqlCheckProcedureRelabel(procOid, seclabel); ++ if (!HeapTupleHasSecid(newtup)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s\"", -+ get_func_name(HeapTupleGetOid(newtup))))); -+ HeapTupleSetSecLabel(newtup, secid); ++ get_func_name(procOid)))); ++ HeapTupleSetSecid(newtup, secid); + + simple_heap_update(rel, &newtup->t_self, newtup); + CatalogUpdateIndexes(rel, newtup); @@ -3771,11 +3979,11 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands * ALTER framework). *************** AlterFunction(AlterFunctionStmt *stmt) *** 1296,1301 **** ---- 1369,1377 ---- +--- 1370,1378 ---- aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PROC, NameListToString(stmt->func->funcname)); -+ /* SELinux checks db_procedure:{setattr} */ ++ /* SELinux checks permissions */ + sepgsqlCheckProcedureSetattr(funcOid); + if (procForm->proisagg) @@ -3783,7 +3991,7 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands (errcode(ERRCODE_WRONG_OBJECT_TYPE), *************** CreateCast(CreateCastStmt *stmt) *** 1580,1585 **** ---- 1656,1664 ---- +--- 1657,1665 ---- errmsg("cast function must not return a set"))); ReleaseSysCache(tuple); @@ -3794,17 +4002,19 @@ diff -Nrpc base/src/backend/commands/functioncmds.c sepgsql/src/backend/commands else { *************** AlterFunctionNamespace(List *name, List -*** 1854,1859 **** ---- 1933,1941 ---- - aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PROC, - NameListToString(name)); +*** 1897,1902 **** +--- 1977,1987 ---- + NameStr(proc->proname), + newschema))); -+ /* SELinux checks db_procedure:{setattr} */ ++ /* SELinux checks permissions */ + sepgsqlCheckProcedureSetattr(procOid); ++ sepgsqlCheckSchemaRemoveName(oldNspOid); ++ sepgsqlCheckSchemaAddName(nspOid); + - tup = SearchSysCacheCopy(PROCOID, - ObjectIdGetDatum(procOid), - 0, 0, 0); + /* OK, modify the pg_proc row */ + + /* tup is a copy, so we can scribble directly on it */ diff -Nrpc base/src/backend/commands/lockcmds.c sepgsql/src/backend/commands/lockcmds.c *** base/src/backend/commands/lockcmds.c Thu Jun 18 10:20:52 2009 --- sepgsql/src/backend/commands/lockcmds.c Wed Jul 15 19:35:52 2009 @@ -3908,7 +4118,7 @@ diff -Nrpc base/src/backend/commands/proclang.c sepgsql/src/backend/commands/pro stmt->pltrusted); diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/schemacmds.c *** base/src/backend/commands/schemacmds.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/schemacmds.c Wed Jul 15 19:37:35 2009 +--- sepgsql/src/backend/commands/schemacmds.c Tue Sep 8 23:55:48 2009 *************** *** 25,30 **** --- 25,31 ---- @@ -3931,13 +4141,12 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s *************** CreateSchemaCommand(CreateSchemaStmt *st *** 75,80 **** ---- 77,86 ---- +--- 77,85 ---- check_is_member_of_role(saved_uid, owner_uid); + /* SELinux checks db_schema:{create} */ -+ nspsecid = sepgsqlCheckSchemaCreate(schemaName, -+ (DefElem *)stmt->secLabel, false); ++ nspsecid = sepgsqlCheckSchemaCreate(schemaName, (DefElem *)stmt->secLabel, false); + /* Additional check to protect reserved schema names */ if (!allowSystemTableMods && IsReservedName(schemaName)) @@ -3951,7 +4160,7 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s /* Advance cmd counter to make the namespace visible */ CommandCounterIncrement(); ---- 100,106 ---- +--- 99,105 ---- SetUserIdAndContext(owner_uid, true); /* Create the schema's namespace */ @@ -3960,8 +4169,26 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s /* Advance cmd counter to make the namespace visible */ CommandCounterIncrement(); *************** RenameSchema(const char *oldname, const +*** 267,274 **** + errmsg("schema \"%s\" does not exist", oldname))); + + /* make sure the new name doesn't exist */ +! if (HeapTupleIsValid( +! SearchSysCache(NAMESPACENAME, + CStringGetDatum(newname), + 0, 0, 0))) + ereport(ERROR, +--- 272,278 ---- + errmsg("schema \"%s\" does not exist", oldname))); + + /* make sure the new name doesn't exist */ +! if (HeapTupleIsValid(SearchSysCache(NAMESPACENAME, + CStringGetDatum(newname), + 0, 0, 0))) + ereport(ERROR, +*************** RenameSchema(const char *oldname, const *** 286,291 **** ---- 292,300 ---- +--- 290,298 ---- aclcheck_error(aclresult, ACL_KIND_DATABASE, get_database_name(MyDatabaseId)); @@ -3973,7 +4200,7 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s (errcode(ERRCODE_RESERVED_NAME), *************** AlterSchemaOwner_internal(HeapTuple tup, *** 397,402 **** ---- 406,414 ---- +--- 404,412 ---- aclcheck_error(aclresult, ACL_KIND_DATABASE, get_database_name(MyDatabaseId)); @@ -3985,7 +4212,7 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s *************** AlterSchemaOwner_internal(HeapTuple tup, *** 431,433 **** ---- 443,491 ---- +--- 441,489 ---- } } @@ -3994,7 +4221,7 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s + * ALTER SCHEMA name SECURITY_LABEL [=] newlabel + */ + void -+ AlterSchemaSecLabel(const char *name, DefElem *seclabel) ++ AlterSchemaSecLabel(const char *name, DefElem *secLabel) + { + Relation rel; + HeapTuple oldtup; @@ -4021,12 +4248,12 @@ diff -Nrpc base/src/backend/commands/schemacmds.c sepgsql/src/backend/commands/s + if (!pg_namespace_ownercheck(HeapTupleGetOid(newtup), GetUserId())) + aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_NAMESPACE, name); + /* SELinux checks db_schema:{setattr relabelfrom relabelto} */ -+ secid = sepgsqlCheckSchemaRelabel(HeapTupleGetOid(newtup), seclabel); -+ if (!HeapTupleHasSecLabel(newtup)) ++ secid = sepgsqlCheckSchemaRelabel(HeapTupleGetOid(newtup), secLabel); ++ if (!HeapTupleHasSecid(newtup)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s\"", name))); -+ HeapTupleSetSecLabel(newtup, secid); ++ HeapTupleSetSecid(newtup, secid); + + simple_heap_update(rel, &newtup->t_self, newtup); + CatalogUpdateIndexes(rel, newtup); @@ -4118,8 +4345,8 @@ diff -Nrpc base/src/backend/commands/sequence.c sepgsql/src/backend/commands/seq seq = read_info(elm, seqrel, &buf); diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/tablecmds.c -*** base/src/backend/commands/tablecmds.c Fri Jun 19 13:40:37 2009 ---- sepgsql/src/backend/commands/tablecmds.c Thu Jul 16 17:22:29 2009 +*** base/src/backend/commands/tablecmds.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/commands/tablecmds.c Tue Sep 8 23:55:48 2009 *************** *** 62,67 **** --- 62,68 ---- @@ -4141,18 +4368,18 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta AttrNumber attnum; static char *validnsps[] = HEAP_RELOPT_NAMESPACES; *************** DefineRelation(CreateStmt *stmt, char re -*** 494,499 **** ---- 496,505 ---- - } - } +*** 444,449 **** +--- 446,455 ---- + localHasOids = interpretOidsOption(stmt->options); + descriptor->tdhasoid = (localHasOids || parentOidCount > 0); + /* SELinux checks db_table:{create} and db_column:{create} */ + secLabels = sepgsqlCreateTableColumns(stmt, relname, namespaceId, + descriptor, relkind); + /* - * Create the relation. Inherited defaults and constraints are passed in - * for immediate handling --- since they don't need parsing, they can be + * Find columns with default values and prepare for insertion of the + * defaults. Pre-cooked (that is, inherited) defaults go into a list of *************** DefineRelation(CreateStmt *stmt, char re *** 513,519 **** parentOidCount, @@ -4221,14 +4448,14 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta if (newrel) { Oid tupOid = InvalidOid; -+ Oid tupSecLabel = InvalidOid; ++ Oid tupSecid = InvalidOid; /* Extract data from old tuple */ heap_deform_tuple(tuple, oldTupDesc, values, isnull); if (oldTupDesc->tdhasoid) tupOid = HeapTupleGetOid(tuple); -+ if (HeapTupleHasSecLabel(tuple)) -+ tupSecLabel = HeapTupleGetSecLabel(tuple); ++ if (HeapTupleHasSecid(tuple)) ++ tupSecid = HeapTupleGetSecid(tuple); /* Set dropped attributes to null in new tuple */ foreach(lc, dropped_attrs) @@ -4238,9 +4465,9 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta /* Preserve OID, if any */ if (newTupDesc->tdhasoid) HeapTupleSetOid(tuple, tupOid); -+ /* Preserve SecLabel, if any */ -+ if (HeapTupleHasSecLabel(tuple)) -+ HeapTupleSetSecLabel(tuple, tupSecLabel); ++ /* Preserve SID, if any */ ++ if (HeapTupleHasSecid(tuple)) ++ HeapTupleSetSecid(tuple, tupSecid); } /* Now check any constraints on the possibly-changed tuple */ @@ -4445,8 +4672,8 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta typeTuple = typenameType(NULL, typename, &targettypmod); tform = (Form_pg_type) GETSTRUCT(typeTuple); *************** ATExecChangeOwner(Oid relationOid, Oid n -*** 6300,6305 **** ---- 6360,6367 ---- +*** 6308,6313 **** +--- 6368,6375 ---- aclcheck_error(aclresult, ACL_KIND_NAMESPACE, get_namespace_name(namespaceOid)); } @@ -4456,8 +4683,8 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta memset(repl_null, false, sizeof(repl_null)); *************** AlterSeqNamespaces(Relation classRel, Re -*** 7754,7759 **** ---- 7816,7943 ---- +*** 7762,7767 **** +--- 7824,7951 ---- relation_close(depRel, AccessShareLock); } @@ -4488,12 +4715,12 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta + + /* SELinux checks db_table:{setattr relabelfrom relabelto} */ + secid = sepgsqlCheckTableRelabel(relid, seclabel); -+ if (!HeapTupleHasSecLabel(newtup)) ++ if (!HeapTupleHasSecid(newtup)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s\"", + get_rel_name(relid)))); -+ HeapTupleSetSecLabel(newtup, secid); ++ HeapTupleSetSecid(newtup, secid); + + simple_heap_update(rel, &newtup->t_self, newtup); + CatalogUpdateIndexes(rel, newtup); @@ -4529,12 +4756,12 @@ diff -Nrpc base/src/backend/commands/tablecmds.c sepgsql/src/backend/commands/ta + + /* SELinux checks db_column:{setattr relabelfrom relabelto} */ + secid = sepgsqlCheckColumnRelabel(relid, attnum, seclabel); -+ if (!HeapTupleHasSecLabel(newtup)) ++ if (!HeapTupleHasSecid(newtup)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s.%s\"", + get_rel_name(relid), attname))); -+ HeapTupleSetSecLabel(newtup, secid); ++ HeapTupleSetSecid(newtup, secid); + + simple_heap_update(rel, &newtup->t_self, newtup); + CatalogUpdateIndexes(rel, newtup); @@ -4650,7 +4877,7 @@ diff -Nrpc base/src/backend/commands/tsearchcmds.c sepgsql/src/backend/commands/ diff -Nrpc base/src/backend/commands/typecmds.c sepgsql/src/backend/commands/typecmds.c *** base/src/backend/commands/typecmds.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/commands/typecmds.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/commands/typecmds.c Tue Sep 8 23:55:48 2009 *************** *** 56,61 **** --- 56,62 ---- @@ -4661,23 +4888,108 @@ diff -Nrpc base/src/backend/commands/typecmds.c sepgsql/src/backend/commands/typ #include "utils/acl.h" #include "utils/builtins.h" #include "utils/fmgroids.h" -*************** DefineType(List *names, List *parameters -*** 521,526 **** ---- 522,535 ---- - aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PROC, - NameListToString(analyzeName)); - #endif -+ /* SELinux checks db_procedure:{install} */ -+ sepgsqlCheckProcedureInstall(inputOid); -+ sepgsqlCheckProcedureInstall(outputOid); -+ sepgsqlCheckProcedureInstall(receiveOid); -+ sepgsqlCheckProcedureInstall(sendOid); -+ sepgsqlCheckProcedureInstall(typmodinOid); -+ sepgsqlCheckProcedureInstall(typmodoutOid); -+ sepgsqlCheckProcedureInstall(analyzeOid); +*************** AlterDomainDefault(List *names, Node *de +*** 1543,1548 **** +--- 1544,1551 ---- - /* Preassign array type OID so we can insert it in pg_type.typarray */ - pg_type = heap_open(TypeRelationId, AccessShareLock); + /* Check it's a domain and check user has permission for ALTER DOMAIN */ + checkDomainOwner(tup, typename); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(tup), ++ format_type_be(domainoid)); + + /* Setup new tuple */ + MemSet(new_record, (Datum) 0, sizeof(new_record)); +*************** AlterDomainNotNull(List *names, bool not +*** 1671,1676 **** +--- 1674,1681 ---- + + /* Check it's a domain and check user has permission for ALTER DOMAIN */ + checkDomainOwner(tup, typename); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(tup), ++ format_type_be(domainoid)); + + /* Is the domain already set to the desired constraint? */ + if (typTup->typnotnull == notNull) +*************** AlterDomainDropConstraint(List *names, c +*** 1772,1777 **** +--- 1777,1784 ---- + + /* Check it's a domain and check user has permission for ALTER DOMAIN */ + checkDomainOwner(tup, typename); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(tup), ++ format_type_be(domainoid)); + + /* Grab an appropriate lock on the pg_constraint relation */ + conrel = heap_open(ConstraintRelationId, RowExclusiveLock); +*************** AlterDomainAddConstraint(List *names, No +*** 1848,1853 **** +--- 1855,1862 ---- + + /* Check it's a domain and check user has permission for ALTER DOMAIN */ + checkDomainOwner(tup, typename); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(tup), ++ format_type_be(domainoid)); + + /* Check for unsupported constraint types */ + if (IsA(newConstraint, FkConstraint)) +*************** RenameType(List *names, const char *newT +*** 2470,2475 **** +--- 2479,2490 ---- + aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_TYPE, + format_type_be(typeOid)); + ++ /* SELinux check permission */ ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(tup), ++ format_type_be(typeOid)); ++ sepgsqlCheckSchemaRemoveName(typTup->typnamespace); ++ sepgsqlCheckSchemaAddName(typTup->typnamespace); ++ + /* + * If it's a composite type, we need to check that it really is a + * free-standing composite type, and not a table's rowtype. We want people +*************** AlterTypeOwner(List *names, Oid newOwner +*** 2590,2595 **** +--- 2605,2613 ---- + aclcheck_error(aclresult, ACL_KIND_NAMESPACE, + get_namespace_name(typTup->typnamespace)); + } ++ /* SELinux checks permissions */ ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(tup), ++ format_type_be(HeapTupleGetOid(tup))); + + /* + * If it's a composite type, invoke ATExecChangeOwner so that we fix +*************** void +*** 2680,2685 **** +--- 2698,2704 ---- + AlterTypeNamespace(List *names, const char *newschema) + { + TypeName *typename; ++ HeapTuple typtup; + Oid typeOid; + Oid nspOid; + Oid elemOid; +*************** AlterTypeNamespace(List *names, const ch +*** 2706,2711 **** +--- 2725,2742 ---- + errhint("You can alter type %s, which will alter the array type as well.", + format_type_be(elemOid)))); + ++ /* SELinux checks permissions */ ++ typtup = SearchSysCache(TYPEOID, ++ ObjectIdGetDatum(typeOid), ++ 0, 0, 0); ++ if (!HeapTupleIsValid(typtup)) ++ elog(ERROR, "cache lookup failed for type: %u", typeOid); ++ sepgsqlCheckSysobjSetattr(TypeRelationId, HeapTupleGetSecid(typtup), ++ format_type_be(typeOid)); ++ sepgsqlCheckSchemaRemoveName(((Form_pg_type) GETSTRUCT(typtup))->typnamespace); ++ sepgsqlCheckSchemaAddName(nspOid); ++ ReleaseSysCache(typtup); ++ + /* and do the work */ + AlterTypeNamespaceInternal(typeOid, nspOid, false, true); + } diff -Nrpc base/src/backend/executor/execJunk.c sepgsql/src/backend/executor/execJunk.c *** base/src/backend/executor/execJunk.c Sat Jan 3 13:01:35 2009 --- sepgsql/src/backend/executor/execJunk.c Wed Jul 15 19:30:50 2009 @@ -4718,7 +5030,7 @@ diff -Nrpc base/src/backend/executor/execJunk.c sepgsql/src/backend/executor/exe * Use the given slot, or make a new slot if we weren't given one. diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/execMain.c *** base/src/backend/executor/execMain.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/executor/execMain.c Wed Jul 15 19:39:56 2009 +--- sepgsql/src/backend/executor/execMain.c Wed Sep 9 16:47:01 2009 *************** *** 39,44 **** --- 39,45 ---- @@ -4789,7 +5101,7 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe j = ExecInitJunkFilter(subplan->plan->targetlist, ! RelationGetDescr(resultRel)->tdhasoid, -! RelationGetDescr(resultRel)->tdhasseclabel, +! RelationGetDescr(resultRel)->tdhassecid, ! ExecAllocTableSlot(estate->es_tupleTable)); /* * Since it must be UPDATE/DELETE, there had better be a @@ -4800,7 +5112,7 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe j = ExecInitJunkFilter(planstate->plan->targetlist, tupType->tdhasoid, -+ tupType->tdhasseclabel, ++ tupType->tdhassecid, ExecAllocTableSlot(estate->es_tupleTable)); estate->es_junkFilter = j; if (estate->es_result_relation_info) @@ -4828,17 +5140,17 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe } + /* -+ * ExecContextForcesSecLabel ++ * ExecContextForcesSecids + * -+ * We need to ensure that result tuples have space for security label, ++ * We need to ensure that result tuples have space for security identifier. + * if the security feature need to store it within the given relation. + */ -+ bool ExecContextForcesSecLabel(PlanState *planstate, bool *hassecurity) ++ bool ExecContextForcesSecids(PlanState *planstate, bool *hassecid) + { + if (planstate->state->es_select_into) + { -+ *hassecurity = securityTupleDescHasSecLabel(InvalidOid, -+ RELKIND_RELATION); ++ *hassecid = securityTupleDescHasSecid(InvalidOid, ++ RELKIND_RELATION); + return true; + } + else @@ -4850,7 +5162,7 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe + Oid relid = RelationGetRelid(ri->ri_RelationDesc); + char relkind = RelationGetForm(ri->ri_RelationDesc)->relkind; + -+ *hassecurity = securityTupleDescHasSecLabel(relid, relkind); ++ *hassecid = securityTupleDescHasSecid(relid, relkind); + + return true; + } @@ -4883,7 +5195,7 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe + bool isnull; + + /* for Security Label */ -+ attno = ExecFindJunkAttribute(junkfilter, SecurityLabelAttributeName); ++ attno = ExecFindJunkAttribute(junkfilter, SecurityAttributeName); + if (attno != InvalidAttrNumber) + { + datum = ExecGetJunkAttribute(slot, attno, &isnull); @@ -4891,7 +5203,7 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set NULL on \"%s\"", -+ SecurityLabelAttributeName))); ++ SecurityAttributeName))); + *tts_seclabel = datum; + } + } @@ -4907,16 +5219,16 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe + { + char *seclabel = TextDatumGetCString(slot->tts_seclabel); + -+ if (!HeapTupleHasSecLabel(tuple)) ++ if (!HeapTupleHasSecid(tuple)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to assign security label on \"%s\"", + RelationGetRelationName(rel)))); + secid = securityTransSecLabelIn(relid, seclabel); -+ HeapTupleSetSecLabel(tuple, secid); ++ HeapTupleSetSecid(tuple, secid); + } -+ else if (HeapTupleHasSecLabel(tuple)) -+ HeapTupleSetSecLabel(tuple, InvalidOid); ++ else if (HeapTupleHasSecid(tuple)) ++ HeapTupleSetSecid(tuple, InvalidOid); + } + /* ---------------------------------------------------------------- @@ -5074,9 +5386,42 @@ diff -Nrpc base/src/backend/executor/execMain.c sepgsql/src/backend/executor/exe heap_insert(myState->rel, tuple, myState->estate->es_output_cid, +diff -Nrpc base/src/backend/executor/execQual.c sepgsql/src/backend/executor/execQual.c +*** base/src/backend/executor/execQual.c Thu Jun 18 10:20:52 2009 +--- sepgsql/src/backend/executor/execQual.c Tue Sep 8 17:13:41 2009 +*************** +*** 47,52 **** +--- 47,53 ---- + #include "nodes/nodeFuncs.h" + #include "optimizer/planner.h" + #include "pgstat.h" ++ #include "security/sepgsql.h" + #include "utils/acl.h" + #include "utils/builtins.h" + #include "utils/lsyscache.h" +*************** init_fcache(Oid foid, FuncExprState *fca +*** 1034,1039 **** +--- 1035,1041 ---- + aclresult = pg_proc_aclcheck(foid, GetUserId(), ACL_EXECUTE); + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, get_func_name(foid)); ++ sepgsqlCheckProcedureExecute(foid); + + /* + * Safety check on nargs. Under normal circumstances this should never +*************** ExecEvalArrayCoerceExpr(ArrayCoerceExprS +*** 4032,4037 **** +--- 4034,4040 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(acoerce->elemfuncid)); ++ sepgsqlCheckProcedureExecute(acoerce->elemfuncid); + + /* Set up the primary fmgr lookup information */ + fmgr_info_cxt(acoerce->elemfuncid, &(astate->elemfunc), diff -Nrpc base/src/backend/executor/execScan.c sepgsql/src/backend/executor/execScan.c *** base/src/backend/executor/execScan.c Thu Apr 9 00:13:21 2009 ---- sepgsql/src/backend/executor/execScan.c Wed Jul 15 19:39:56 2009 +--- sepgsql/src/backend/executor/execScan.c Wed Sep 9 13:14:37 2009 *************** *** 20,25 **** --- 20,26 ---- @@ -5150,7 +5495,7 @@ diff -Nrpc base/src/backend/executor/execScan.c sepgsql/src/backend/executor/exe int numattrs = tupdesc->natts; int attrno; bool hasoid; -+ bool hasseclabel; ++ bool hassecid; ListCell *tlist_item = list_head(tlist); /* Check the tlist attributes */ @@ -5172,22 +5517,22 @@ diff -Nrpc base/src/backend/executor/execScan.c sepgsql/src/backend/executor/exe return false; /* tlist too long */ /* -! * If the plan context requires a particular hasoid or hasseclabel setting, +! * If the plan context requires a particular hasoid or hassecid setting, ! * then that has to match, too. */ if (ExecContextForcesOids(ps, &hasoid) && hasoid != tupdesc->tdhasoid) return false; -+ if (ExecContextForcesSecLabel(ps, &hasseclabel) && -+ hasseclabel != tupdesc->tdhasseclabel) ++ if (ExecContextForcesSecids(ps, &hassecid) && ++ hassecid != tupdesc->tdhassecid) + return false; + return true; } diff -Nrpc base/src/backend/executor/execTuples.c sepgsql/src/backend/executor/execTuples.c *** base/src/backend/executor/execTuples.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/executor/execTuples.c Wed Jul 15 19:30:50 2009 +--- sepgsql/src/backend/executor/execTuples.c Wed Sep 9 13:14:37 2009 *************** *** 100,106 **** @@ -5220,9 +5565,9 @@ diff -Nrpc base/src/backend/executor/execTuples.c sepgsql/src/backend/executor/e * ---------------------------------------------------------------- */ TupleDesc -! ExecTypeFromTL(List *targetList, bool hasoid, bool hasseclabel) +! ExecTypeFromTL(List *targetList, bool hasoid, bool hassecid) { -! return ExecTypeFromTLInternal(targetList, hasoid, hasseclabel, false); +! return ExecTypeFromTLInternal(targetList, hasoid, hassecid, false); } /* ---------------------------------------------------------------- @@ -5245,14 +5590,14 @@ diff -Nrpc base/src/backend/executor/execTuples.c sepgsql/src/backend/executor/e * ---------------------------------------------------------------- */ TupleDesc -! ExecCleanTypeFromTL(List *targetList, bool hasoid, bool hasseclabel) +! ExecCleanTypeFromTL(List *targetList, bool hasoid, bool hassecid) { -! return ExecTypeFromTLInternal(targetList, hasoid, hasseclabel, true); +! return ExecTypeFromTLInternal(targetList, hasoid, hassecid, true); } static TupleDesc ! ExecTypeFromTLInternal(List *targetList, bool hasoid, -! bool hasseclabel, bool skipjunk) +! bool hassecid, bool skipjunk) { TupleDesc typeInfo; ListCell *l; @@ -5262,25 +5607,25 @@ diff -Nrpc base/src/backend/executor/execTuples.c sepgsql/src/backend/executor/e else len = ExecTargetListLength(targetList); typeInfo = CreateTemplateTupleDesc(len, hasoid); -+ typeInfo->tdhasseclabel = hasseclabel; ++ typeInfo->tdhassecid = hassecid; foreach(l, targetList) { diff -Nrpc base/src/backend/executor/execUtils.c sepgsql/src/backend/executor/execUtils.c -*** base/src/backend/executor/execUtils.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/executor/execUtils.c Wed Jul 15 19:30:50 2009 +*** base/src/backend/executor/execUtils.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/executor/execUtils.c Wed Sep 9 13:14:37 2009 *************** void -*** 506,511 **** ---- 506,512 ---- +*** 512,517 **** +--- 512,518 ---- ExecAssignResultTypeFromTL(PlanState *planstate) { bool hasoid; -+ bool hasseclabel; ++ bool hassecid; TupleDesc tupDesc; if (ExecContextForcesOids(planstate, &hasoid)) *************** ExecAssignResultTypeFromTL(PlanState *pl -*** 518,529 **** +*** 524,535 **** hasoid = false; } @@ -5293,19 +5638,19 @@ diff -Nrpc base/src/backend/executor/execUtils.c sepgsql/src/backend/executor/ex ExecAssignResultType(planstate, tupDesc); } ---- 519,533 ---- +--- 525,539 ---- hasoid = false; } -+ if (!ExecContextForcesSecLabel(planstate, &hasseclabel)) -+ hasseclabel = false; ++ if (!ExecContextForcesSecids(planstate, &hassecid)) ++ hassecid = false; + /* * ExecTypeFromTL needs the parse-time representation of the tlist, not a * list of ExprStates. This is good because some plan nodes don't bother * to set up planstate->targetlist ... */ -! tupDesc = ExecTypeFromTL(planstate->plan->targetlist, hasoid, hasseclabel); +! tupDesc = ExecTypeFromTL(planstate->plan->targetlist, hasoid, hassecid); ExecAssignResultType(planstate, tupDesc); } @@ -5363,6 +5708,72 @@ diff -Nrpc base/src/backend/executor/functions.c sepgsql/src/backend/executor/fu return true; } Assert(tupdesc); +diff -Nrpc base/src/backend/executor/nodeAgg.c sepgsql/src/backend/executor/nodeAgg.c +*** base/src/backend/executor/nodeAgg.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/executor/nodeAgg.c Mon Sep 7 00:55:45 2009 +*************** +*** 81,86 **** +--- 81,87 ---- + #include "parser/parse_agg.h" + #include "parser/parse_coerce.h" + #include "parser/parse_oper.h" ++ #include "security/sepgsql.h" + #include "utils/acl.h" + #include "utils/builtins.h" + #include "utils/lsyscache.h" +*************** ExecInitAgg(Agg *node, EState *estate, i +*** 1431,1436 **** +--- 1432,1438 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(aggref->aggfnoid)); ++ sepgsqlCheckProcedureExecute(aggref->aggfnoid); + + peraggstate->transfn_oid = transfn_oid = aggform->aggtransfn; + peraggstate->finalfn_oid = finalfn_oid = aggform->aggfinalfn; +*************** ExecInitAgg(Agg *node, EState *estate, i +*** 1454,1459 **** +--- 1456,1462 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(transfn_oid)); ++ sepgsqlCheckProcedureExecute(transfn_oid); + if (OidIsValid(finalfn_oid)) + { + aclresult = pg_proc_aclcheck(finalfn_oid, aggOwner, +*************** ExecInitAgg(Agg *node, EState *estate, i +*** 1461,1466 **** +--- 1464,1470 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(finalfn_oid)); ++ sepgsqlCheckProcedureExecute(finalfn_oid); + } + } + +diff -Nrpc base/src/backend/executor/nodeMergejoin.c sepgsql/src/backend/executor/nodeMergejoin.c +*** base/src/backend/executor/nodeMergejoin.c Thu Jun 18 10:20:52 2009 +--- sepgsql/src/backend/executor/nodeMergejoin.c Mon Sep 7 00:55:45 2009 +*************** +*** 98,103 **** +--- 98,104 ---- + #include "executor/execdefs.h" + #include "executor/nodeMergejoin.h" + #include "miscadmin.h" ++ #include "security/sepgsql.h" + #include "utils/acl.h" + #include "utils/lsyscache.h" + #include "utils/memutils.h" +*************** MJExamineQuals(List *mergeclauses, +*** 215,220 **** +--- 216,222 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(cmpproc)); ++ sepgsqlCheckProcedureExecute(cmpproc); + + /* Set up the fmgr lookup information */ + fmgr_info(cmpproc, &(clause->cmpfinfo)); diff -Nrpc base/src/backend/executor/nodeSubplan.c sepgsql/src/backend/executor/nodeSubplan.c *** base/src/backend/executor/nodeSubplan.c Thu Jun 18 10:20:52 2009 --- sepgsql/src/backend/executor/nodeSubplan.c Wed Jul 15 19:30:50 2009 @@ -5400,17 +5811,60 @@ diff -Nrpc base/src/backend/executor/nodeSubplan.c sepgsql/src/backend/executor/ slot = ExecAllocTableSlot(tupTable); ExecSetSlotDescriptor(slot, tupDesc); sstate->projRight = ExecBuildProjectionInfo(righttlist, +diff -Nrpc base/src/backend/executor/nodeWindowAgg.c sepgsql/src/backend/executor/nodeWindowAgg.c +*** base/src/backend/executor/nodeWindowAgg.c Tue Jun 23 11:09:47 2009 +--- sepgsql/src/backend/executor/nodeWindowAgg.c Mon Sep 7 00:55:45 2009 +*************** +*** 43,48 **** +--- 43,49 ---- + #include "optimizer/clauses.h" + #include "parser/parse_agg.h" + #include "parser/parse_coerce.h" ++ #include "security/sepgsql.h" + #include "utils/acl.h" + #include "utils/builtins.h" + #include "utils/datum.h" +*************** ExecInitWindowAgg(WindowAgg *node, EStat +*** 1224,1229 **** +--- 1225,1231 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(wfunc->winfnoid)); ++ sepgsqlCheckProcedureExecute(wfunc->winfnoid); + + /* Fill in the perfuncstate data */ + perfuncstate->wfuncstate = wfuncstate; +*************** initialize_peragg(WindowAggState *winsta +*** 1418,1423 **** +--- 1420,1426 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(transfn_oid)); ++ sepgsqlCheckProcedureExecute(transfn_oid); + if (OidIsValid(finalfn_oid)) + { + aclresult = pg_proc_aclcheck(finalfn_oid, aggOwner, +*************** initialize_peragg(WindowAggState *winsta +*** 1425,1430 **** +--- 1428,1434 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(finalfn_oid)); ++ sepgsqlCheckProcedureExecute(finalfn_oid); + } + } + diff -Nrpc base/src/backend/executor/spi.c sepgsql/src/backend/executor/spi.c *** base/src/backend/executor/spi.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/executor/spi.c Wed Jul 15 19:30:50 2009 +--- sepgsql/src/backend/executor/spi.c Tue Sep 8 23:55:48 2009 *************** SPI_modifytuple(Relation rel, HeapTuple *** 705,710 **** --- 705,712 ---- mtuple->t_tableOid = tuple->t_tableOid; if (rel->rd_att->tdhasoid) HeapTupleSetOid(mtuple, HeapTupleGetOid(tuple)); -+ if (HeapTupleHasSecLabel(mtuple)) -+ HeapTupleSetSecLabel(mtuple, HeapTupleGetSecLabel(tuple)); ++ if (HeapTupleHasSecid(mtuple)) ++ HeapTupleSetSecid(mtuple, HeapTupleGetSecid(tuple)); } else { @@ -5737,8 +6191,8 @@ diff -Nrpc base/src/backend/nodes/outfuncs.c sepgsql/src/backend/nodes/outfuncs. static void diff -Nrpc base/src/backend/optimizer/plan/createplan.c sepgsql/src/backend/optimizer/plan/createplan.c -*** base/src/backend/optimizer/plan/createplan.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/optimizer/plan/createplan.c Wed Jul 15 19:39:56 2009 +*** base/src/backend/optimizer/plan/createplan.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/optimizer/plan/createplan.c Sun Sep 6 19:53:10 2009 *************** create_scan_plan(PlannerInfo *root, Path *** 305,310 **** --- 305,313 ---- @@ -5753,7 +6207,7 @@ diff -Nrpc base/src/backend/optimizer/plan/createplan.c sepgsql/src/backend/opti * gating Result node that evaluates the pseudoconstants as one-time diff -Nrpc base/src/backend/optimizer/util/clauses.c sepgsql/src/backend/optimizer/util/clauses.c *** base/src/backend/optimizer/util/clauses.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/optimizer/util/clauses.c Wed Jul 15 19:35:52 2009 +--- sepgsql/src/backend/optimizer/util/clauses.c Mon Sep 7 00:55:45 2009 *************** *** 38,43 **** --- 38,44 ---- @@ -5770,7 +6224,7 @@ diff -Nrpc base/src/backend/optimizer/util/clauses.c sepgsql/src/backend/optimiz funcform->prosecdef || funcform->proretset || !heap_attisnull(func_tuple, Anum_pg_proc_proconfig) || -+ !sepgsqlAllowFunctionInlined(func_tuple) || ++ !sepgsqlHintProcedureInlined(func_tuple) || funcform->pronargs != list_length(args)) return NULL; @@ -5780,7 +6234,7 @@ diff -Nrpc base/src/backend/optimizer/util/clauses.c sepgsql/src/backend/optimiz funcform->prosecdef || !funcform->proretset || !heap_attisnull(func_tuple, Anum_pg_proc_proconfig) || -+ !sepgsqlAllowFunctionInlined(func_tuple) || ++ !sepgsqlHintProcedureInlined(func_tuple) || funcform->pronargs != list_length(fexpr->args)) { ReleaseSysCache(func_tuple); @@ -5808,8 +6262,8 @@ diff -Nrpc base/src/backend/optimizer/util/relnode.c sepgsql/src/backend/optimiz /* Check type of rtable entry */ switch (rte->rtekind) diff -Nrpc base/src/backend/parser/analyze.c sepgsql/src/backend/parser/analyze.c -*** base/src/backend/parser/analyze.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/parser/analyze.c Wed Jul 15 19:38:52 2009 +*** base/src/backend/parser/analyze.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/parser/analyze.c Sun Sep 6 19:53:10 2009 *************** *** 25,30 **** --- 25,31 ---- @@ -5889,8 +6343,8 @@ diff -Nrpc base/src/backend/parser/analyze.c sepgsql/src/backend/parser/analyze. /* * transformSelectStmt - *************** transformSelectStmt(ParseState *pstate, -*** 871,876 **** ---- 914,920 ---- +*** 872,877 **** +--- 915,921 ---- if (stmt->intoClause) { qry->intoClause = stmt->intoClause; @@ -5899,8 +6353,8 @@ diff -Nrpc base/src/backend/parser/analyze.c sepgsql/src/backend/parser/analyze. applyColumnNames(qry->targetList, stmt->intoClause->colNames); } diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y -*** base/src/backend/parser/gram.y Fri Jun 19 13:40:37 2009 ---- sepgsql/src/backend/parser/gram.y Wed Jul 15 19:37:35 2009 +*** base/src/backend/parser/gram.y Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/parser/gram.y Tue Sep 8 17:13:41 2009 *************** *** 58,63 **** --- 58,64 ---- @@ -5934,7 +6388,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y %type OptTableSpace OptConsTableSpace OptTableSpaceOwner %type opt_check_option -+ %type OptSecLabel SecLabelItem ++ %type OptSecCxt SecCxtItem + %type xml_attribute_el %type xml_attribute_list xml_attributes @@ -5962,7 +6416,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y *****************************************************************************/ CreateSchemaStmt: -! CREATE SCHEMA OptSchemaName AUTHORIZATION RoleId OptSecLabel OptSchemaEltList +! CREATE SCHEMA OptSchemaName AUTHORIZATION RoleId OptSecCxt OptSchemaEltList { CreateSchemaStmt *n = makeNode(CreateSchemaStmt); /* One can omit the schema name or the authorization id. */ @@ -5992,7 +6446,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y ! n->schemaElts = $7; $$ = (Node *)n; } -! | CREATE SCHEMA ColId OptSecLabel OptSchemaEltList +! | CREATE SCHEMA ColId OptSecCxt OptSchemaEltList { CreateSchemaStmt *n = makeNode(CreateSchemaStmt); /* ...but not both */ @@ -6016,7 +6470,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y *****************************************************************************/ CreateStmt: CREATE OptTemp TABLE qualified_name '(' OptTableElementList ')' -! OptInherit OptWith OnCommitOption OptTableSpace OptSecLabel +! OptInherit OptWith OnCommitOption OptTableSpace OptSecCxt { CreateStmt *n = makeNode(CreateStmt); $4->istemp = $2; @@ -6040,7 +6494,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y $$ = (Node *)n; } | CREATE OptTemp TABLE qualified_name OF qualified_name -! '(' OptTableElementList ')' OptWith OnCommitOption OptTableSpace OptSecLabel +! '(' OptTableElementList ')' OptWith OnCommitOption OptTableSpace OptSecCxt { /* SQL99 CREATE TABLE OF (cols) seems to be satisfied * by our inheritance capabilities. Let's try it... @@ -6073,7 +6527,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y | TableConstraint { $$ = $1; } ; -! columnDef: ColId Typename ColQualList OptSecLabel +! columnDef: ColId Typename ColQualList OptSecCxt { ColumnDef *n = makeNode(ColumnDef); n->colname = $1; @@ -6102,7 +6556,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y *****************************************************************************/ CreateSeqStmt: -! CREATE OptTemp SEQUENCE qualified_name OptSeqOptList OptSecLabel +! CREATE OptTemp SEQUENCE qualified_name OptSeqOptList OptSecCxt { CreateSeqStmt *n = makeNode(CreateSeqStmt); $4->istemp = $2; @@ -6118,7 +6572,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y { $$ = makeDefElem("window", (Node *)makeInteger(TRUE)); } -+ | SecLabelItem ++ | SecCxtItem + { + $$ = $1; + } @@ -6127,17 +6581,17 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y $$ = $1; *************** AlterOwnerStmt: ALTER AGGREGATE func_nam *** 5591,5596 **** ---- 5605,5679 ---- +--- 5605,5680 ---- } ; + /***************************************************************************** + * -+ * ALTER THING name SECURITY_LABEL [=] ++ * ALTER THING name SECURITY_CONTEXT [=] + * + *****************************************************************************/ + -+ AlterSecLabelStmt: ALTER DATABASE database_name SecLabelItem ++ AlterSecLabelStmt: ALTER DATABASE database_name SecCxtItem + { + AlterSecLabelStmt *n = makeNode(AlterSecLabelStmt); + n->objectType = OBJECT_DATABASE; @@ -6145,7 +6599,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y + n->secLabel = (Node *)$4; + $$ = (Node *) n; + } -+ | ALTER SCHEMA name SecLabelItem ++ | ALTER SCHEMA name SecCxtItem + { + AlterSecLabelStmt *n = makeNode(AlterSecLabelStmt); + n->objectType = OBJECT_SCHEMA; @@ -6153,7 +6607,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y + n->secLabel = (Node *)$4; + $$ = (Node *) n; + } -+ | ALTER TABLE relation_expr SecLabelItem ++ | ALTER TABLE relation_expr SecCxtItem + { + AlterSecLabelStmt *n = makeNode(AlterSecLabelStmt); + n->objectType = OBJECT_TABLE; @@ -6161,7 +6615,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y + n->secLabel = (Node *)$4; + $$ = (Node *) n; + } -+ | ALTER TABLE relation_expr ALTER opt_column ColId SecLabelItem ++ | ALTER TABLE relation_expr ALTER opt_column ColId SecCxtItem + { + AlterSecLabelStmt *n = makeNode(AlterSecLabelStmt); + n->objectType = OBJECT_COLUMN; @@ -6170,7 +6624,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y + n->secLabel = (Node *)$7; + $$ = (Node *) n; + } -+ | ALTER SEQUENCE relation_expr SecLabelItem ++ | ALTER SEQUENCE relation_expr SecCxtItem + { + AlterSecLabelStmt *n = makeNode(AlterSecLabelStmt); + n->objectType = OBJECT_SEQUENCE; @@ -6178,7 +6632,7 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y + n->secLabel = (Node *)$4; + $$ = (Node *) n; + } -+ | ALTER FUNCTION function_with_argtypes SecLabelItem ++ | ALTER FUNCTION function_with_argtypes SecCxtItem + { + AlterSecLabelStmt *n = makeNode(AlterSecLabelStmt); + n->objectType = OBJECT_FUNCTION; @@ -6189,27 +6643,28 @@ diff -Nrpc base/src/backend/parser/gram.y sepgsql/src/backend/parser/gram.y + } + ; + -+ OptSecLabel: SecLabelItem { $$ = $1; } -+ | /* EMPTY */ { $$ = NULL; } -+ ; ++ OptSecCxt: SecCxtItem { $$ = $1; } ++ | /* EMPTY */ { $$ = NULL; } ++ ; + -+ SecLabelItem: IDENT opt_equal Sconst ++ SecCxtItem: IDENT opt_equal Sconst + { -+ if (strcmp("security_label", $1) != 0) ++ if (strcmp("security_context", $1) != 0) + yyerror("syntax error"); + $$ = makeDefElem($1, (Node *) makeString($3)); + } -+ ; ++ ; ++ /***************************************************************************** * *************** createdb_opt_item: *** 6033,6038 **** ---- 6116,6125 ---- +--- 6117,6126 ---- { $$ = makeDefElem("owner", NULL); } -+ | SecLabelItem ++ | SecCxtItem + { + $$ = $1; + } @@ -6358,8 +6813,8 @@ diff -Nrpc base/src/backend/parser/parse_target.c sepgsql/src/backend/parser/par /* * Check for duplicates, but only of whole columns --- we allow diff -Nrpc base/src/backend/postmaster/autovacuum.c sepgsql/src/backend/postmaster/autovacuum.c -*** base/src/backend/postmaster/autovacuum.c Fri Jun 19 13:40:37 2009 ---- sepgsql/src/backend/postmaster/autovacuum.c Thu Jul 16 17:22:29 2009 +*** base/src/backend/postmaster/autovacuum.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/postmaster/autovacuum.c Sun Sep 6 19:53:10 2009 *************** do_autovacuum(void) *** 2004,2010 **** object.classId = RelationRelationId; @@ -6378,8 +6833,8 @@ diff -Nrpc base/src/backend/postmaster/autovacuum.c sepgsql/src/backend/postmast else { diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmaster/postmaster.c -*** base/src/backend/postmaster/postmaster.c Tue Jun 30 01:26:47 2009 ---- sepgsql/src/backend/postmaster/postmaster.c Wed Jul 15 19:35:52 2009 +*** base/src/backend/postmaster/postmaster.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/postmaster/postmaster.c Sun Sep 6 19:53:10 2009 *************** *** 108,113 **** --- 108,114 ---- @@ -6409,8 +6864,8 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast /* Startup/shutdown state */ #define NoShutdown 0 *************** ServerLoop(void) -*** 1393,1398 **** ---- 1395,1404 ---- +*** 1436,1441 **** +--- 1438,1447 ---- if (PgStatPID == 0 && pmState == PM_RUN) PgStatPID = pgstat_start(); @@ -6418,12 +6873,12 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast + if (sepgsqlWorkerPID == 0 && pmState == PM_RUN) + sepgsqlWorkerPID = sepgsqlStartupWorkerProcess(); + - /* - * Touch the socket and lock file every 58 minutes, to ensure that - * they are not removed by overzealous /tmp-cleaning tasks. We assume + /* If we need to signal the autovacuum launcher, do so now */ + if (avlauncher_needs_signal) + { *************** SIGHUP_handler(SIGNAL_ARGS) -*** 2002,2007 **** ---- 2008,2015 ---- +*** 2053,2058 **** +--- 2059,2066 ---- signal_child(SysLoggerPID, SIGHUP); if (PgStatPID != 0) signal_child(PgStatPID, SIGHUP); @@ -6433,8 +6888,8 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast /* Reload authentication config files too */ if (!load_hba()) *************** pmdie(SIGNAL_ARGS) -*** 2062,2067 **** ---- 2070,2078 ---- +*** 2113,2118 **** +--- 2121,2129 ---- /* and the walwriter too */ if (WalWriterPID != 0) signal_child(WalWriterPID, SIGTERM); @@ -6445,8 +6900,8 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast } *************** pmdie(SIGNAL_ARGS) -*** 2108,2113 **** ---- 2119,2127 ---- +*** 2160,2165 **** +--- 2171,2179 ---- /* and the walwriter too */ if (WalWriterPID != 0) signal_child(WalWriterPID, SIGTERM); @@ -6457,8 +6912,8 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast } *************** pmdie(SIGNAL_ARGS) -*** 2141,2146 **** ---- 2155,2162 ---- +*** 2193,2198 **** +--- 2207,2214 ---- signal_child(PgArchPID, SIGQUIT); if (PgStatPID != 0) signal_child(PgStatPID, SIGQUIT); @@ -6468,8 +6923,8 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast break; } *************** reaper(SIGNAL_ARGS) -*** 2403,2408 **** ---- 2419,2434 ---- +*** 2455,2460 **** +--- 2471,2486 ---- continue; } @@ -6487,8 +6942,8 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast * Else do standard backend child cleanup. */ *************** HandleChildCrash(int pid, int exitstatus -*** 2594,2599 **** ---- 2620,2637 ---- +*** 2646,2651 **** +--- 2672,2689 ---- signal_child(AutoVacPID, (SendStop ? SIGSTOP : SIGQUIT)); } @@ -6508,7 +6963,7 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast * Force a power-cycle of the pgarch process too. (This isn't absolutely * necessary, but it seems like a good idea for robustness, and it *************** PostmasterStateMachine(void) -*** 2726,2732 **** +*** 2778,2784 **** StartupPID == 0 && (BgWriterPID == 0 || !FatalError) && WalWriterPID == 0 && @@ -6516,7 +6971,7 @@ diff -Nrpc base/src/backend/postmaster/postmaster.c sepgsql/src/backend/postmast { if (FatalError) { ---- 2764,2771 ---- +--- 2816,2823 ---- StartupPID == 0 && (BgWriterPID == 0 || !FatalError) && WalWriterPID == 0 && @@ -6695,10 +7150,10 @@ diff -Nrpc base/src/backend/security/sepgsql/Makefile sepgsql/src/backend/securi + include $(top_srcdir)/src/backend/common.mk diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/sepgsql/avc.c *** base/src/backend/security/sepgsql/avc.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/avc.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/security/sepgsql/avc.c Wed Sep 9 17:45:12 2009 *************** *** 0 **** ---- 1,889 ---- +--- 1,894 ---- + /* + * src/backend/security/sepgsql/avc.c + * SE-PostgreSQL userspace access vector cache @@ -6746,12 +7201,6 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + #define AVC_HASH_NUM_SLOTS 256 + #define AVC_HASH_NUM_NODES 180 + -+ typedef struct -+ { -+ Oid relid; -+ Oid secid; -+ } sepgsql_sid_t; -+ + #define AVC_DATUM_NSID_SLOTS 19 + typedef struct + { @@ -6842,6 +7291,26 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + } + + /* ++ * sepgsqlAvcReset ++ * ++ * It invalidate access vector cache. It has to be called on errors, ++ * because avc entries for newly created context is uncertain whether ++ * it is still valid, or not. ++ */ ++ void ++ sepgsqlAvcReset(void) ++ { ++ if (!sepgsqlIsEnabled()) ++ return; ++ ++ MemoryContextReset(AvcMemCtx); ++ ++ current_page = NULL; ++ ++ sepgsqlAvcSwitchClient(sepgsqlGetClientLabel()); ++ } ++ ++ /* + * sepgsqlAvcCheckValid + * + * It checks whether the current AVC pages are valid, or not. @@ -7058,7 +7527,7 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + (hash_uint32((trelid) ^ (tsecid) ^ ((tclass) << 3))) + + static avc_datum * -+ sepgsqlAvcMakeEntry(avc_page *page, Oid relid, Oid secid, uint16 tclass) ++ sepgsqlAvcMakeEntry(avc_page *page, sepgsql_sid_t tsid, uint16 tclass) + { + security_context_t scontext, tcontext, ncontext; + security_class_t tclass_ex; @@ -7067,11 +7536,11 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + avc_datum *cache; + uint32 hash_key, index; + -+ hash_key = avc_hash_key(relid, secid, tclass); ++ hash_key = avc_hash_key(tsid.relid, tsid.secid, tclass); + index = hash_key % AVC_HASH_NUM_SLOTS; + + scontext = page->scontext; -+ tcontext = securityRawSecLabelOut(relid, secid); ++ tcontext = securityRawSecLabelOut(tsid.relid, tsid.secid); + + /* + * Compute SELinux permission @@ -7129,8 +7598,8 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + + cache->hash_key = hash_key; + cache->tclass = tclass; -+ cache->tsid.relid = relid; -+ cache->tsid.secid = secid; ++ cache->tsid.relid = tsid.relid; ++ cache->tsid.secid = tsid.secid; + /* cache->nsid shall be set later */ + + cache->allowed = avd.allowed; @@ -7160,13 +7629,13 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + * It lookups required AVC entry. + */ + static avc_datum * -+ sepgsqlAvcLookup(avc_page *page, Oid trelid, Oid tsecid, uint16 tclass) ++ sepgsqlAvcLookup(avc_page *page, sepgsql_sid_t tsid, uint16 tclass) + { + avc_datum *cache = NULL; + uint32 hash_key, index; + ListCell *l; + -+ hash_key = avc_hash_key(trelid, tsecid, tclass); ++ hash_key = avc_hash_key(tsid.relid, tsid.secid, tclass); + index = hash_key % AVC_HASH_NUM_SLOTS; + + foreach (l, page->slot[index]) @@ -7174,8 +7643,8 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + cache = lfirst(l); + if (cache->hash_key == hash_key + && cache->tclass == tclass -+ && cache->tsid.relid == trelid -+ && cache->tsid.secid == tsecid) ++ && cache->tsid.relid == tsid.relid ++ && cache->tsid.secid == tsid.secid) + { + cache->hot_cache = true; + return cache; @@ -7235,23 +7704,24 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + + /* + * sepgsqlClientHasPerms -+ * checks client's privileges on given objects via uAVC. ++ * ++ * It checks client's privileges on the given object using avc. + */ + bool -+ sepgsqlClientHasPermsSid(Oid relid, Oid secid, -+ uint16 tclass, uint32 required, -+ const char *audit_name, bool abort) ++ sepgsqlClientHasPerms(sepgsql_sid_t tsid, ++ uint16 tclass, uint32 required, ++ const char *audit_name, bool abort) + { -+ avc_datum *cache; ++ avc_datum *cache; + uint32 denied, audited; + bool result = true; + + Assert(required != 0); + + do { -+ cache = sepgsqlAvcLookup(current_page, relid, secid, tclass); ++ cache = sepgsqlAvcLookup(current_page, tsid, tclass); + if (!cache) -+ cache = sepgsqlAvcMakeEntry(current_page, relid, secid, tclass); ++ cache = sepgsqlAvcMakeEntry(current_page, tsid, tclass); + } while (!sepgsqlAvcCheckValid()); + + denied = required & ~cache->allowed; @@ -7261,7 +7731,7 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + { + sepgsqlAvcAudit(!!denied, + current_page->scontext, -+ securityRawSecLabelOut(relid, secid), ++ securityRawSecLabelOut(tsid.relid, tsid.secid), + cache->tclass, audited, audit_name); + } + @@ -7282,31 +7752,21 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + return result; + } + -+ bool -+ sepgsqlClientHasPermsTup(Oid relid, HeapTuple tuple, -+ uint16 tclass, uint32 required, bool abort) -+ { -+ const char *audit_name = sepgsqlAuditName(relid, tuple); -+ -+ return sepgsqlClientHasPermsSid(relid, HeapTupleGetSecLabel(tuple), -+ tclass, required, audit_name, abort); -+ } -+ + /* + * sepgsqlClientCreateSecid + * sepgsqlClientCreateLabel + */ -+ Oid -+ sepgsqlClientCreateSecid(Oid trelid, Oid tsecid, uint16 tclass, Oid nrelid) ++ sepgsql_sid_t ++ sepgsqlClientCreateSecid(sepgsql_sid_t tsid, uint16 tclass, Oid nrelid) + { -+ avc_datum *cache; -+ int index; -+ Oid nsecid; ++ sepgsql_sid_t nsid; ++ avc_datum *cache; ++ int index; + + do { -+ cache = sepgsqlAvcLookup(current_page, trelid, tsecid, tclass); ++ cache = sepgsqlAvcLookup(current_page, tsid, tclass); + if (!cache) -+ cache = sepgsqlAvcMakeEntry(current_page, trelid, tsecid, tclass); ++ cache = sepgsqlAvcMakeEntry(current_page, tsid, tclass); + + index = (nrelid % AVC_DATUM_NSID_SLOTS); + if (cache->nsid[index].relid != nrelid) @@ -7315,21 +7775,21 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + = securityRawSecLabelIn(nrelid, cache->ncontext); + cache->nsid[index].relid = nrelid; + } -+ nsecid = cache->nsid[index].secid; ++ nsid = cache->nsid[index]; + } while (!sepgsqlAvcCheckValid()); + -+ return nsecid; ++ return nsid; + } + + security_context_t -+ sepgsqlClientCreateLabel(Oid trelid, Oid tsecid, uint16 tclass) ++ sepgsqlClientCreateLabel(sepgsql_sid_t tsid, uint16 tclass) + { + avc_datum *cache; + + do { -+ cache = sepgsqlAvcLookup(current_page, trelid, tsecid, tclass); ++ cache = sepgsqlAvcLookup(current_page, tsid, tclass); + if (!cache) -+ cache = sepgsqlAvcMakeEntry(current_page, trelid, tsecid, tclass); ++ cache = sepgsqlAvcMakeEntry(current_page, tsid, tclass); + } while (!sepgsqlAvcCheckValid()); + + return cache->ncontext; @@ -7590,10 +8050,10 @@ diff -Nrpc base/src/backend/security/sepgsql/avc.c sepgsql/src/backend/security/ + } diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/security/sepgsql/checker.c *** base/src/backend/security/sepgsql/checker.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/checker.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/security/sepgsql/checker.c Thu Sep 10 00:06:47 2009 *************** *** 0 **** ---- 1,420 ---- +--- 1,443 ---- + /* + * src/backend/security/sepgsql/checker.c + * walks on given Query tree and applies checks @@ -7605,6 +8065,7 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + + #include "access/sysattr.h" + #include "catalog/catalog.h" ++ #include "catalog/pg_security.h" + #include "miscadmin.h" + #include "security/sepgsql.h" + #include "storage/bufmgr.h" @@ -7668,10 +8129,12 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + Bitmapset *columns; + Bitmapset *selected_ex; + Bitmapset *modified_ex; -+ HeapTuple tuple; ++ Form_pg_class relForm; ++ HeapTuple reltup; ++ sepgsql_sid_t relsid; ++ sepgsql_sid_t attsid; + AttrNumber attno; -+ int nattrs; -+ security_class_t tclass; ++ uint16 tclass; + + /* + * Hardwired Policy: @@ -7699,13 +8162,15 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + /* + * Check db_table:{...} or db_sequence permissions + */ -+ tuple = SearchSysCache(RELOID, -+ ObjectIdGetDatum(relid), -+ 0, 0, 0); -+ if (!HeapTupleIsValid(tuple)) ++ reltup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(relid), ++ 0, 0, 0); ++ if (!HeapTupleIsValid(reltup)) + elog(ERROR, "SELinux: cache lookup failed for relation %u", relid); + -+ tclass = sepgsqlTupleObjectClass(RelationRelationId, tuple); ++ relForm = (Form_pg_class) GETSTRUCT(reltup); ++ ++ relsid = sepgsqlGetTupleContext(RelationRelationId, reltup, &tclass); + + if (tclass != SEPG_CLASS_DB_TABLE) + { @@ -7714,35 +8179,30 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + { + if (required & SEPG_DB_TABLE__SELECT) + { -+ sepgsqlClientHasPermsTup(RelationRelationId, tuple, -+ SEPG_CLASS_DB_SEQUENCE, -+ SEPG_DB_SEQUENCE__GET_VALUE, -+ true); ++ sepgsqlClientHasPerms(relsid, tclass, ++ SEPG_DB_SEQUENCE__GET_VALUE, ++ NameStr(relForm->relname), true); + } + } -+ ReleaseSysCache(tuple); ++ ReleaseSysCache(reltup); + return; + } -+ -+ sepgsqlClientHasPermsTup(RelationRelationId, tuple, -+ SEPG_CLASS_DB_TABLE, -+ required, true); -+ -+ nattrs = ((Form_pg_class) GETSTRUCT(tuple))->relnatts; -+ -+ ReleaseSysCache(tuple); ++ sepgsqlClientHasPerms(relsid, tclass, required, ++ NameStr(relForm->relname), true); + + /* + * Check db_column:{...} permissions + */ -+ selected_ex = fixupWholeRowReference(relid, nattrs, selected); -+ modified_ex = fixupWholeRowReference(relid, nattrs, modified); ++ selected_ex = fixupWholeRowReference(relid, relForm->relnatts, selected); ++ modified_ex = fixupWholeRowReference(relid, relForm->relnatts, modified); + columns = bms_union(selected_ex, modified_ex); + + while ((attno = bms_first_member(columns)) >= 0) + { + Form_pg_attribute attForm; -+ access_vector_t attperms = 0; ++ HeapTuple atttup; ++ uint32 attperms = 0; ++ char auname[2 * NAMEDATALEN + 3]; + + if (bms_is_member(attno, selected_ex)) + attperms |= SEPG_DB_COLUMN__SELECT; @@ -7758,25 +8218,31 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + + /* remove the attribute number offset */ + attno += FirstLowInvalidHeapAttributeNumber; -+ tuple = SearchSysCache(ATTNUM, -+ ObjectIdGetDatum(relid), -+ Int16GetDatum(attno), -+ 0, 0); -+ if (!HeapTupleIsValid(tuple)) ++ atttup = SearchSysCache(ATTNUM, ++ ObjectIdGetDatum(relid), ++ Int16GetDatum(attno), ++ 0, 0); ++ if (!HeapTupleIsValid(atttup)) + elog(ERROR, "cache lookup failed for attribute %d of relation %u", + attno, relid); + -+ attForm = (Form_pg_attribute) GETSTRUCT(tuple); ++ attForm = (Form_pg_attribute) GETSTRUCT(atttup); + if (attForm->attisdropped) + elog(ERROR, "attribute %d of relation %u does not exist", + attno, relid); + -+ sepgsqlClientHasPermsTup(AttributeRelationId, tuple, -+ SEPG_CLASS_DB_COLUMN, -+ attperms, true); -+ ReleaseSysCache(tuple); ++ snprintf(auname, sizeof(auname), "%s.%s", ++ NameStr(relForm->relname), ++ NameStr(attForm->attname)); ++ attsid = sepgsqlGetTupleContext(AttributeRelationId, ++ atttup, &tclass); ++ sepgsqlClientHasPerms(attsid, tclass, attperms, auname, true); ++ ++ ReleaseSysCache(atttup); + } + ++ ReleaseSysCache(reltup); ++ + if (selected_ex != selected) + bms_free(selected_ex); + @@ -7893,16 +8359,28 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + bool + sepgsqlExecScan(Relation rel, HeapTuple tuple, uint32 required, bool abort) + { -+ security_class_t tclass; ++ sepgsql_sid_t sid; ++ uint16 tclass; + + if (!sepgsqlIsEnabled() || + !required || -+ RelationGetForm(rel)->relkind != RELKIND_RELATION) ++ RelationGetForm(rel)->relkind != RELKIND_RELATION || ++ RelationGetRelid(rel) == SecurityRelationId) + return true; + -+ tclass = sepgsqlTupleObjectClass(RelationGetRelid(rel), tuple); -+ return sepgsqlClientHasPermsTup(RelationGetRelid(rel), tuple, -+ tclass, required, abort); ++ sid = sepgsqlGetTupleContext(RelationGetRelid(rel), tuple, &tclass); ++ /* ++ * Insert/Delete to an external attribute is equivalent to ++ * the set-attribute on the master ++ */ ++ if (sid.relid != RelationGetRelid(rel) && ++ (required & (SEPG_DB_TUPLE__INSERT | SEPG_DB_TUPLE__DELETE))) ++ { ++ required &= ~(SEPG_DB_TUPLE__INSERT | SEPG_DB_TUPLE__DELETE); ++ required |= SEPG_DB_TUPLE__UPDATE; ++ } ++ ++ return sepgsqlClientHasPerms(sid, tclass, required, NULL, abort); + } + + uint32 @@ -7935,8 +8413,8 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + void + sepgsqlHeapTupleInsert(Relation rel, HeapTuple newtup, bool internal) + { -+ security_class_t tclass; -+ Oid relid = RelationGetRelid(rel); ++ sepgsql_sid_t sid; ++ uint16 tclass; + + if (!sepgsqlIsEnabled()) + return; @@ -7944,10 +8422,10 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + /* + * assigns a default security label, if not explicit one + */ -+ if (!OidIsValid(HeapTupleGetSecLabel(newtup))) ++ if (!OidIsValid(HeapTupleGetSecid(newtup))) + { -+ if (HeapTupleHasSecLabel(newtup)) -+ sepgsqlSetDefaultSecLabel(rel, newtup); ++ if (HeapTupleHasSecid(newtup)) ++ sepgsqlSetDefaultSecid(rel, newtup); + } + + /* @@ -7958,9 +8436,9 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + if (internal) + return; + -+ tclass = sepgsqlTupleObjectClass(relid, newtup); -+ sepgsqlClientHasPermsTup(relid, newtup, tclass, -+ SEPG_DB_TUPLE__INSERT, true); ++ sid = sepgsqlGetTupleContext(RelationGetRelid(rel), ++ newtup, &tclass); ++ sepgsqlClientHasPerms(sid, tclass, SEPG_DB_TUPLE__INSERT, NULL, true); + } + + /* @@ -7972,7 +8450,6 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + void + sepgsqlHeapTupleUpdate(Relation rel, ItemPointer otid, HeapTuple newtup) + { -+ Oid relid = RelationGetRelid(rel); + Oid secid; + HeapTupleData oldtup; + Buffer oldbuf; @@ -7988,7 +8465,7 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + * at the sepgsqlExecScan() hook, so we don't need to + * check anything more. + */ -+ secid = HeapTupleGetSecLabel(newtup); ++ secid = HeapTupleGetSecid(newtup); + if (!OidIsValid(secid)) + return; + @@ -7999,18 +8476,24 @@ diff -Nrpc base/src/backend/security/sepgsql/checker.c sepgsql/src/backend/secur + if (!heap_fetch(rel, SnapshotAny, &oldtup, &oldbuf, false, NULL)) + elog(ERROR, "failed to fetch old version of the tuple"); + -+ if (secid != HeapTupleGetSecLabel(&oldtup)) ++ if (secid != HeapTupleGetSecid(&oldtup)) + { -+ security_class_t tclass -+ = sepgsqlTupleObjectClass(relid, newtup); ++ sepgsql_sid_t sid; ++ uint16 tclass; + -+ /* db_tuple:{relabelfrom} for older security label */ -+ sepgsqlClientHasPermsTup(relid, &oldtup, tclass, -+ SEPG_DB_TUPLE__RELABELFROM, true); ++ /* db_tuple:{relabelfrom} for older security context */ ++ sid = sepgsqlGetTupleContext(RelationGetRelid(rel), ++ &oldtup, &tclass); ++ sepgsqlClientHasPerms(sid, tclass, ++ SEPG_DB_TUPLE__RELABELFROM, ++ NULL, true); + + /* db_tuple:{relabelto} for newer security label */ -+ sepgsqlClientHasPermsTup(relid, newtup, tclass, -+ SEPG_DB_TUPLE__RELABELTO, true); ++ sid = sepgsqlGetTupleContext(RelationGetRelid(rel), ++ newtup, &tclass); ++ sepgsqlClientHasPerms(sid, tclass, ++ SEPG_DB_TUPLE__RELABELTO, ++ NULL, true); + } + ReleaseBuffer(oldbuf); + } @@ -8101,10 +8584,10 @@ diff -Nrpc base/src/backend/security/sepgsql/dummy.c sepgsql/src/backend/securit + } diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/security/sepgsql/hooks.c *** base/src/backend/security/sepgsql/hooks.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/hooks.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/security/sepgsql/hooks.c Thu Sep 10 00:06:47 2009 *************** *** 0 **** ---- 1,1170 ---- +--- 1,1273 ---- + /* + * src/backend/security/sepgsql/hooks.c + * SE-PostgreSQL security hooks @@ -8155,95 +8638,106 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + * into its process address space. + */ + Oid -+ sepgsqlCheckDatabaseCreate(const char *datname, DefElem *new_label) ++ sepgsqlCheckDatabaseCreate(const char *datname, DefElem *newLabel) + { -+ Oid datsid; ++ sepgsql_sid_t datSid; + + if (!sepgsqlIsEnabled()) + return InvalidOid; + -+ if (!new_label) -+ datsid = sepgsqlGetDefaultDatabaseSecLabel(); ++ if (!newLabel) ++ datSid = sepgsqlGetDefaultDatabaseSecid(); + else -+ datsid = securityTransSecLabelIn(DatabaseRelationId, -+ strVal(new_label->arg)); ++ { ++ datSid.relid = DatabaseRelationId; ++ datSid.secid = securityTransSecLabelIn(datSid.relid, ++ strVal(newLabel->arg)); ++ } + -+ sepgsqlClientHasPermsSid(DatabaseRelationId, datsid, -+ SEPG_CLASS_DB_DATABASE, -+ SEPG_DB_DATABASE__CREATE, -+ datname, true); -+ return datsid; ++ sepgsqlClientHasPerms(datSid, ++ SEPG_CLASS_DB_DATABASE, ++ SEPG_DB_DATABASE__CREATE, ++ datname, true); ++ return datSid.secid; + } + + static bool -+ checkDatabaseCommon(Oid datoid, access_vector_t perms, bool abort) ++ checkDatabaseCommon(Oid datOid, uint32 required, bool abort) + { + HeapTuple tuple; ++ sepgsql_sid_t datSid; ++ uint16 tclass; ++ const char *auname; + bool rc; + + if (!sepgsqlIsEnabled()) + return true; + + tuple = SearchSysCache(DATABASEOID, -+ ObjectIdGetDatum(datoid), ++ ObjectIdGetDatum(datOid), + 0, 0, 0); + if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for database: %u", datoid); ++ elog(ERROR, "cache lookup failed for database: %u", datOid); ++ ++ auname = NameStr(((Form_pg_database) GETSTRUCT(tuple))->datname); ++ datSid = sepgsqlGetTupleContext(DatabaseRelationId, ++ tuple, &tclass); ++ rc = sepgsqlClientHasPerms(datSid, ++ tclass, required, ++ auname, abort); + -+ rc = sepgsqlClientHasPermsTup(DatabaseRelationId, tuple, -+ SEPG_CLASS_DB_DATABASE, -+ perms, abort); + ReleaseSysCache(tuple); + + return rc; + } + + void -+ sepgsqlCheckDatabaseDrop(Oid database_oid) ++ sepgsqlCheckDatabaseDrop(Oid datOid) + { -+ checkDatabaseCommon(database_oid, -+ SEPG_DB_DATABASE__DROP, true); ++ checkDatabaseCommon(datOid, SEPG_DB_DATABASE__DROP, true); + } + + void -+ sepgsqlCheckDatabaseSetattr(Oid database_oid) ++ sepgsqlCheckDatabaseSetattr(Oid datOid) + { -+ checkDatabaseCommon(database_oid, -+ SEPG_DB_DATABASE__SETATTR, true); ++ checkDatabaseCommon(datOid, SEPG_DB_DATABASE__SETATTR, true); + } + + Oid -+ sepgsqlCheckDatabaseRelabel(Oid database_oid, DefElem *new_label) ++ sepgsqlCheckDatabaseRelabel(Oid datOid, DefElem *newLabel) + { -+ Oid datsid; ++ sepgsql_sid_t datSid; + + if (!sepgsqlIsEnabled()) + { -+ if (new_label) ++ if (newLabel) + ereport(ERROR, + (errcode(ERRCODE_SELINUX_ERROR), + errmsg("SELinux is disabled now"))); + return InvalidOid; + } -+ datsid = securityTransSecLabelIn(DatabaseRelationId, -+ strVal(new_label->arg)); ++ datSid.relid = DatabaseRelationId; ++ datSid.secid = securityTransSecLabelIn(datSid.relid, ++ strVal(newLabel->arg)); + /* db_database:{setattr relabelfrom} for older seclabel */ -+ checkDatabaseCommon(database_oid, ++ checkDatabaseCommon(datOid, + SEPG_DB_DATABASE__SETATTR | + SEPG_DB_DATABASE__RELABELFROM, true); + /* db_database:{relabelto} for newer seclabel */ -+ sepgsqlClientHasPermsSid(DatabaseRelationId, datsid, -+ SEPG_CLASS_DB_DATABASE, -+ SEPG_DB_DATABASE__RELABELTO, -+ get_database_name(database_oid), true); -+ return datsid; ++ sepgsqlClientHasPerms(datSid, ++ SEPG_CLASS_DB_DATABASE, ++ SEPG_DB_DATABASE__RELABELTO, ++ get_database_name(datOid), true); ++ return datSid.secid; + } + -+ bool -+ sepgsqlCheckDatabaseConnect(Oid database_oid) ++ void ++ sepgsqlCheckDatabaseAccess(Oid datOid) + { -+ return checkDatabaseCommon(database_oid, -+ SEPG_DB_DATABASE__CONNECT, false); ++ if (!checkDatabaseCommon(datOid, SEPG_DB_DATABASE__ACCESS, false)) ++ ereport(FATAL, ++ (errcode(ERRCODE_SELINUX_ERROR), ++ errmsg("SELinux: security policy violation"))); + } + + bool @@ -8254,25 +8748,6 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + } + + void -+ sepgsqlCheckDatabaseInstallModule(const char *probin, HeapTuple protup) -+ { -+ Datum oldbin; -+ bool isnull; -+ -+ if (HeapTupleIsValid(protup)) -+ { -+ oldbin = SysCacheGetAttr(PROCOID, protup, -+ Anum_pg_proc_probin, -+ &isnull); -+ if (!isnull && -+ strcmp(probin, TextDatumGetCString(oldbin))) -+ return; /* unchanged */ -+ } -+ checkDatabaseCommon(MyDatabaseId, -+ SEPG_DB_DATABASE__INSTALL_MODULE, true); -+ } -+ -+ void + sepgsqlCheckDatabaseLoadModule(const char *filename) + { + HeapTuple tuple; @@ -8297,7 +8772,7 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + elog(ERROR, "cache lookup failed for database: %u", MyDatabaseId); + + dbcon = securityRawSecLabelOut(DatabaseRelationId, -+ HeapTupleGetSecLabel(tuple)); ++ HeapTupleGetSecid(tuple)); + ReleaseSysCache(tuple); + + /* Get library context */ @@ -8326,111 +8801,271 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + * ------------------------------------------------------------ + * Hooks corresponding to db_schema object class + * ------------------------------------------------------------ -+ * -+ * sepgsqlCheckSchemaAddRemove -+ * checks db_schema:{add_object} and db_schema:{remove_object} -+ * permission when a database object within a certain schema -+ * is added or removed. + */ ++ + Oid -+ sepgsqlCheckSchemaCreate(const char *nspname, DefElem *new_label, bool temp_schema) ++ sepgsqlCheckSchemaCreate(const char *nspName, DefElem *newLabel, bool isTemp) + { -+ Oid nspsid; ++ sepgsql_sid_t nspSid; + + if (!sepgsqlIsEnabled()) + return InvalidOid; + -+ if (!new_label) -+ nspsid = (!temp_schema -+ ? sepgsqlGetDefaultSchemaSecLabel(MyDatabaseId) -+ : sepgsqlGetDefaultSchemaTempSecLabel(MyDatabaseId)); ++ if (!newLabel) ++ { ++ nspSid = (!isTemp ++ ? sepgsqlGetDefaultSchemaSecid(MyDatabaseId) ++ : sepgsqlGetDefaultSchemaTempSecid(MyDatabaseId)); ++ } + else -+ nspsid = securityTransSecLabelIn(NamespaceRelationId, -+ strVal(new_label->arg)); -+ -+ sepgsqlClientHasPermsSid(NamespaceRelationId, nspsid, -+ (!temp_schema -+ ? SEPG_CLASS_DB_SCHEMA -+ : SEPG_CLASS_DB_SCHEMA_TEMP), -+ SEPG_DB_SCHEMA__CREATE, -+ nspname, true); -+ return nspsid; ++ { ++ nspSid.relid = NamespaceRelationId; ++ nspSid.secid = securityTransSecLabelIn(nspSid.relid, ++ strVal(newLabel->arg)); ++ } ++ sepgsqlClientHasPerms(nspSid, ++ (!isTemp ++ ? SEPG_CLASS_DB_SCHEMA ++ : SEPG_CLASS_DB_SCHEMA_TEMP), ++ SEPG_DB_SCHEMA__CREATE, ++ nspName, true); ++ return nspSid.secid; + } + + static bool -+ sepgsqlCheckSchemaCommon(Oid namespace_oid, access_vector_t required, bool abort) ++ checkSchemaCommon(Oid nspOid, uint32 required, bool abort) + { -+ HeapTuple tuple; -+ bool rc; ++ HeapTuple tuple; ++ sepgsql_sid_t nspSid; ++ uint16 tclass; ++ const char *auname; ++ bool rc; + + if (!sepgsqlIsEnabled()) + return true; + + tuple = SearchSysCache(NAMESPACEOID, -+ ObjectIdGetDatum(namespace_oid), ++ ObjectIdGetDatum(nspOid), + 0, 0, 0); + if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for namespace: %u", namespace_oid); ++ elog(ERROR, "cache lookup failed for namespace: %u", nspOid); ++ ++ nspSid = sepgsqlGetTupleContext(NamespaceRelationId, ++ tuple, &tclass); ++ ++ auname = NameStr(((Form_pg_namespace) GETSTRUCT(tuple))->nspname); ++ rc = sepgsqlClientHasPerms(nspSid, tclass, required, ++ auname, abort); + -+ rc = sepgsqlClientHasPermsTup(NamespaceRelationId, tuple, -+ (!isAnyTempNamespace(namespace_oid) -+ ? SEPG_CLASS_DB_SCHEMA -+ : SEPG_CLASS_DB_SCHEMA_TEMP), -+ required, abort); + ReleaseSysCache(tuple); + + return rc; + } + + void -+ sepgsqlCheckSchemaDrop(Oid namespace_oid) ++ sepgsqlCheckSchemaDrop(Oid nspOid) + { -+ sepgsqlCheckSchemaCommon(namespace_oid, -+ SEPG_DB_SCHEMA__DROP, true); ++ checkSchemaCommon(nspOid, SEPG_DB_SCHEMA__DROP, true); + } + + void -+ sepgsqlCheckSchemaSetattr(Oid namespace_oid) ++ sepgsqlCheckSchemaSetattr(Oid nspOid) + { -+ sepgsqlCheckSchemaCommon(namespace_oid, -+ SEPG_DB_SCHEMA__SETATTR, true); ++ checkSchemaCommon(nspOid, SEPG_DB_SCHEMA__SETATTR, true); + } + + Oid -+ sepgsqlCheckSchemaRelabel(Oid namespace_oid, DefElem *new_label) ++ sepgsqlCheckSchemaRelabel(Oid nspOid, DefElem *newLabel) + { -+ Oid nspsid; ++ sepgsql_sid_t nspSid; + + if (!sepgsqlIsEnabled()) + { -+ if (new_label) ++ if (newLabel) + ereport(ERROR, + (errcode(ERRCODE_SELINUX_ERROR), + errmsg("SELinux is disabled now"))); + return InvalidOid; + } -+ nspsid = securityTransSecLabelIn(NamespaceRelationId, -+ strVal(new_label->arg)); ++ nspSid.relid = NamespaceRelationId; ++ nspSid.secid = securityTransSecLabelIn(nspSid.relid, ++ strVal(newLabel->arg)); + + /* db_schema:{setattr relabelfrom} for older seclabel */ -+ sepgsqlCheckSchemaCommon(namespace_oid, -+ SEPG_DB_SCHEMA__SETATTR | -+ SEPG_DB_SCHEMA__RELABELFROM, true); ++ checkSchemaCommon(nspOid, ++ SEPG_DB_SCHEMA__SETATTR | ++ SEPG_DB_SCHEMA__RELABELFROM, true); + /* db_schema:{relabelto} for newer seclabel */ -+ sepgsqlClientHasPermsSid(NamespaceRelationId, nspsid, -+ !isAnyTempNamespace(namespace_oid) -+ ? SEPG_CLASS_DB_SCHEMA -+ : SEPG_CLASS_DB_SCHEMA_TEMP, -+ SEPG_DB_SCHEMA__RELABELTO, -+ get_namespace_name(namespace_oid), true); -+ return nspsid; ++ sepgsqlClientHasPerms(nspSid, ++ !isAnyTempNamespace(nspOid) ++ ? SEPG_CLASS_DB_SCHEMA ++ : SEPG_CLASS_DB_SCHEMA_TEMP, ++ SEPG_DB_SCHEMA__RELABELTO, ++ get_namespace_name(nspOid), true); ++ return nspSid.secid; ++ } ++ ++ void ++ sepgsqlCheckSchemaAddName(Oid nspOid) ++ { ++ checkSchemaCommon(nspOid, SEPG_DB_SCHEMA__ADD_NAME, true); ++ } ++ ++ void ++ sepgsqlCheckSchemaRemoveName(Oid nspOid) ++ { ++ checkSchemaCommon(nspOid, SEPG_DB_SCHEMA__REMOVE_NAME, true); + } + + bool -+ sepgsqlCheckSchemaUsage(Oid namespace_oid) ++ sepgsqlCheckSchemaSearch(Oid nspOid, bool abort) + { -+ return sepgsqlCheckSchemaCommon(namespace_oid, -+ SEPG_DB_SCHEMA__USAGE, false); ++ return checkSchemaCommon(nspOid, SEPG_DB_SCHEMA__SEARCH, abort); ++ } ++ ++ /* ------------------------------------------------------------ * ++ * Hooks corresponding to db_column object class ++ * ------------------------------------------------------------ */ ++ ++ /* ++ * NOTE: db_column:{create} is checked on sepgsqlCreateTableColumns() ++ * which is invoked on CREATE TABLE statement. ++ * The sepgsqlCheckColumnCreate() is called on the ALTER TABLE ++ * ... ADD COLUMN path. ++ */ ++ Oid ++ sepgsqlCheckColumnCreate(Oid table_oid, const char *attname, DefElem *newLabel) ++ { ++ sepgsql_sid_t attSid; ++ char relkind; ++ char auname[NAMEDATALEN * 2 + 3]; ++ ++ if (!sepgsqlIsEnabled()) ++ { ++ if (newLabel) ++ ereport(ERROR, ++ (errcode(ERRCODE_SELINUX_ERROR), ++ errmsg("SELinux is disabled now"))); ++ return InvalidOid; ++ } ++ ++ relkind = get_rel_relkind(table_oid); ++ if (relkind != RELKIND_RELATION) ++ { ++ if (newLabel) ++ ereport(ERROR, ++ (errcode(ERRCODE_SELINUX_ERROR), ++ errmsg("Unable to assign security label"))); ++ return InvalidOid; ++ } ++ ++ if (!newLabel) ++ attSid = sepgsqlGetDefaultColumnSecid(table_oid); ++ else ++ { ++ attSid.relid = AttributeRelationId; ++ attSid.secid = securityTransSecLabelIn(attSid.relid, ++ strVal(newLabel->arg)); ++ } ++ ++ sprintf(auname, "%s.%s", get_rel_name(table_oid), attname); ++ sepgsqlClientHasPerms(attSid, ++ SEPG_CLASS_DB_COLUMN, ++ SEPG_DB_COLUMN__CREATE, ++ auname, true); ++ return attSid.secid; ++ } ++ ++ static void ++ checkColumnCommon(Oid relOid, AttrNumber attno, uint32 required) ++ { ++ Form_pg_attribute attr; ++ sepgsql_sid_t attSid; ++ HeapTuple tuple; ++ uint16 tclass; ++ char auname[2 * NAMEDATALEN + 3]; ++ char relkind; ++ ++ if (!sepgsqlIsEnabled()) ++ return; ++ ++ relkind = get_rel_relkind(relOid); ++ if (relkind != RELKIND_RELATION) ++ return; ++ ++ tuple = SearchSysCache(ATTNUM, ++ ObjectIdGetDatum(relOid), ++ Int16GetDatum(attno), ++ 0, 0); ++ if (!HeapTupleIsValid(tuple)) ++ elog(ERROR, "cache lookup failed for attribute %d of relation %u", ++ attno, relOid); ++ ++ attr = (Form_pg_attribute) GETSTRUCT(tuple); ++ if (!attr->attisdropped) ++ { ++ sprintf(auname, "%s.%s", ++ get_rel_name(relOid), ++ NameStr(attr->attname)); ++ attSid = sepgsqlGetTupleContext(AttributeRelationId, ++ tuple, &tclass); ++ sepgsqlClientHasPerms(attSid, tclass, required, ++ auname, true); ++ } ++ ++ ReleaseSysCache(tuple); ++ } ++ ++ void ++ sepgsqlCheckColumnDrop(Oid relOid, AttrNumber attno) ++ { ++ checkColumnCommon(relOid, attno, SEPG_DB_COLUMN__DROP); ++ } ++ ++ void ++ sepgsqlCheckColumnSetattr(Oid relOid, AttrNumber attno) ++ { ++ checkColumnCommon(relOid, attno, SEPG_DB_COLUMN__SETATTR); ++ } ++ ++ Oid ++ sepgsqlCheckColumnRelabel(Oid relOid, AttrNumber attno, DefElem *newLabel) ++ { ++ sepgsql_sid_t attSid; ++ char relkind; ++ ++ if (!sepgsqlIsEnabled()) ++ { ++ if (newLabel) ++ ereport(ERROR, ++ (errcode(ERRCODE_SELINUX_ERROR), ++ errmsg("SELinux is disabled now"))); ++ return InvalidOid; ++ } ++ ++ relkind = get_rel_relkind(relOid); ++ if (relkind != RELKIND_RELATION) ++ ereport(ERROR, ++ (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), ++ errmsg("Unable to set security label on \"%s.%s\"", ++ get_rel_name(relOid), ++ get_attname(relOid, attno)))); ++ ++ attSid.relid = AttributeRelationId; ++ attSid.secid = securityTransSecLabelIn(attSid.relid, ++ strVal(newLabel->arg)); ++ ++ /* db_column:{setattr relabelfrom} for older seclabel */ ++ checkColumnCommon(relOid, attno, ++ SEPG_DB_COLUMN__SETATTR | ++ SEPG_DB_COLUMN__RELABELFROM); ++ ++ /* db_column:{relabelto} for newer seclabel */ ++ sepgsqlClientHasPerms(attSid, ++ SEPG_CLASS_DB_COLUMN, ++ SEPG_DB_COLUMN__RELABELTO, ++ get_attname(relOid, attno), true); ++ return attSid.secid; + } + + /* ------------------------------------------------------------ * @@ -8451,8 +9086,10 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + static void + checkTableCommon(Oid table_oid, access_vector_t required) + { -+ HeapTuple tuple; -+ char relkind; ++ HeapTuple tuple; ++ sepgsql_sid_t relSid; ++ uint16 tclass; ++ const char *auname; + + if (!sepgsqlIsEnabled()) + return; @@ -8463,71 +9100,18 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for relation %u", table_oid); + -+ relkind = ((Form_pg_class) GETSTRUCT(tuple))->relkind; -+ switch (relkind) -+ { -+ case RELKIND_RELATION: -+ sepgsqlClientHasPermsTup(RelationRelationId, tuple, -+ SEPG_CLASS_DB_TABLE, -+ required, true); -+ break; -+ -+ case RELKIND_SEQUENCE: -+ sepgsqlClientHasPermsTup(RelationRelationId, tuple, -+ SEPG_CLASS_DB_SEQUENCE, -+ required, true); -+ break; -+ -+ default: -+ /* do nothing in this version */ -+ break; -+ } ++ auname = NameStr(((Form_pg_class) GETSTRUCT(tuple))->relname); ++ relSid = sepgsqlGetTupleContext(RelationRelationId, ++ tuple, &tclass); ++ sepgsqlClientHasPerms(relSid, tclass, required, ++ auname, true); + ReleaseSysCache(tuple); + } + + void + sepgsqlCheckTableDrop(Oid table_oid) + { -+ Form_pg_attribute attr; -+ Relation attrel; -+ SysScanDesc scan; -+ ScanKeyData key[1]; -+ HeapTuple atttup; -+ char relkind; -+ -+ if (!sepgsqlIsEnabled()) -+ return; -+ + checkTableCommon(table_oid, SEPG_DB_TABLE__DROP); -+ -+ relkind = get_rel_relkind(table_oid); -+ if (relkind != RELKIND_RELATION) -+ return; /* no need to check anymore */ -+ -+ /* Also checks db_column:{drop} */ -+ attrel = heap_open(AttributeRelationId, AccessShareLock); -+ -+ ScanKeyInit(&key[0], -+ Anum_pg_attribute_attrelid, -+ BTEqualStrategyNumber, F_OIDEQ, -+ ObjectIdGetDatum(table_oid)); -+ -+ scan = systable_beginscan(attrel, AttributeRelidNumIndexId, true, -+ SnapshotNow, 1, key); -+ while(HeapTupleIsValid(atttup = systable_getnext(scan))) -+ { -+ attr = (Form_pg_attribute) GETSTRUCT(atttup); -+ if (attr->attisdropped) -+ continue; -+ -+ sepgsqlClientHasPermsTup(AttributeRelationId, atttup, -+ SEPG_CLASS_DB_COLUMN, -+ SEPG_DB_COLUMN__DROP, -+ true); -+ } -+ systable_endscan(scan); -+ -+ heap_close(attrel, AccessShareLock); + } + + void @@ -8537,14 +9121,14 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + } + + Oid -+ sepgsqlCheckTableRelabel(Oid table_oid, DefElem *new_label) ++ sepgsqlCheckTableRelabel(Oid table_oid, DefElem *newLabel) + { -+ Oid relsid; -+ char relkind; ++ sepgsql_sid_t relSid; ++ char relkind; + + if (!sepgsqlIsEnabled()) + { -+ if (new_label) ++ if (newLabel) + ereport(ERROR, + (errcode(ERRCODE_SELINUX_ERROR), + errmsg("SELinux is disabled now"))); @@ -8558,8 +9142,9 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + errmsg("Unable to set security label on \"%s\"", + get_rel_name(table_oid)))); + -+ relsid = securityTransSecLabelIn(RelationRelationId, -+ strVal(new_label->arg)); ++ relSid.relid = RelationRelationId; ++ relSid.secid = securityTransSecLabelIn(relSid.relid, ++ strVal(newLabel->arg)); + + /* db_table/db_sequence:{setattr relabelfrom} for older seclabel */ + checkTableCommon(table_oid, @@ -8567,13 +9152,13 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + SEPG_DB_TABLE__RELABELFROM); + + /* db_table/db_sequence:{relabelto} for newer seclabel */ -+ sepgsqlClientHasPermsSid(RelationRelationId, relsid, -+ (relkind == RELKIND_RELATION -+ ? SEPG_CLASS_DB_TABLE -+ : SEPG_CLASS_DB_SEQUENCE), -+ SEPG_DB_TABLE__RELABELTO, -+ get_rel_name(table_oid), true); -+ return relsid; ++ sepgsqlClientHasPerms(relSid, ++ (relkind == RELKIND_RELATION ++ ? SEPG_CLASS_DB_TABLE ++ : SEPG_CLASS_DB_SEQUENCE), ++ SEPG_DB_TABLE__RELABELTO, ++ get_rel_name(table_oid), true); ++ return relSid.secid; + } + + void @@ -8587,7 +9172,8 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + { + HeapScanDesc scan; + HeapTuple tuple; -+ security_class_t tclass; ++ sepgsql_sid_t tupSid; ++ uint16 tclass; + + if (!sepgsqlIsEnabled()) + return; @@ -8595,14 +9181,20 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + /* check db_table:{delete} permission */ + checkTableCommon(RelationGetRelid(rel), SEPG_DB_TABLE__DELETE); + ++ /* row-level access control is enabled? */ ++ if (!sepostgresql_row_level) ++ return; ++ + /* check db_tuple:{delete} permission */ + scan = heap_beginscan(rel, SnapshotNow, 0, NULL); + + while ((tuple = heap_getnext(scan, ForwardScanDirection)) != NULL) + { -+ tclass = sepgsqlTupleObjectClass(RelationGetRelid(rel), tuple); -+ sepgsqlClientHasPermsTup(RelationGetRelid(rel), tuple, tclass, -+ SEPG_DB_TUPLE__DELETE, true); ++ tupSid = sepgsqlGetTupleContext(RelationGetRelid(rel), ++ tuple, &tclass); ++ sepgsqlClientHasPerms(tupSid, ++ tclass, SEPG_DB_TUPLE__DELETE, ++ NULL, true); + } + heap_endscan(scan); + } @@ -8610,309 +9202,231 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckTableReference(Relation rel, int16 *attnums, int natts) + { -+ HeapTuple tuple; -+ int i; -+ -+ if (!sepgsqlIsEnabled()) -+ return; ++ int i; + + checkTableCommon(RelationGetRelid(rel), SEPG_DB_TABLE__REFERENCE); + + for (i=0; i < natts; i++) + { -+ tuple = SearchSysCache(ATTNUM, -+ ObjectIdGetDatum(RelationGetRelid(rel)), -+ Int16GetDatum(attnums[i]), -+ 0, 0); -+ if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for attribute %u of %s", -+ attnums[i], RelationGetRelationName(rel)); -+ -+ sepgsqlClientHasPermsTup(AttributeRelationId, tuple, -+ SEPG_CLASS_DB_COLUMN, -+ SEPG_DB_COLUMN__REFERENCE, -+ true); -+ ReleaseSysCache(tuple); ++ checkColumnCommon(RelationGetRelid(rel), ++ attnums[i], SEPG_DB_COLUMN__REFERENCE); + } + } + + /* ------------------------------------------------------------ * + * Hooks corresponding to db_sequence object class + * ------------------------------------------------------------ */ -+ static void -+ sepgsqlCheckSequenceCommon(Oid seqid, access_vector_t required) ++ void sepgsqlCheckSequenceGetValue(Oid seqOid) + { -+ HeapTuple tuple; -+ -+ if (!sepgsqlIsEnabled()) -+ return; -+ -+ tuple = SearchSysCache(RELOID, -+ ObjectIdGetDatum(seqid), -+ 0, 0, 0); -+ if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for sequence: %u", seqid); -+ -+ sepgsqlClientHasPermsTup(RelationRelationId, tuple, -+ SEPG_CLASS_DB_SEQUENCE, -+ required, true); -+ ReleaseSysCache(tuple); ++ checkTableCommon(seqOid, SEPG_DB_SEQUENCE__GET_VALUE); + } + -+ void sepgsqlCheckSequenceGetValue(Oid seqid) ++ void sepgsqlCheckSequenceNextValue(Oid seqOid) + { -+ sepgsqlCheckSequenceCommon(seqid, SEPG_DB_SEQUENCE__GET_VALUE); ++ checkTableCommon(seqOid, SEPG_DB_SEQUENCE__NEXT_VALUE); + } + -+ void sepgsqlCheckSequenceNextValue(Oid seqid) ++ void sepgsqlCheckSequenceSetValue(Oid seqOid) + { -+ sepgsqlCheckSequenceCommon(seqid, SEPG_DB_SEQUENCE__NEXT_VALUE); -+ } -+ -+ void sepgsqlCheckSequenceSetValue(Oid seqid) -+ { -+ sepgsqlCheckSequenceCommon(seqid, SEPG_DB_SEQUENCE__SET_VALUE); -+ } -+ -+ /* ------------------------------------------------------------ * -+ * Hooks corresponding to db_column object class -+ * ------------------------------------------------------------ */ -+ -+ /* -+ * NOTE: db_column:{create} is checked on sepgsqlCreateTableColumns() -+ * which is invoked on CREATE TABLE statement. -+ * The sepgsqlCheckColumnCreate() is called on the ALTER TABLE -+ * ... ADD COLUMN path. -+ */ -+ Oid -+ sepgsqlCheckColumnCreate(Oid table_oid, const char *attname, DefElem *new_label) -+ { -+ Oid secid; -+ char relkind; -+ char buffer[NAMEDATALEN * 2 + 3]; -+ -+ if (!sepgsqlIsEnabled()) -+ { -+ if (new_label) -+ ereport(ERROR, -+ (errcode(ERRCODE_SELINUX_ERROR), -+ errmsg("SELinux is disabled now"))); -+ return InvalidOid; -+ } -+ -+ relkind = get_rel_relkind(table_oid); -+ if (relkind != RELKIND_RELATION) -+ { -+ if (new_label) -+ ereport(ERROR, -+ (errcode(ERRCODE_SELINUX_ERROR), -+ errmsg("Unable to assign security label"))); -+ return InvalidOid; -+ } -+ -+ if (!new_label) -+ secid = sepgsqlGetDefaultColumnSecLabel(table_oid); -+ else -+ secid = securityTransSecLabelIn(AttributeRelationId, -+ strVal(new_label->arg)); -+ -+ sprintf(buffer, "%s.%s", get_rel_name(table_oid), attname); -+ sepgsqlClientHasPermsSid(AttributeRelationId, secid, -+ SEPG_CLASS_DB_COLUMN, -+ SEPG_DB_COLUMN__CREATE, -+ buffer, true); -+ return secid; -+ } -+ -+ static void -+ sepgsqlCheckColumnCommon(Oid table_oid, AttrNumber attno, -+ access_vector_t required) -+ { -+ Form_pg_attribute attr; -+ HeapTuple tuple; -+ char relkind; -+ -+ if (!sepgsqlIsEnabled()) -+ return; -+ -+ relkind = get_rel_relkind(table_oid); -+ if (relkind != RELKIND_RELATION) -+ return; -+ -+ tuple = SearchSysCache(ATTNUM, -+ ObjectIdGetDatum(table_oid), -+ Int16GetDatum(attno), -+ 0, 0); -+ if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for attribute %d of relation %u", -+ attno, table_oid); -+ -+ attr = (Form_pg_attribute) GETSTRUCT(tuple); -+ if (!attr->attisdropped) -+ sepgsqlClientHasPermsTup(AttributeRelationId, tuple, -+ SEPG_CLASS_DB_COLUMN, -+ required, true); -+ ReleaseSysCache(tuple); -+ } -+ -+ void -+ sepgsqlCheckColumnDrop(Oid table_oid, AttrNumber attno) -+ { -+ sepgsqlCheckColumnCommon(table_oid, attno, SEPG_DB_COLUMN__DROP); -+ } -+ -+ void -+ sepgsqlCheckColumnSetattr(Oid table_oid, AttrNumber attno) -+ { -+ sepgsqlCheckColumnCommon(table_oid, attno, SEPG_DB_COLUMN__SETATTR); -+ } -+ -+ Oid -+ sepgsqlCheckColumnRelabel(Oid table_oid, AttrNumber attno, DefElem *new_label) -+ { -+ Oid attsid; -+ char relkind; -+ -+ if (!sepgsqlIsEnabled()) -+ { -+ if (new_label) -+ ereport(ERROR, -+ (errcode(ERRCODE_SELINUX_ERROR), -+ errmsg("SELinux is disabled now"))); -+ return InvalidOid; -+ } -+ -+ relkind = get_rel_relkind(table_oid); -+ if (relkind != RELKIND_RELATION) -+ ereport(ERROR, -+ (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), -+ errmsg("Unable to set security label on \"%s.%s\"", -+ get_rel_name(table_oid), -+ get_attname(table_oid, attno)))); -+ -+ attsid = securityTransSecLabelIn(AttributeRelationId, -+ strVal(new_label->arg)); -+ -+ /* db_column:{setattr relabelfrom} for older seclabel */ -+ sepgsqlCheckColumnCommon(table_oid, attno, -+ SEPG_DB_COLUMN__SETATTR | -+ SEPG_DB_COLUMN__RELABELFROM); -+ -+ /* db_column:{relabelto} for newer seclabel */ -+ sepgsqlClientHasPermsSid(AttributeRelationId, attsid, -+ SEPG_CLASS_DB_COLUMN, -+ SEPG_DB_COLUMN__RELABELTO, -+ get_attname(table_oid, attno), true); -+ return attsid; ++ checkTableCommon(seqOid, SEPG_DB_SEQUENCE__SET_VALUE); + } + + /* ------------------------------------------------------------ * + * Hooks corresponding to db_procedure object class + * ------------------------------------------------------------ */ -+ Oid -+ sepgsqlCheckProcedureCreate(const char *proname, -+ Oid namespace_oid, DefElem *new_label) -+ { -+ Oid prosid; -+ -+ if (!sepgsqlIsEnabled()) -+ return InvalidOid; -+ -+ if (!new_label) -+ prosid = sepgsqlGetDefaultProcedureSecLabel(namespace_oid); -+ else -+ prosid = securityTransSecLabelIn(ProcedureRelationId, -+ strVal(new_label->arg)); -+ -+ sepgsqlClientHasPermsSid(ProcedureRelationId, prosid, -+ SEPG_CLASS_DB_PROCEDURE, -+ SEPG_DB_PROCEDURE__CREATE, -+ proname, true); -+ -+ return prosid; -+ } -+ + static bool -+ sepgsqlCheckProcedureCommon(Oid proc_oid, access_vector_t required, bool abort) ++ checkProcedureCommon(Oid procOid, uint32 required, bool abort) + { -+ HeapTuple tuple; -+ bool rc; ++ sepgsql_sid_t proSid; ++ HeapTuple tuple; ++ uint16 tclass; ++ const char *auname; ++ bool rc; + + if (!sepgsqlIsEnabled()) + return true; + + tuple = SearchSysCache(PROCOID, -+ ObjectIdGetDatum(proc_oid), ++ ObjectIdGetDatum(procOid), + 0, 0, 0); + if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for procedure: %u", proc_oid); ++ elog(ERROR, "cache lookup failed for procedure: %u", procOid); ++ ++ auname = NameStr(((Form_pg_proc) GETSTRUCT(tuple))->proname); ++ proSid = sepgsqlGetTupleContext(ProcedureRelationId, ++ tuple, &tclass); ++ rc = sepgsqlClientHasPerms(proSid, tclass, required, ++ auname, abort); + -+ rc = sepgsqlClientHasPermsTup(ProcedureRelationId, tuple, -+ SEPG_CLASS_DB_PROCEDURE, -+ required, abort); + ReleaseSysCache(tuple); + + return rc; + } + -+ void -+ sepgsqlCheckProcedureDrop(Oid proc_oid) ++ Oid ++ sepgsqlCheckProcedureCreate(const char *procName, Oid procOid, ++ Oid procNsp, Oid procLang, DefElem *newLabel) + { -+ sepgsqlCheckProcedureCommon(proc_oid, SEPG_DB_PROCEDURE__DROP, true); ++ sepgsql_sid_t proSid; ++ HeapTuple tuple; ++ uint32 required; ++ ++ if (!sepgsqlIsEnabled()) ++ return InvalidOid; ++ ++ if (!OidIsValid(procOid)) ++ { ++ /* create a new function */ ++ required = SEPG_DB_PROCEDURE__CREATE; ++ if (!newLabel) ++ proSid = sepgsqlGetDefaultProcedureSecid(procNsp); ++ else ++ { ++ proSid.relid = ProcedureRelationId; ++ proSid.secid = securityTransSecLabelIn(proSid.relid, ++ strVal(newLabel->arg)); ++ } ++ } ++ else if (!newLabel) ++ { ++ /* replace an existing function, without any label */ ++ required = SEPG_DB_PROCEDURE__SETATTR; ++ tuple = SearchSysCache(PROCOID, ++ ObjectIdGetDatum(procOid), ++ 0, 0, 0); ++ if (!HeapTupleIsValid(tuple)) ++ elog(ERROR, "cache lookup failed for procedure: %u", procOid); ++ ++ proSid = sepgsqlGetTupleContext(ProcedureRelationId, ++ tuple, NULL); ++ ReleaseSysCache(tuple); ++ } ++ else ++ { ++ /* replace an existing function, with relabeling */ ++ checkProcedureCommon(procOid, ++ SEPG_DB_PROCEDURE__SETATTR | ++ SEPG_DB_PROCEDURE__RELABELFROM, true); ++ ++ required = SEPG_DB_PROCEDURE__RELABELTO; ++ proSid.relid = ProcedureRelationId; ++ proSid.secid = securityTransSecLabelIn(proSid.relid, ++ strVal(newLabel->arg)); ++ } ++ ++ /* Procedural language is trusted? */ ++ tuple = SearchSysCache(LANGOID, ++ ObjectIdGetDatum(procLang), ++ 0, 0, 0); ++ if (!HeapTupleIsValid(tuple)) ++ elog(ERROR, "cache lookup failed for procedural langugage: %u", procLang); ++ ++ if (!((Form_pg_language) GETSTRUCT(tuple))->lanpltrusted) ++ required |= SEPG_DB_PROCEDURE__UNTRUSTED; ++ ++ ReleaseSysCache(tuple); ++ ++ /* check it */ ++ sepgsqlClientHasPerms(proSid, ++ SEPG_CLASS_DB_PROCEDURE, required, ++ procName, true); ++ ++ return proSid.secid; + } + + void -+ sepgsqlCheckProcedureSetattr(Oid proc_oid) ++ sepgsqlCheckProcedureDrop(Oid procOid) + { -+ sepgsqlCheckProcedureCommon(proc_oid, SEPG_DB_PROCEDURE__SETATTR, true); ++ checkProcedureCommon(procOid, SEPG_DB_PROCEDURE__DROP, true); ++ } ++ ++ void ++ sepgsqlCheckProcedureSetattr(Oid procOid) ++ { ++ checkProcedureCommon(procOid, SEPG_DB_PROCEDURE__SETATTR, true); + } + + Oid -+ sepgsqlCheckProcedureRelabel(Oid proc_oid, DefElem *new_label) ++ sepgsqlCheckProcedureRelabel(Oid procOid, DefElem *newLabel) + { -+ Oid prosid; ++ sepgsql_sid_t proSid; + + if (!sepgsqlIsEnabled()) + { -+ if (new_label) ++ if (newLabel) + ereport(ERROR, + (errcode(ERRCODE_SELINUX_ERROR), + errmsg("SELinux is disabled now"))); + return InvalidOid; + } + -+ prosid = securityTransSecLabelIn(ProcedureRelationId, -+ strVal(new_label->arg)); ++ proSid.relid = ProcedureRelationId; ++ proSid.secid = securityTransSecLabelIn(proSid.relid, ++ strVal(newLabel->arg)); + + /* db_procedure:{setattr relabelfrom} for older seclabel */ -+ sepgsqlCheckProcedureCommon(proc_oid, -+ SEPG_DB_PROCEDURE__SETATTR | -+ SEPG_DB_PROCEDURE__RELABELFROM, true); ++ checkProcedureCommon(procOid, ++ SEPG_DB_PROCEDURE__SETATTR | ++ SEPG_DB_PROCEDURE__RELABELFROM, true); + /* db_procedure:{relabelto} for newer seclabel */ -+ sepgsqlClientHasPermsSid(ProcedureRelationId, prosid, -+ SEPG_CLASS_DB_PROCEDURE, -+ SEPG_DB_PROCEDURE__RELABELTO, -+ get_func_name(proc_oid), true); -+ return prosid; ++ sepgsqlClientHasPerms(proSid, ++ SEPG_CLASS_DB_PROCEDURE, ++ SEPG_DB_PROCEDURE__RELABELTO, ++ get_func_name(procOid), true); ++ return proSid.secid; + } + -+ bool -+ sepgsqlCheckProcedureExecute(Oid proc_oid) ++ void ++ sepgsqlCheckProcedureExecute(Oid procOid) + { -+ return sepgsqlCheckProcedureCommon(proc_oid, SEPG_DB_PROCEDURE__EXECUTE, false); ++ checkProcedureCommon(procOid, SEPG_DB_PROCEDURE__EXECUTE, true); + } + + /* + * sepgsqlCheckProcedureInstall + * -+ * -+ * ++ * It should be checked when a procedure is installed as a part of system ++ * internal stuff. + */ + void -+ sepgsqlCheckProcedureInstall(Oid proc_oid) ++ sepgsqlCheckProcedureInstall(Oid procOid) + { -+ if (OidIsValid(proc_oid)) -+ sepgsqlCheckProcedureCommon(proc_oid, SEPG_DB_PROCEDURE__INSTALL, true); ++ if (OidIsValid(procOid)) ++ checkProcedureCommon(procOid, SEPG_DB_PROCEDURE__INSTALL, true); ++ } ++ ++ /* ++ * sepgsqlHintProcedureInlined ++ * ++ * It provides a hint whether the given sql procedure can be inlined, or not. ++ */ ++ bool ++ sepgsqlHintProcedureInlined(HeapTuple protup) ++ { ++ security_context_t newcon; ++ sepgsql_sid_t proSid; ++ ++ if (!sepgsqlIsEnabled()) ++ return true; ++ ++ if (!checkProcedureCommon(HeapTupleGetOid(protup), ++ SEPG_DB_PROCEDURE__EXECUTE, false)) ++ return false; ++ /* ++ * If the security context of client is unchange ++ * before or after invocation of the functions, ++ * it is not a trusted procedure, so it can be ++ * inlined due to performance purpose. ++ */ ++ proSid = sepgsqlGetTupleContext(ProcedureRelationId, ++ protup, NULL); ++ ++ newcon = sepgsqlClientCreateLabel(proSid, SEPG_CLASS_PROCESS); ++ ++ if (strcmp(sepgsqlGetClientLabel(), newcon) == 0) ++ return true; ++ ++ return false; + } + + /* @@ -8964,23 +9478,25 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + { + struct TrustedProcedureCache *tcache; + security_context_t newcon; ++ sepgsql_sid_t proSid; + + if (!sepgsqlIsEnabled()) + return; + -+ newcon = sepgsqlClientCreateLabel(ProcedureRelationId, -+ HeapTupleGetSecLabel(protup), -+ SEPG_CLASS_PROCESS); ++ proSid = sepgsqlGetTupleContext(ProcedureRelationId, ++ protup, NULL); ++ ++ newcon = sepgsqlClientCreateLabel(proSid, SEPG_CLASS_PROCESS); + + /* Do nothing, if it is not a trusted procedure */ + if (strcmp(newcon, sepgsqlGetClientLabel()) == 0) + return; + + /* check db_procedure:{entrypoint} */ -+ sepgsqlClientHasPermsTup(ProcedureRelationId, protup, -+ SEPG_CLASS_DB_PROCEDURE, -+ SEPG_DB_PROCEDURE__ENTRYPOINT, -+ true); ++ sepgsqlClientHasPerms(proSid, ++ SEPG_CLASS_DB_PROCEDURE, ++ SEPG_DB_PROCEDURE__ENTRYPOINT, ++ NULL, true); + + /* check process:{transition} */ + sepgsqlComputePerms(sepgsqlGetClientLabel(), @@ -9005,15 +9521,20 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobCreate(Relation rel, HeapTuple lotup) + { ++ sepgsql_sid_t loSid; ++ Oid relid = RelationGetRelid(rel); ++ + if (!sepgsqlIsEnabled()) + return; + + /* set a default security context */ -+ sepgsqlSetDefaultSecLabel(rel, lotup); -+ sepgsqlClientHasPermsTup(RelationGetRelid(rel), lotup, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__CREATE, -+ true); ++ sepgsqlSetDefaultSecid(rel, lotup); ++ ++ loSid = sepgsqlGetTupleContext(relid, lotup, NULL); ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__CREATE, ++ NULL, true); + } + + /* @@ -9023,13 +9544,17 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobDrop(Relation rel, HeapTuple lotup) + { ++ sepgsql_sid_t loSid; ++ Oid relid = RelationGetRelid(rel); ++ + if (!sepgsqlIsEnabled()) + return; + -+ sepgsqlClientHasPermsTup(RelationGetRelid(rel), lotup, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__DROP, -+ true); ++ loSid = sepgsqlGetTupleContext(relid, lotup, NULL); ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__DROP, ++ NULL, true); + } + + /* @@ -9039,14 +9564,17 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobRead(LargeObjectDesc *lobj) + { ++ sepgsql_sid_t loSid; ++ + if (!sepgsqlIsEnabled()) + return; + -+ sepgsqlClientHasPermsSid(LargeObjectRelationId, -+ lobj->secid, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__READ, -+ NULL, true); ++ loSid.relid = LargeObjectRelationId; ++ loSid.secid = lobj->secid; ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__READ, ++ NULL, true); + } + + /* @@ -9056,14 +9584,17 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobWrite(LargeObjectDesc *lobj) + { ++ sepgsql_sid_t loSid; ++ + if (!sepgsqlIsEnabled()) + return; + -+ sepgsqlClientHasPermsSid(LargeObjectRelationId, -+ lobj->secid, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__WRITE, -+ NULL, true); ++ loSid.relid = LargeObjectRelationId; ++ loSid.secid = lobj->secid; ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__WRITE, ++ NULL, true); + } + + /* @@ -9073,13 +9604,17 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobGetattr(HeapTuple tuple) + { ++ sepgsql_sid_t loSid; ++ + if (!sepgsqlIsEnabled()) + return; + -+ sepgsqlClientHasPermsTup(LargeObjectRelationId, tuple, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__GETATTR, -+ true); ++ loSid.relid = LargeObjectRelationId; ++ loSid.secid = HeapTupleGetSecid(tuple); ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__GETATTR, ++ NULL, true); + } + + /* @@ -9089,13 +9624,17 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobSetattr(HeapTuple tuple) + { ++ sepgsql_sid_t loSid; ++ + if (!sepgsqlIsEnabled()) + return; + -+ sepgsqlClientHasPermsTup(LargeObjectRelationId, tuple, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__SETATTR, -+ true); ++ loSid.relid = LargeObjectRelationId; ++ loSid.secid = HeapTupleGetSecid(tuple); ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__SETATTR, ++ NULL, true); + } + + /* @@ -9106,15 +9645,18 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + sepgsqlCheckBlobExport(LargeObjectDesc *lobj, + int fdesc, const char *filename) + { ++ sepgsql_sid_t loSid; ++ + if (!sepgsqlIsEnabled()) + return; + + /* db_blob:{read export} */ -+ sepgsqlClientHasPermsSid(LargeObjectRelationId, -+ lobj->secid, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__READ | SEPG_DB_BLOB__EXPORT, -+ NULL, true); ++ loSid.relid = LargeObjectRelationId; ++ loSid.secid = lobj->secid; ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__READ | SEPG_DB_BLOB__EXPORT, ++ NULL, true); + /* file:{write} */ + sepgsqlCheckFileWrite(fdesc, filename); + } @@ -9127,15 +9669,18 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + sepgsqlCheckBlobImport(LargeObjectDesc *lobj, + int fdesc, const char *filename) + { ++ sepgsql_sid_t loSid; ++ + if (!sepgsqlIsEnabled()) + return; + + /* db_blob:{write import} */ -+ sepgsqlClientHasPermsSid(LargeObjectRelationId, -+ lobj->secid, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__WRITE | SEPG_DB_BLOB__IMPORT, -+ NULL, true); ++ loSid.relid = LargeObjectRelationId; ++ loSid.secid = lobj->secid; ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__WRITE | SEPG_DB_BLOB__IMPORT, ++ NULL, true); + /* file:{read} */ + sepgsqlCheckFileRead(fdesc, filename); + } @@ -9147,22 +9692,124 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + void + sepgsqlCheckBlobRelabel(HeapTuple oldtup, HeapTuple newtup) + { ++ sepgsql_sid_t loSid; + access_vector_t required = SEPG_DB_BLOB__SETATTR; + -+ if (HeapTupleGetSecLabel(oldtup) != HeapTupleGetSecLabel(newtup)) ++ if (HeapTupleGetSecid(oldtup) != HeapTupleGetSecid(newtup)) + required |= SEPG_DB_BLOB__RELABELFROM; + -+ sepgsqlClientHasPermsTup(LargeObjectRelationId, oldtup, -+ SEPG_CLASS_DB_BLOB, -+ required, -+ true); ++ /* db_blob:{setattr relabelfrom} */ ++ loSid = sepgsqlGetTupleContext(LargeObjectRelationId, oldtup, NULL); ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ required, ++ NULL, true); ++ + if ((required & SEPG_DB_BLOB__RELABELFROM) == 0) + return; + -+ sepgsqlClientHasPermsTup(LargeObjectRelationId, newtup, -+ SEPG_CLASS_DB_BLOB, -+ SEPG_DB_BLOB__RELABELTO, -+ true); ++ /* db_blob:{relabelto} */ ++ loSid = sepgsqlGetTupleContext(LargeObjectRelationId, newtup, NULL); ++ sepgsqlClientHasPerms(loSid, ++ SEPG_CLASS_DB_BLOB, ++ SEPG_DB_BLOB__RELABELTO, ++ NULL, true); ++ } ++ ++ /* ++ * sepgsqlCheckSysobjCreate ++ * ++ * It checks db_tuple:{insert} for system catalog ++ */ ++ Oid ++ sepgsqlCheckSysobjCreate(Oid relid, const char *auditName) ++ { ++ sepgsql_sid_t sysSid; ++ ++ if (!sepgsqlIsEnabled()) ++ return InvalidOid; ++ ++ sysSid = sepgsqlGetDefaultTupleSecid(relid); ++ ++ sepgsqlClientHasPerms(sysSid, ++ SEPG_CLASS_DB_TUPLE, ++ SEPG_DB_TUPLE__INSERT, ++ auditName, true); ++ ++ return sysSid.secid; ++ } ++ ++ /* ++ * sepgsqlCheckSysobjGetattr ++ * ++ * It checks db_tuple:{select} for system catalog ++ */ ++ void ++ sepgsqlCheckSysobjGetattr(Oid relid, Oid secid, const char *auditName) ++ { ++ sepgsql_sid_t sysSid; ++ ++ if (!sepgsqlIsEnabled()) ++ return; ++ ++ sysSid.relid = relid; ++ sysSid.secid = secid; ++ sepgsqlClientHasPerms(sysSid, ++ SEPG_CLASS_DB_TUPLE, ++ SEPG_DB_TUPLE__SELECT, ++ auditName, true); ++ } ++ ++ /* ++ * sepgsqlCheckSysobjSetattr ++ * ++ * It checks db_tuple:{update} for system catalog ++ */ ++ void ++ sepgsqlCheckSysobjSetattr(Oid relid, Oid secid, const char *auditName) ++ { ++ sepgsql_sid_t sysSid; ++ ++ if (!sepgsqlIsEnabled()) ++ return; ++ ++ sysSid.relid = relid; ++ sysSid.secid = secid; ++ sepgsqlClientHasPerms(sysSid, ++ SEPG_CLASS_DB_TUPLE, ++ SEPG_DB_TUPLE__UPDATE, ++ auditName, true); ++ } ++ ++ /* ++ * sepgsqlCheckSysobjDrop ++ * It checks db_xxx:{drop} permission on the given opaque ++ * object, invoked from deleteOneObject() ++ */ ++ void ++ sepgsqlCheckSysobjDrop(const ObjectAddress *object) ++ { ++ switch (object->classId) ++ { ++ case NamespaceRelationId: ++ sepgsqlCheckSchemaDrop(object->objectId); ++ break; ++ ++ case RelationRelationId: ++ if (!object->objectSubId) ++ sepgsqlCheckTableDrop(object->objectId); ++ else ++ sepgsqlCheckColumnDrop(object->objectId, object->objectSubId); ++ break; ++ ++ case ProcedureRelationId: ++ sepgsqlCheckProcedureDrop(object->objectId); ++ break; ++ ++ default: ++ /* do nothing in this version */ ++ break; ++ } + } + + /* @@ -9214,73 +9861,12 @@ diff -Nrpc base/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/securit + { + checkFileCommon(fdesc, filename, SEPG_FILE__WRITE); + } -+ -+ /* -+ * sepgsqlCheckObjectDrop -+ * It checks db_xxx:{drop} permission on the given opaque -+ * object, invoked from deleteOneObject() -+ */ -+ void -+ sepgsqlCheckObjectDrop(const ObjectAddress *object) -+ { -+ switch (object->classId) -+ { -+ case NamespaceRelationId: -+ sepgsqlCheckSchemaDrop(object->objectId); -+ break; -+ -+ case RelationRelationId: -+ sepgsqlCheckTableDrop(object->objectId); -+ break; -+ -+ case AttributeRelationId: -+ sepgsqlCheckColumnDrop(object->objectId, object->objectSubId); -+ break; -+ -+ case ProcedureRelationId: -+ sepgsqlCheckProcedureDrop(object->objectId); -+ break; -+ -+ default: -+ /* do nothing in this version */ -+ break; -+ } -+ } -+ -+ /* -+ * sepgsqlAllowFunctionInlined -+ * It provides the optimizer a hint whether the given SQL function -+ * can be inlined, or not. If it can be configured as a trusted -+ * procedure, we should not allow it inlined. -+ */ -+ bool -+ sepgsqlAllowFunctionInlined(HeapTuple protup) -+ { -+ security_context_t newcon; -+ -+ if (!sepgsqlIsEnabled()) -+ return true; -+ -+ newcon = sepgsqlClientCreateLabel(ProcedureRelationId, -+ HeapTupleGetSecLabel(protup), -+ SEPG_CLASS_PROCESS); -+ /* -+ * If the security context of client is unchange -+ * before or after invocation of the functions, -+ * it is not a trusted procedure, so it can be -+ * inlined due to performance purpose. -+ */ -+ if (strcmp(sepgsqlGetClientLabel(), newcon) == 0) -+ return true; -+ -+ return false; -+ } diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/security/sepgsql/label.c *** base/src/backend/security/sepgsql/label.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/label.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/security/sepgsql/label.c Thu Sep 10 15:18:03 2009 *************** *** 0 **** ---- 1,685 ---- +--- 1,1151 ---- + /* + * src/backend/security/sepgsql/label.c + * SE-PostgreSQL security label management @@ -9293,21 +9879,53 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + #include "access/sysattr.h" + #include "access/xact.h" + #include "catalog/catalog.h" ++ #include "catalog/pg_constraint.h" + #include "catalog/heap.h" + #include "catalog/indexing.h" ++ #include "catalog/namespace.h" ++ #include "catalog/pg_aggregate.h" ++ #include "catalog/pg_amop.h" ++ #include "catalog/pg_amproc.h" ++ #include "catalog/pg_attrdef.h" + #include "catalog/pg_attribute.h" ++ #include "catalog/pg_auth_members.h" ++ #include "catalog/pg_authid.h" ++ #include "catalog/pg_cast.h" + #include "catalog/pg_class.h" ++ #include "catalog/pg_conversion.h" + #include "catalog/pg_database.h" ++ #include "catalog/pg_description.h" ++ #include "catalog/pg_enum.h" ++ #include "catalog/pg_foreign_data_wrapper.h" ++ #include "catalog/pg_foreign_server.h" ++ #include "catalog/pg_inherits.h" ++ #include "catalog/pg_language.h" + #include "catalog/pg_largeobject.h" + #include "catalog/pg_namespace.h" ++ #include "catalog/pg_opclass.h" ++ #include "catalog/pg_operator.h" ++ #include "catalog/pg_opfamily.h" + #include "catalog/pg_proc.h" ++ #include "catalog/pg_rewrite.h" + #include "catalog/pg_security.h" ++ #include "catalog/pg_shdescription.h" ++ #include "catalog/pg_statistic.h" ++ #include "catalog/pg_tablespace.h" ++ #include "catalog/pg_trigger.h" ++ #include "catalog/pg_ts_config.h" ++ #include "catalog/pg_ts_dict.h" ++ #include "catalog/pg_ts_parser.h" ++ #include "catalog/pg_ts_template.h" + #include "catalog/pg_type.h" ++ #include "catalog/pg_user_mapping.h" + #include "miscadmin.h" + #include "nodes/makefuncs.h" + #include "security/sepgsql.h" + #include "storage/fd.h" ++ #include "utils/fmgroids.h" ++ #include "utils/lsyscache.h" + #include "utils/syscache.h" ++ #include "utils/tqual.h" + + /* GUC: to turn on/off row level controls in SE-PostgreSQL */ + bool sepostgresql_row_level; @@ -9316,13 +9934,13 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + bool sepostgresql_use_mcstrans; + + /* -+ * sepgsqlTupleDescHasSecLabel ++ * sepgsqlTupleDescHasSecid + * + * returns a hint whether we should allocate a field to store + * security label on the given relation, or not. + */ + bool -+ sepgsqlTupleDescHasSecLabel(Oid relid, char relkind) ++ sepgsqlTupleDescHasSecid(Oid relid, char relkind) + { + if (!sepgsqlIsEnabled()) + return false; @@ -9330,6 +9948,7 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + if (!OidIsValid(relid)) + return sepostgresql_row_level; /* Target of SELECT INTO */ + ++ /* These system catalogs always have its secid */ + if (relid == DatabaseRelationId || + relid == NamespaceRelationId || + relid == RelationRelationId || @@ -9337,48 +9956,36 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + relid == ProcedureRelationId) + return true; + ++ /* These system catalogs are an external attributes */ ++ if (relid == AggregateRelationId || ++ relid == AccessMethodOperatorRelationId || ++ relid == AccessMethodProcedureRelationId || ++ relid == AttrDefaultRelationId || ++ relid == AuthMemRelationId || ++ relid == ConstraintRelationId || ++ relid == DescriptionRelationId || ++ relid == EnumRelationId || ++ relid == IndexRelationId || ++ relid == InheritsRelationId || ++ relid == RewriteRelationId || ++ relid == SecurityRelationId || ++ relid == SharedDescriptionRelationId || ++ relid == StatisticRelationId || ++ relid == TriggerRelationId) ++ return false; ++ + return sepostgresql_row_level; + } + + /* -+ * sepgsqlMetaSecurityLabel -+ * It returns a security label of tuples within pg_security system -+ * catalog. The purpose of this special handling is to avoid infinite -+ * function invocations to insert new entry for meta security labels. -+ */ -+ security_context_t -+ sepgsqlMetaSecurityLabel(void) -+ { -+ HeapTuple tuple; -+ security_context_t tcontext; -+ Oid tblsid; -+ -+ if (!sepgsqlIsEnabled()) -+ return NULL; -+ -+ tuple = SearchSysCache(RELOID, -+ ObjectIdGetDatum(SecurityRelationId), -+ 0, 0, 0); -+ if (!HeapTupleIsValid(tuple)) -+ elog(ERROR, "cache lookup failed for relation: \"pg_security\""); -+ -+ tblsid = HeapTupleGetSecLabel(tuple); -+ tcontext = securityRawSecLabelOut(RelationRelationId, tblsid); -+ -+ ReleaseSysCache(tuple); -+ -+ return sepgsqlComputeCreate(sepgsqlGetServerLabel(), -+ tcontext, SEPG_CLASS_DB_TUPLE); -+ } -+ -+ /* -+ * sepgsqlGetDefaultDatabaseSecLabel ++ * sepgsqlGetDefaultDatabaseSecid + * It returns the default security label of a database object. + */ -+ Oid -+ sepgsqlGetDefaultDatabaseSecLabel(void) ++ sepgsql_sid_t ++ sepgsqlGetDefaultDatabaseSecid(void) + { + security_context_t seclabel; ++ sepgsql_sid_t sid; + char filename[MAXPGPATH]; + char buffer[1024], *policy_type, *tmp; + FILE *filp; @@ -9411,7 +10018,11 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + + /* An entry found */ + FreeFile(filp); -+ return securityTransSecLabelIn(DatabaseRelationId, seclabel); ++ ++ sid.relid = DatabaseRelationId; ++ sid.secid = securityTransSecLabelIn(sid.relid, seclabel); ++ ++ return sid; + } + FreeFile(filp); + @@ -9419,21 +10030,24 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + seclabel = sepgsqlComputeCreate(sepgsqlGetClientLabel(), + sepgsqlGetClientLabel(), + SEPG_CLASS_DB_DATABASE); -+ return securityTransSecLabelIn(DatabaseRelationId, seclabel); ++ sid.relid = DatabaseRelationId; ++ sid.secid = securityTransSecLabelIn(sid.relid, seclabel); ++ ++ return sid; + } + -+ static Oid -+ defaultSecLabelWithDatabase(Oid relid, Oid datoid, security_class_t tclass) ++ static sepgsql_sid_t ++ defaultSecidWithDatabase(Oid relid, Oid datoid, uint16 tclass) + { -+ HeapTuple tuple; -+ Oid datsid; ++ HeapTuple tuple; ++ sepgsql_sid_t datsid; + + if (IsBootstrapProcessingMode()) + { -+ static Oid cached = InvalidOid; ++ static sepgsql_sid_t cached = { InvalidOid, InvalidOid }; + -+ if (!OidIsValid(cached)) -+ cached = sepgsqlGetDefaultDatabaseSecLabel(); ++ if (!SidIsValid(cached)) ++ cached = sepgsqlGetDefaultDatabaseSecid(); + datsid = cached; + } + else @@ -9443,42 +10057,44 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + 0, 0, 0); + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for database: %u", datoid); -+ datsid = HeapTupleGetSecLabel(tuple); -+ ++ datsid.relid = DatabaseRelationId; ++ datsid.secid = HeapTupleGetSecid(tuple); + ReleaseSysCache(tuple); + } + -+ return sepgsqlClientCreateSecid(DatabaseRelationId, datsid, -+ tclass, relid); ++ return sepgsqlClientCreateSecid(datsid, tclass, relid); + } + -+ Oid -+ sepgsqlGetDefaultSchemaSecLabel(Oid database_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultSchemaSecid(Oid database_oid) + { -+ return defaultSecLabelWithDatabase(NamespaceRelationId, -+ database_oid, SEPG_CLASS_DB_SCHEMA); ++ return defaultSecidWithDatabase(NamespaceRelationId, ++ database_oid, ++ SEPG_CLASS_DB_SCHEMA); + } + -+ Oid -+ sepgsqlGetDefaultSchemaTempSecLabel(Oid database_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultSchemaTempSecid(Oid database_oid) + { -+ return defaultSecLabelWithDatabase(NamespaceRelationId, -+ database_oid, SEPG_CLASS_DB_SCHEMA_TEMP); ++ return defaultSecidWithDatabase(NamespaceRelationId, ++ database_oid, ++ SEPG_CLASS_DB_SCHEMA_TEMP); + } + -+ static Oid -+ defaultSecLabelWithSchema(Oid relid, Oid nspoid, security_class_t tclass) ++ static sepgsql_sid_t ++ defaultSecidWithSchema(Oid relid, Oid nspoid, uint16 tclass) + { -+ HeapTuple tuple; -+ Oid nspsid; ++ HeapTuple tuple; ++ sepgsql_sid_t nspsid; + + if (IsBootstrapProcessingMode()) + { -+ static Oid cached = InvalidOid; ++ static sepgsql_sid_t cached = { InvalidOid, InvalidOid }; + -+ if (!OidIsValid(cached)) -+ cached = sepgsqlGetDefaultSchemaSecLabel(MyDatabaseId); -+ nspsid = cached; ++ if (!SidIsValid(cached)) ++ cached = sepgsqlGetDefaultSchemaSecid(MyDatabaseId); ++ ++ nspsid = sepgsqlGetDefaultSchemaSecid(MyDatabaseId); + } + else + { @@ -9487,45 +10103,43 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + 0, 0, 0); + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for namespace: %u", nspoid); -+ -+ nspsid = HeapTupleGetSecLabel(tuple); -+ ++ nspsid.relid = NamespaceRelationId; ++ nspsid.secid = HeapTupleGetSecid(tuple); + ReleaseSysCache(tuple); + } + -+ return sepgsqlClientCreateSecid(NamespaceRelationId, nspsid, -+ tclass, relid); ++ return sepgsqlClientCreateSecid(nspsid, tclass, relid); + } + -+ Oid -+ sepgsqlGetDefaultTableSecLabel(Oid namespace_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultTableSecid(Oid namespace_oid) + { -+ return defaultSecLabelWithSchema(RelationRelationId, -+ namespace_oid, -+ SEPG_CLASS_DB_TABLE); ++ return defaultSecidWithSchema(RelationRelationId, ++ namespace_oid, ++ SEPG_CLASS_DB_TABLE); + } + -+ Oid -+ sepgsqlGetDefaultSequenceSecLabel(Oid namespace_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultSequenceSecid(Oid namespace_oid) + { -+ return defaultSecLabelWithSchema(RelationRelationId, -+ namespace_oid, -+ SEPG_CLASS_DB_SEQUENCE); ++ return defaultSecidWithSchema(RelationRelationId, ++ namespace_oid, ++ SEPG_CLASS_DB_SEQUENCE); + } + -+ Oid -+ sepgsqlGetDefaultProcedureSecLabel(Oid namespace_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultProcedureSecid(Oid namespace_oid) + { -+ return defaultSecLabelWithSchema(ProcedureRelationId, -+ namespace_oid, -+ SEPG_CLASS_DB_PROCEDURE); ++ return defaultSecidWithSchema(ProcedureRelationId, ++ namespace_oid, ++ SEPG_CLASS_DB_PROCEDURE); + } + -+ static Oid -+ defaultSecLabelWithTable(Oid relid, Oid tbloid, security_class_t tclass) ++ static sepgsql_sid_t ++ defaultSecidWithTable(Oid relid, Oid tbloid, security_class_t tclass) + { -+ HeapTuple tuple; -+ Oid tblsid; ++ HeapTuple tuple; ++ sepgsql_sid_t relsid; + + if (IsBootstrapProcessingMode() + && (tbloid == TypeRelationId || @@ -9533,11 +10147,12 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + tbloid == AttributeRelationId || + tbloid == RelationRelationId)) + { -+ static Oid cached = InvalidOid; ++ static sepgsql_sid_t cached = { InvalidOid, InvalidOid }; + -+ if (!OidIsValid(cached)) -+ cached = sepgsqlGetDefaultTableSecLabel(PG_CATALOG_NAMESPACE); -+ tblsid = cached; ++ if (!SidIsValid(cached)) ++ cached = sepgsqlGetDefaultTableSecid(PG_CATALOG_NAMESPACE); ++ ++ relsid = cached; + } + else + { @@ -9546,88 +10161,88 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + 0, 0, 0); + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for relation: %u", tbloid); -+ -+ tblsid = HeapTupleGetSecLabel(tuple); -+ ++ relsid.relid = RelationRelationId; ++ relsid.secid = HeapTupleGetSecid(tuple); + ReleaseSysCache(tuple); + } + -+ return sepgsqlClientCreateSecid(RelationRelationId, tblsid, -+ tclass, relid); ++ return sepgsqlClientCreateSecid(relsid, tclass, relid); + } + -+ Oid -+ sepgsqlGetDefaultColumnSecLabel(Oid table_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultColumnSecid(Oid table_oid) + { -+ return defaultSecLabelWithTable(AttributeRelationId, -+ table_oid, -+ SEPG_CLASS_DB_COLUMN); ++ return defaultSecidWithTable(AttributeRelationId, ++ table_oid, ++ SEPG_CLASS_DB_COLUMN); + } + -+ Oid -+ sepgsqlGetDefaultTupleSecLabel(Oid table_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultTupleSecid(Oid table_oid) + { -+ return defaultSecLabelWithTable(table_oid, -+ table_oid, -+ SEPG_CLASS_DB_TUPLE); ++ return defaultSecidWithTable(table_oid, ++ table_oid, ++ SEPG_CLASS_DB_TUPLE); + } + -+ Oid -+ sepgsqlGetDefaultBlobSecLabel(Oid database_oid) ++ sepgsql_sid_t ++ sepgsqlGetDefaultBlobSecid(Oid database_oid) + { -+ return defaultSecLabelWithDatabase(LargeObjectRelationId, -+ MyDatabaseId, -+ SEPG_CLASS_DB_BLOB); ++ return defaultSecidWithDatabase(LargeObjectRelationId, ++ MyDatabaseId, ++ SEPG_CLASS_DB_BLOB); + } + + void -+ sepgsqlSetDefaultSecLabel(Relation rel, HeapTuple tuple) ++ sepgsqlSetDefaultSecid(Relation rel, HeapTuple tuple) + { -+ Oid relid = RelationGetRelid(rel); -+ Oid newsid, nspoid, tbloid; ++ Oid relOid = RelationGetRelid(rel); ++ Oid nspOid, tblOid; ++ sepgsql_sid_t newSid; + + if (!sepgsqlIsEnabled()) + return; + -+ if (!HeapTupleHasSecLabel(tuple)) ++ if (!HeapTupleHasSecid(tuple)) + return; + -+ switch (sepgsqlTupleObjectClass(relid, tuple)) ++ switch (sepgsqlTupleObjectClass(relOid, tuple)) + { + case SEPG_CLASS_DB_DATABASE: -+ newsid = sepgsqlGetDefaultDatabaseSecLabel(); ++ newSid = sepgsqlGetDefaultDatabaseSecid(); + break; + case SEPG_CLASS_DB_SCHEMA: -+ newsid = sepgsqlGetDefaultSchemaSecLabel(MyDatabaseId); ++ newSid = sepgsqlGetDefaultSchemaSecid(MyDatabaseId); + break; + case SEPG_CLASS_DB_SCHEMA_TEMP: -+ newsid = sepgsqlGetDefaultSchemaTempSecLabel(MyDatabaseId); ++ newSid = sepgsqlGetDefaultSchemaTempSecid(MyDatabaseId); + break; + case SEPG_CLASS_DB_TABLE: -+ nspoid = ((Form_pg_class) GETSTRUCT(tuple))->relnamespace; -+ newsid = sepgsqlGetDefaultTableSecLabel(nspoid); ++ nspOid = ((Form_pg_class) GETSTRUCT(tuple))->relnamespace; ++ newSid = sepgsqlGetDefaultTableSecid(nspOid); + break; + case SEPG_CLASS_DB_SEQUENCE: -+ nspoid = ((Form_pg_class) GETSTRUCT(tuple))->relnamespace; -+ newsid = sepgsqlGetDefaultSequenceSecLabel(nspoid); ++ nspOid = ((Form_pg_class) GETSTRUCT(tuple))->relnamespace; ++ newSid = sepgsqlGetDefaultSequenceSecid(nspOid); + break; + case SEPG_CLASS_DB_PROCEDURE: -+ nspoid = ((Form_pg_proc) GETSTRUCT(tuple))->pronamespace; -+ newsid = sepgsqlGetDefaultProcedureSecLabel(nspoid); ++ nspOid = ((Form_pg_proc) GETSTRUCT(tuple))->pronamespace; ++ newSid = sepgsqlGetDefaultProcedureSecid(nspOid); + break; + case SEPG_CLASS_DB_COLUMN: -+ tbloid = ((Form_pg_attribute) GETSTRUCT(tuple))->attrelid; -+ newsid = sepgsqlGetDefaultColumnSecLabel(tbloid); ++ tblOid = ((Form_pg_attribute) GETSTRUCT(tuple))->attrelid; ++ newSid = sepgsqlGetDefaultColumnSecid(tblOid); + break; + case SEPG_CLASS_DB_BLOB: -+ newsid = sepgsqlGetDefaultBlobSecLabel(MyDatabaseId); ++ newSid = sepgsqlGetDefaultBlobSecid(MyDatabaseId); + break; + default: -+ newsid = sepgsqlGetDefaultTupleSecLabel(relid); ++ newSid = sepgsqlGetDefaultTupleSecid(relOid); + break; + } + -+ HeapTupleSetSecLabel(tuple, newsid); ++ Assert(newSid.relid == relOid); ++ HeapTupleSetSecid(tuple, newSid.secid); + } + + /* @@ -9647,9 +10262,9 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + const char *relname, Oid namespace_oid, + TupleDesc tupdesc, char relkind) + { -+ Oid *secLabels = NULL; -+ Oid relsid = InvalidOid; -+ int index; ++ sepgsql_sid_t relsid; ++ Oid *secLabels = NULL; ++ int index; + + if (!sepgsqlIsEnabled()) + return NULL; @@ -9679,26 +10294,32 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + { + case RELKIND_RELATION: + if (!stmt || !stmt->secLabel) -+ relsid = sepgsqlGetDefaultTableSecLabel(namespace_oid); ++ relsid = sepgsqlGetDefaultTableSecid(namespace_oid); + else -+ relsid = securityTransSecLabelIn(RelationRelationId, ++ { ++ relsid.relid = RelationRelationId; ++ relsid.secid = securityTransSecLabelIn(relsid.relid, + strVal(((DefElem *)stmt->secLabel)->arg)); -+ sepgsqlClientHasPermsSid(RelationRelationId, relsid, -+ SEPG_CLASS_DB_TABLE, -+ SEPG_DB_TABLE__CREATE, -+ relname, true); ++ } ++ sepgsqlClientHasPerms(relsid, ++ SEPG_CLASS_DB_TABLE, ++ SEPG_DB_TABLE__CREATE, ++ relname, true); + break; + + case RELKIND_SEQUENCE: + if (!stmt || !stmt->secLabel) -+ relsid = sepgsqlGetDefaultSequenceSecLabel(namespace_oid); ++ relsid = sepgsqlGetDefaultSequenceSecid(namespace_oid); + else -+ relsid = securityTransSecLabelIn(RelationRelationId, ++ { ++ relsid.relid = RelationRelationId; ++ relsid.secid = securityTransSecLabelIn(relsid.relid, + strVal(((DefElem *)stmt->secLabel)->arg)); -+ sepgsqlClientHasPermsSid(RelationRelationId, relsid, -+ SEPG_CLASS_DB_SEQUENCE, -+ SEPG_DB_SEQUENCE__CREATE, -+ relname, true); ++ } ++ sepgsqlClientHasPerms(relsid, ++ SEPG_CLASS_DB_SEQUENCE, ++ SEPG_DB_SEQUENCE__CREATE, ++ relname, true); + break; + + default: @@ -9706,11 +10327,11 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s\"", relname))); -+ relsid = sepgsqlGetDefaultTupleSecLabel(RelationRelationId); ++ relsid = sepgsqlGetDefaultTupleSecid(RelationRelationId); + break; + } + /* table's security identifier to be assigned on */ -+ secLabels[0] = relsid; ++ secLabels[0] = relsid.secid; + + /* + * SELinux checks db_column:{create} @@ -9720,8 +10341,8 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + index++) + { + Form_pg_attribute attr; -+ char attname[NAMEDATALEN * 2 + 3]; -+ Oid attsid = InvalidOid; ++ sepgsql_sid_t attsid = { InvalidOid, InvalidOid }; ++ char attname[NAMEDATALEN * 2 + 3]; + + /* skip unnecessary attributes */ + if (index < 0 && (relkind == RELKIND_VIEW || @@ -9747,7 +10368,8 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + if (colDef->secLabel && + strcmp(colDef->colname, NameStr(attr->attname)) == 0) + { -+ attsid = securityTransSecLabelIn(AttributeRelationId, ++ attsid.relid = AttributeRelationId; ++ attsid.secid = securityTransSecLabelIn(attsid.relid, + strVal(((DefElem *)colDef->secLabel)->arg)); + break; + } @@ -9758,29 +10380,29 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + { + case RELKIND_RELATION: + /* compute default column's label if necessary */ -+ if (!OidIsValid(attsid)) -+ attsid = sepgsqlClientCreateSecid(RelationRelationId, relsid, ++ if (!SidIsValid(attsid)) ++ attsid = sepgsqlClientCreateSecid(relsid, + SEPG_CLASS_DB_COLUMN, + AttributeRelationId); + + sprintf(attname, "%s.%s", relname, NameStr(attr->attname)); -+ sepgsqlClientHasPermsSid(AttributeRelationId, attsid, -+ SEPG_CLASS_DB_COLUMN, -+ SEPG_DB_COLUMN__CREATE, -+ attname, true); ++ sepgsqlClientHasPerms(attsid, ++ SEPG_CLASS_DB_COLUMN, ++ SEPG_DB_COLUMN__CREATE, ++ attname, true); + break; + + default: -+ if (OidIsValid(attsid)) ++ if (SidIsValid(attsid)) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("Unable to set security label on \"%s.%s\"", + relname, NameStr(attr->attname)))); -+ attsid = sepgsqlGetDefaultTupleSecLabel(AttributeRelationId); ++ attsid = sepgsqlGetDefaultTupleSecid(AttributeRelationId); + break; + } + /* column's security identifier to be assigend on */ -+ secLabels[index - FirstLowInvalidHeapAttributeNumber] = attsid; ++ secLabels[index - FirstLowInvalidHeapAttributeNumber] = attsid.secid; + } + return secLabels; + } @@ -9819,7 +10441,7 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + elog(ERROR, "cache lookup failed for relation \"%s\"", + RelationGetRelationName(source)); + -+ secLabels[0] = HeapTupleGetSecLabel(tuple); ++ secLabels[0] = HeapTupleGetSecid(tuple); + + ReleaseSysCache(tuple); + @@ -9843,7 +10465,7 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + continue; + + secLabels[index - FirstLowInvalidHeapAttributeNumber] -+ = HeapTupleGetSecLabel(tuple); ++ = HeapTupleGetSecid(tuple); + + ReleaseSysCache(tuple); + } @@ -9852,6 +10474,426 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + } + + /* ++ * sepgsqlGetSysobjContext ++ * ++ * It returns a pair of relid/secid for the given OID. ++ */ ++ static sepgsql_sid_t ++ getSysobjContextDirect(Oid classOid, Oid indexOid, Oid objectId, uint16 *tclass) ++ { ++ sepgsql_sid_t sid = { InvalidOid, InvalidOid }; ++ Relation rel; ++ HeapTuple tup; ++ ScanKeyData skey; ++ SysScanDesc scan; ++ ++ rel = heap_open(CastRelationId, AccessShareLock); ++ ++ ScanKeyInit(&skey, ++ ObjectIdAttributeNumber, ++ BTEqualStrategyNumber, F_OIDEQ, ++ ObjectIdGetDatum(objectId)); ++ ++ scan = systable_beginscan(rel, CastOidIndexId, true, ++ SnapshotNow, 1, &skey); ++ tup = systable_getnext(scan); ++ ++ if (HeapTupleIsValid(tup)) ++ sid = sepgsqlGetTupleContext(classOid, tup, tclass); ++ ++ systable_endscan(scan); ++ ++ heap_close(rel, AccessShareLock); ++ ++ return sid; ++ } ++ ++ sepgsql_sid_t ++ sepgsqlGetSysobjContext(Oid classOid, Oid objectId, int32 objsubId, uint16 *tclass) ++ { ++ sepgsql_sid_t sid = { InvalidOid, InvalidOid }; ++ HeapTuple tup = NULL; ++ ++ switch (classOid) ++ { ++ case AccessMethodRelationId: ++ tup = SearchSysCache(AMOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case AccessMethodOperatorRelationId: ++ return getSysobjContextDirect(AccessMethodOperatorRelationId, ++ AccessMethodOperatorOidIndexId, ++ objectId, tclass); ++ ++ case AccessMethodProcedureRelationId: ++ return getSysobjContextDirect(AccessMethodProcedureRelationId, ++ AccessMethodProcedureOidIndexId, ++ objectId, tclass); ++ ++ case AuthIdRelationId: ++ tup = SearchSysCache(AUTHOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case CastRelationId: ++ return getSysobjContextDirect(CastRelationId, ++ CastOidIndexId, ++ objectId, tclass); ++ ++ case ConstraintRelationId: ++ tup = SearchSysCache(CONSTROID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case ConversionRelationId: ++ tup = SearchSysCache(CONVOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case DatabaseRelationId: ++ tup = SearchSysCache(DATABASEOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case ForeignDataWrapperRelationId: ++ tup = SearchSysCache(FOREIGNDATAWRAPPEROID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case ForeignServerRelationId: ++ tup = SearchSysCache(FOREIGNSERVEROID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case LanguageRelationId: ++ tup = SearchSysCache(LANGOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case LargeObjectRelationId: ++ /* to be replaced by LargeObjectMetaRelationId! */ ++ { ++ Relation rel; ++ ScanKeyData skey; ++ SysScanDesc scan; ++ ++ rel = heap_open(LargeObjectRelationId, AccessShareLock); ++ ++ ScanKeyInit(&skey, ++ Anum_pg_largeobject_loid, ++ BTEqualStrategyNumber, F_OIDEQ, ++ ObjectIdGetDatum(objectId)); ++ ++ scan = systable_beginscan(rel, LargeObjectLOidPNIndexId, ++ true, SnapshotNow, 1, &skey); ++ ++ tup = systable_getnext(scan); ++ ++ if (HeapTupleIsValid(tup)) ++ sid = sepgsqlGetTupleContext(classOid, tup, tclass); ++ ++ systable_endscan(scan); ++ ++ heap_close(rel, AccessShareLock); ++ } ++ return sid; ++ ++ case RelationRelationId: ++ if (objsubId != 0) ++ { ++ classOid = AttributeRelationId; ++ tup = SearchSysCache(ATTNUM, ++ ObjectIdGetDatum(objectId), ++ Int16GetDatum(objsubId), ++ 0, 0); ++ } ++ else ++ { ++ classOid = RelationRelationId; ++ tup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ } ++ break; ++ ++ case NamespaceRelationId: ++ tup = SearchSysCache(NAMESPACEOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case OperatorClassRelationId: ++ tup = SearchSysCache(CLAOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case OperatorFamilyRelationId: ++ tup = SearchSysCache(OPFAMILYOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case OperatorRelationId: ++ tup = SearchSysCache(OPEROID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case ProcedureRelationId: ++ tup = SearchSysCache(PROCOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case RewriteRelationId: ++ return getSysobjContextDirect(RewriteRelationId, ++ RewriteOidIndexId, ++ objectId, tclass); ++ ++ case TableSpaceRelationId: ++ return getSysobjContextDirect(TableSpaceRelationId, ++ TablespaceOidIndexId, ++ objectId, tclass); ++ ++ case TriggerRelationId: ++ return getSysobjContextDirect(TriggerRelationId, ++ TriggerOidIndexId, ++ objectId, tclass); ++ ++ case TSConfigRelationId: ++ tup = SearchSysCache(TSCONFIGOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case TSDictionaryRelationId: ++ tup = SearchSysCache(TSDICTOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case TSParserRelationId: ++ tup = SearchSysCache(TSPARSEROID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case TSTemplateRelationId: ++ tup = SearchSysCache(TSTEMPLATEOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case TypeRelationId: ++ tup = SearchSysCache(TYPEOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ case UserMappingRelationId: ++ tup = SearchSysCache(USERMAPPINGOID, ++ ObjectIdGetDatum(objectId), ++ 0, 0, 0); ++ break; ++ ++ default: ++ elog(ERROR, "unexpected class OID: %u", classOid); ++ break; ++ } ++ ++ if (HeapTupleIsValid(tup)) ++ { ++ sid = sepgsqlGetTupleContext(classOid, tup, tclass); ++ ReleaseSysCache(tup); ++ } ++ ++ return sid; ++ } ++ ++ /* ++ * sepgsqlGetTupleContext ++ * ++ * It returns a pair of relid/secid for the given HeapTuple. ++ * A few system catalogs is handled as an attribute of other ++ * system objects. ++ * E.g) pg_attrdef is an attribute of a certain pg_attribute ++ */ ++ sepgsql_sid_t ++ sepgsqlGetTupleContext(Oid tableOid, HeapTuple tuple, uint16 *tclass) ++ { ++ sepgsql_sid_t sid = { InvalidOid, InvalidOid }; ++ HeapTuple exttup; ++ Oid extid; ++ Oid extcls; ++ AttrNumber extsub; ++ ++ if (tclass) ++ *tclass = SEPG_CLASS_DB_TUPLE; ++ ++ switch (tableOid) ++ { ++ case AggregateRelationId: ++ sid.relid = ProcedureRelationId; ++ extid = ((Form_pg_aggregate) GETSTRUCT(tuple))->aggfnoid; ++ exttup = SearchSysCache(PROCOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case AccessMethodOperatorRelationId: ++ sid.relid = OperatorFamilyRelationId; ++ extid = ((Form_pg_amop) GETSTRUCT(tuple))->amopfamily; ++ exttup = SearchSysCache(OPFAMILYOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case AccessMethodProcedureRelationId: ++ sid.relid = OperatorFamilyRelationId; ++ extid = ((Form_pg_amproc) GETSTRUCT(tuple))->amprocfamily; ++ exttup = SearchSysCache(OPFAMILYOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case AttrDefaultRelationId: ++ sid.relid = AttributeRelationId; ++ extid = ((Form_pg_attrdef) GETSTRUCT(tuple))->adrelid; ++ extsub = ((Form_pg_attrdef) GETSTRUCT(tuple))->adnum; ++ exttup = SearchSysCache(ATTNUM, ++ ObjectIdGetDatum(extid), ++ Int16GetDatum(extsub), ++ 0, 0); ++ break; ++ ++ case AuthMemRelationId: ++ sid.relid = AuthIdRelationId; ++ extid = ((Form_pg_auth_members) GETSTRUCT(tuple))->roleid; ++ exttup = SearchSysCache(AUTHOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case ConstraintRelationId: ++ /* CHECK constraint is an attribute of the relation */ ++ extid = ((Form_pg_constraint) GETSTRUCT(tuple))->conrelid; ++ if (OidIsValid(extid)) ++ { ++ sid.relid = RelationRelationId; ++ exttup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ } ++ /* DOMAIN constraint is an attribute of the domain type */ ++ extid = ((Form_pg_constraint) GETSTRUCT(tuple))->contypid; ++ if (OidIsValid(extid)) ++ { ++ sid.relid = TypeRelationId; ++ exttup = SearchSysCache(TYPEOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ } ++ /* Database's context for global assertion */ ++ sid.relid = DatabaseRelationId; ++ exttup = SearchSysCache(DATABASEOID, ++ ObjectIdGetDatum(MyDatabaseId), ++ 0, 0, 0); ++ break; ++ ++ case DescriptionRelationId: ++ /* recursive call */ ++ extid = ((Form_pg_description) GETSTRUCT(tuple))->objoid; ++ extcls = ((Form_pg_description) GETSTRUCT(tuple))->classoid; ++ return sepgsqlGetSysobjContext(extcls, extid, 0, tclass); ++ ++ case EnumRelationId: ++ sid.relid = TypeRelationId; ++ extid = ((Form_pg_enum) GETSTRUCT(tuple))->enumtypid; ++ exttup = SearchSysCache(TYPEOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case IndexRelationId: ++ sid.relid = RelationRelationId; ++ extid = ((Form_pg_index) GETSTRUCT(tuple))->indexrelid; ++ exttup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case InheritsRelationId: ++ sid.relid = RelationRelationId; ++ extid = ((Form_pg_inherits) GETSTRUCT(tuple))->inhrelid; ++ exttup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case RewriteRelationId: ++ sid.relid = RelationRelationId; ++ extid = ((Form_pg_rewrite) GETSTRUCT(tuple))->ev_class; ++ exttup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ case SharedDescriptionRelationId: ++ /* recursive invocation */ ++ extid = ((Form_pg_shdescription) GETSTRUCT(tuple))->objoid; ++ extcls = ((Form_pg_shdescription) GETSTRUCT(tuple))->classoid; ++ return sepgsqlGetSysobjContext(extcls, extid, 0, tclass); ++ ++ case StatisticRelationId: ++ sid.relid = AttributeRelationId; ++ extid = ((Form_pg_statistic) GETSTRUCT(tuple))->starelid; ++ extsub = ((Form_pg_statistic) GETSTRUCT(tuple))->staattnum; ++ exttup = SearchSysCache(ATTNUM, ++ ObjectIdGetDatum(extid), ++ Int16GetDatum(extsub), ++ 0, 0); ++ break; ++ ++ case TriggerRelationId: ++ sid.relid = RelationRelationId; ++ extid = ((Form_pg_trigger) GETSTRUCT(tuple))->tgrelid; ++ exttup = SearchSysCache(RELOID, ++ ObjectIdGetDatum(extid), ++ 0, 0, 0); ++ break; ++ ++ default: ++ exttup = tuple; ++ sid.relid = tableOid; ++ break; ++ } ++ ++ if (HeapTupleIsValid(exttup)) ++ { ++ sid.secid = HeapTupleGetSecid(exttup); ++ ++ if (tclass) ++ *tclass = sepgsqlTupleObjectClass(sid.relid, exttup); ++ ++ if (exttup != tuple) ++ ReleaseSysCache(exttup); ++ } ++ return sid; ++ } ++ ++ /* + * sepgsqlRawSecLabelIn + * correctness checks for the given security context + */ @@ -9966,9 +11008,19 @@ diff -Nrpc base/src/backend/security/sepgsql/label.c sepgsql/src/backend/securit + + return result; + } ++ ++ char * ++ sepgsqlSysattSecLabelOut(Oid relid, HeapTuple tuple) ++ { ++ sepgsql_sid_t sid; ++ ++ sid = sepgsqlGetTupleContext(relid, tuple, NULL); ++ ++ return securityTransSecLabelOut(sid.relid, sid.secid); ++ } diff -Nrpc base/src/backend/security/sepgsql/misc.c sepgsql/src/backend/security/sepgsql/misc.c *** base/src/backend/security/sepgsql/misc.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/misc.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/security/sepgsql/misc.c Sun Aug 23 23:05:48 2009 *************** *** 0 **** --- 1,304 ---- @@ -10048,7 +11100,7 @@ diff -Nrpc base/src/backend/security/sepgsql/misc.c sepgsql/src/backend/security + } + PG_END_TRY(); + -+ return new_client; ++ return old_client; + } + + /* @@ -10278,10 +11330,10 @@ diff -Nrpc base/src/backend/security/sepgsql/misc.c sepgsql/src/backend/security + } diff -Nrpc base/src/backend/security/sepgsql/perms.c sepgsql/src/backend/security/sepgsql/perms.c *** base/src/backend/security/sepgsql/perms.c Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/perms.c Thu Jul 16 17:22:29 2009 +--- sepgsql/src/backend/security/sepgsql/perms.c Sun Sep 6 19:31:39 2009 *************** *** 0 **** ---- 1,463 ---- +--- 1,464 ---- + /* + * src/backend/utils/sepgsql/perms.c + * SE-PostgreSQL permission checks @@ -10389,7 +11441,7 @@ diff -Nrpc base/src/backend/security/sepgsql/perms.c sepgsql/src/backend/securit + { "setattr", SEPG_DB_DATABASE__SETATTR }, + { "relabelfrom", SEPG_DB_DATABASE__RELABELFROM }, + { "relabelto", SEPG_DB_DATABASE__RELABELTO }, -+ { "connect", SEPG_DB_DATABASE__CONNECT }, ++ { "access", SEPG_DB_DATABASE__ACCESS }, + { "install_module", SEPG_DB_DATABASE__INSTALL_MODULE }, + { "load_module", SEPG_DB_DATABASE__LOAD_MODULE }, + { "superuser", SEPG_DB_DATABASE__SUPERUSER }, @@ -10405,9 +11457,9 @@ diff -Nrpc base/src/backend/security/sepgsql/perms.c sepgsql/src/backend/securit + { "setattr", SEPG_DB_SCHEMA__SETATTR }, + { "relabelfrom", SEPG_DB_SCHEMA__RELABELFROM }, + { "relabelto", SEPG_DB_SCHEMA__RELABELTO }, -+ { "search", SEPG_DB_SCHEMA__USAGE }, -+ { "add_object", SEPG_DB_SCHEMA__ADD_OBJECT }, -+ { "remove_object", SEPG_DB_SCHEMA__REMOVE_OBJECT }, ++ { "search", SEPG_DB_SCHEMA__SEARCH }, ++ { "add_name", SEPG_DB_SCHEMA__ADD_NAME }, ++ { "remove_name", SEPG_DB_SCHEMA__REMOVE_NAME }, + { NULL, 0UL }, + } + }, @@ -10420,9 +11472,9 @@ diff -Nrpc base/src/backend/security/sepgsql/perms.c sepgsql/src/backend/securit + { "setattr", SEPG_DB_SCHEMA_TEMP__SETATTR }, + { "relabelfrom", SEPG_DB_SCHEMA_TEMP__RELABELFROM }, + { "relabelto", SEPG_DB_SCHEMA_TEMP__RELABELTO }, -+ { "usage", SEPG_DB_SCHEMA_TEMP__USAGE }, -+ { "add_object", SEPG_DB_SCHEMA_TEMP__ADD_OBJECT }, -+ { "remove_object", SEPG_DB_SCHEMA_TEMP__REMOVE_OBJECT }, ++ { "search", SEPG_DB_SCHEMA_TEMP__SEARCH }, ++ { "add_name", SEPG_DB_SCHEMA_TEMP__ADD_NAME }, ++ { "remove_name", SEPG_DB_SCHEMA_TEMP__REMOVE_NAME }, + { NULL, 0UL }, + } + }, @@ -10471,6 +11523,7 @@ diff -Nrpc base/src/backend/security/sepgsql/perms.c sepgsql/src/backend/securit + { "execute", SEPG_DB_PROCEDURE__EXECUTE }, + { "entrypoint", SEPG_DB_PROCEDURE__ENTRYPOINT }, + { "install", SEPG_DB_PROCEDURE__INSTALL }, ++ { "untrusted", SEPG_DB_PROCEDURE__UNTRUSTED }, + { NULL, 0UL }, + } + }, @@ -10799,11 +11852,11 @@ diff -Nrpc base/src/backend/security/sepgsql/policy/sepostgresql-devel.fc.templa + diff -Nrpc base/src/backend/security/sepgsql/policy/sepostgresql-devel.te sepgsql/src/backend/security/sepgsql/policy/sepostgresql-devel.te *** base/src/backend/security/sepgsql/policy/sepostgresql-devel.te Thu Jan 1 09:00:00 1970 ---- sepgsql/src/backend/security/sepgsql/policy/sepostgresql-devel.te Wed Jul 15 19:35:52 2009 +--- sepgsql/src/backend/security/sepgsql/policy/sepostgresql-devel.te Thu Sep 10 15:43:44 2009 *************** *** 0 **** ---- 1,119 ---- -+ policy_module(sepostgresql-devel, 3.27) +--- 1,121 ---- ++ policy_module(sepostgresql-devel, 3.28) + + gen_require(` + class db_database all_db_database_perms; @@ -10896,6 +11949,7 @@ diff -Nrpc base/src/backend/security/sepgsql/policy/sepostgresql-devel.te sepgsq + auditallow domain sepgsql_table_type : db_table *; + auditallow domain sepgsql_table_type : db_column *; + auditallow domain sepgsql_table_type : db_tuple { relabelfrom relabelto }; ++ auditallow domain sepgsql_sysobj_table_type : db_tuple *; + auditallow domain sepgsql_procedure_type : db_procedure *; + auditallow domain sepgsql_blob_type : db_blob *; + auditallow domain sepgsql_module_type : db_database { install_module }; @@ -10907,6 +11961,7 @@ diff -Nrpc base/src/backend/security/sepgsql/policy/sepostgresql-devel.te sepgsq + dontaudit domain sepgsql_table_type : db_table *; + dontaudit domain sepgsql_table_type : db_column *; + dontaudit domain sepgsql_table_type : db_tuple { relabelfrom relabelto }; ++ dontaudit domain sepgsql_sysobj_table_type : db_tuple *; + dontaudit domain sepgsql_procedure_type : db_procedure *; + dontaudit domain sepgsql_blob_type : db_blob *; + dontaudit domain sepgsql_module_type : db_database { install_module }; @@ -10966,7 +12021,7 @@ diff -Nrpc base/src/backend/storage/ipc/ipci.c sepgsql/src/backend/storage/ipc/i addin_request_allowed = false; diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/storage/large_object/inv_api.c *** base/src/backend/storage/large_object/inv_api.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/storage/large_object/inv_api.c Wed Jul 15 19:48:58 2009 +--- sepgsql/src/backend/storage/large_object/inv_api.c Tue Sep 8 23:55:48 2009 *************** *** 39,44 **** --- 39,45 ---- @@ -11037,7 +12092,7 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s ! if (HeapTupleIsValid(tuple)) ! { retval = true; -+ lobj->secid = HeapTupleGetSecLabel(tuple); ++ lobj->secid = HeapTupleGetSecid(tuple); + } systable_endscan(sd); @@ -11065,8 +12120,8 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s replace[Anum_pg_largeobject_data - 1] = true; newtup = heap_modify_tuple(oldtuple, RelationGetDescr(lo_heap_r), values, nulls, replace); -+ if (HeapTupleHasSecLabel(newtup)) -+ HeapTupleSetSecLabel(newtup, obj_desc->secid); ++ if (HeapTupleHasSecid(newtup)) ++ HeapTupleSetSecid(newtup, obj_desc->secid); simple_heap_update(lo_heap_r, &newtup->t_self, newtup); CatalogIndexInsert(indstate, newtup); heap_freetuple(newtup); @@ -11076,8 +12131,8 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s values[Anum_pg_largeobject_pageno - 1] = Int32GetDatum(pageno); values[Anum_pg_largeobject_data - 1] = PointerGetDatum(&workbuf); newtup = heap_form_tuple(lo_heap_r->rd_att, values, nulls); -+ if (HeapTupleHasSecLabel(newtup)) -+ HeapTupleSetSecLabel(newtup, obj_desc->secid); ++ if (HeapTupleHasSecid(newtup)) ++ HeapTupleSetSecid(newtup, obj_desc->secid); simple_heap_insert(lo_heap_r, newtup); CatalogIndexInsert(indstate, newtup); heap_freetuple(newtup); @@ -11087,8 +12142,8 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s values[Anum_pg_largeobject_pageno - 1] = Int32GetDatum(pageno); values[Anum_pg_largeobject_data - 1] = PointerGetDatum(&workbuf); newtup = heap_form_tuple(lo_heap_r->rd_att, values, nulls); -+ if (HeapTupleHasSecLabel(newtup)) -+ HeapTupleSetSecLabel(newtup, obj_desc->secid); ++ if (HeapTupleHasSecid(newtup)) ++ HeapTupleSetSecid(newtup, obj_desc->secid); simple_heap_insert(lo_heap_r, newtup); CatalogIndexInsert(indstate, newtup); heap_freetuple(newtup); @@ -11125,7 +12180,7 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s + * SELinux: check db_blob:{getattr} + */ + sepgsqlCheckBlobGetattr(tuple); -+ secid = HeapTupleGetSecLabel(tuple); ++ secid = HeapTupleGetSecid(tuple); + } + systable_endscan(scan); + @@ -11166,10 +12221,10 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s + + newtuple = heap_modify_tuple(tuple, RelationGetDescr(rel), + values, nulls, replaces); -+ if (!HeapTupleHasSecLabel(newtuple)) ++ if (!HeapTupleHasSecid(newtuple)) + elog(ERROR, "Unable to assign security label on \"%s\"", + RelationGetRelationName(rel)); -+ HeapTupleSetSecLabel(newtuple, secid); ++ HeapTupleSetSecid(newtuple, secid); + + /* + * SELinux: check db_blob:{setattr relabelfrom relabelto} @@ -11194,6 +12249,35 @@ diff -Nrpc base/src/backend/storage/large_object/inv_api.c sepgsql/src/backend/s + (errcode(ERRCODE_UNDEFINED_OBJECT), + errmsg("large object %u does not exist", loid))); + } +diff -Nrpc base/src/backend/tcop/fastpath.c sepgsql/src/backend/tcop/fastpath.c +*** base/src/backend/tcop/fastpath.c Sat Jan 3 13:01:35 2009 +--- sepgsql/src/backend/tcop/fastpath.c Mon Sep 7 00:55:45 2009 +*************** +*** 26,31 **** +--- 26,32 ---- + #include "libpq/pqformat.h" + #include "mb/pg_wchar.h" + #include "miscadmin.h" ++ #include "security/sepgsql.h" + #include "tcop/fastpath.h" + #include "tcop/tcopprot.h" + #include "utils/acl.h" +*************** HandleFunctionRequest(StringInfo msgBuf) +*** 343,353 **** +--- 344,356 ---- + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_NAMESPACE, + get_namespace_name(fip->namespace)); ++ sepgsqlCheckSchemaSearch(fip->namespace, true); + + aclresult = pg_proc_aclcheck(fid, GetUserId(), ACL_EXECUTE); + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_PROC, + get_func_name(fid)); ++ sepgsqlCheckProcedureExecute(fid); + + /* + * Prepare function call info block and insert arguments. diff -Nrpc base/src/backend/tcop/pquery.c sepgsql/src/backend/tcop/pquery.c *** base/src/backend/tcop/pquery.c Thu Jun 18 10:20:52 2009 --- sepgsql/src/backend/tcop/pquery.c Wed Jul 15 19:30:50 2009 @@ -11415,25 +12499,25 @@ diff -Nrpc base/src/backend/utils/adt/ri_triggers.c sepgsql/src/backend/utils/ad diff -Nrpc base/src/backend/utils/adt/trigfuncs.c sepgsql/src/backend/utils/adt/trigfuncs.c *** base/src/backend/utils/adt/trigfuncs.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/adt/trigfuncs.c Wed Jul 15 19:30:50 2009 +--- sepgsql/src/backend/utils/adt/trigfuncs.c Tue Sep 8 23:55:48 2009 *************** suppress_redundant_updates_trigger(PG_FU *** 76,81 **** --- 76,85 ---- !OidIsValid(HeapTupleHeaderGetOid(newheader))) HeapTupleHeaderSetOid(newheader, HeapTupleHeaderGetOid(oldheader)); -+ if (HeapTupleHeaderHasSecLabel(newheader) && -+ !OidIsValid(HeapTupleHeaderGetSecLabel(newheader))) -+ HeapTupleHeaderSetSecLabel(newheader, HeapTupleHeaderGetSecLabel(oldheader)); ++ if (HeapTupleHeaderHasSecid(newheader) && ++ !OidIsValid(HeapTupleHeaderGetSecid(newheader))) ++ HeapTupleHeaderSetSecid(newheader, HeapTupleHeaderGetSecid(oldheader)); + /* if the tuple payload is the same ... */ if (newtuple->t_len == oldtuple->t_len && newheader->t_hoff == oldheader->t_hoff && diff -Nrpc base/src/backend/utils/cache/plancache.c sepgsql/src/backend/utils/cache/plancache.c -*** base/src/backend/utils/cache/plancache.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/cache/plancache.c Wed Jul 15 19:30:50 2009 +*** base/src/backend/utils/cache/plancache.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/utils/cache/plancache.c Sun Sep 6 19:53:10 2009 *************** PlanCacheComputeResultDesc(List *stmt_li -*** 847,858 **** +*** 859,870 **** if (IsA(node, Query)) { query = (Query *) node; @@ -11446,7 +12530,7 @@ diff -Nrpc base/src/backend/utils/cache/plancache.c sepgsql/src/backend/utils/ca } /* other cases shouldn't happen, but return NULL */ break; ---- 847,858 ---- +--- 859,870 ---- if (IsA(node, Query)) { query = (Query *) node; @@ -11460,7 +12544,7 @@ diff -Nrpc base/src/backend/utils/cache/plancache.c sepgsql/src/backend/utils/ca /* other cases shouldn't happen, but return NULL */ break; *************** PlanCacheComputeResultDesc(List *stmt_li -*** 863,875 **** +*** 875,887 **** { query = (Query *) node; Assert(query->returningList); @@ -11474,7 +12558,7 @@ diff -Nrpc base/src/backend/utils/cache/plancache.c sepgsql/src/backend/utils/ca } /* other cases shouldn't happen, but return NULL */ break; ---- 863,876 ---- +--- 875,888 ---- { query = (Query *) node; Assert(query->returningList); @@ -11491,7 +12575,7 @@ diff -Nrpc base/src/backend/utils/cache/plancache.c sepgsql/src/backend/utils/ca break; diff -Nrpc base/src/backend/utils/cache/relcache.c sepgsql/src/backend/utils/cache/relcache.c *** base/src/backend/utils/cache/relcache.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/cache/relcache.c Wed Jul 15 19:30:50 2009 +--- sepgsql/src/backend/utils/cache/relcache.c Wed Sep 9 13:14:37 2009 *************** *** 47,52 **** --- 47,53 ---- @@ -11508,9 +12592,9 @@ diff -Nrpc base/src/backend/utils/cache/relcache.c sepgsql/src/backend/utils/cac /* extract reloptions if any */ RelationParseRelOptions(relation, pg_class_tuple); -+ /* Fixup relation->rd_att->tdhasseclabel */ -+ RelationGetDescr(relation)->tdhasseclabel -+ = securityTupleDescHasSecLabel(relid, relp->relkind); ++ /* Fixup relation->rd_att->tdhassecid */ ++ RelationGetDescr(relation)->tdhassecid ++ = securityTupleDescHasSecid(relid, relp->relkind); + /* * initialize the relation lock manager information @@ -11521,10 +12605,10 @@ diff -Nrpc base/src/backend/utils/cache/relcache.c sepgsql/src/backend/utils/cac RelationGetRelid(relation) = relation->rd_att->attrs[0]->attrelid; relation->rd_rel->relfilenode = RelationGetRelid(relation); -+ /* Fixup relation->rd_att->tdhasseclabel */ -+ RelationGetDescr(relation)->tdhasseclabel -+ = securityTupleDescHasSecLabel(RelationGetRelid(relation), -+ RELKIND_RELATION); ++ /* Fixup relation->rd_att->tdhassecid */ ++ RelationGetDescr(relation)->tdhassecid ++ = securityTupleDescHasSecid(RelationGetRelid(relation), ++ RELKIND_RELATION); + /* * initialize the relation lock manager information @@ -11538,9 +12622,9 @@ diff -Nrpc base/src/backend/utils/cache/relcache.c sepgsql/src/backend/utils/cac + /* + * NOTE: we assume the returned TupleDesc is only used for + * references to toast'ed data, and it is not delivered to -+ * heap_form_tuple(), so TupleDesc->tdhasseclabel don't give us ++ * heap_form_tuple(), so TupleDesc->tdhassecid don't give us + * any effect. -+ * We omit to invoke securityTupleDescHasSecLabel() here. ++ * We omit to invoke securityTupleDescHasSecid() here. + */ for (i = 0; i < natts; i++) @@ -11551,17 +12635,17 @@ diff -Nrpc base/src/backend/utils/cache/relcache.c sepgsql/src/backend/utils/cac rel->rd_options = NULL; } -+ /* Fixup rel->rd_att->tdhasseclabel */ -+ RelationGetDescr(rel)->tdhasseclabel -+ = securityTupleDescHasSecLabel(RelationGetRelid(rel), -+ RelationGetForm(rel)->relkind); ++ /* Fixup rel->rd_att->tdhassecid */ ++ RelationGetDescr(rel)->tdhassecid ++ = securityTupleDescHasSecid(RelationGetRelid(rel), ++ RelationGetForm(rel)->relkind); + /* mark not-null status */ if (has_not_null) { diff -Nrpc base/src/backend/utils/cache/syscache.c sepgsql/src/backend/utils/cache/syscache.c *** base/src/backend/utils/cache/syscache.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/cache/syscache.c Thu Jul 16 23:18:11 2009 +--- sepgsql/src/backend/utils/cache/syscache.c Wed Sep 9 21:29:33 2009 *************** *** 41,46 **** --- 41,47 ---- @@ -11605,9 +12689,19 @@ diff -Nrpc base/src/backend/utils/cache/syscache.c sepgsql/src/backend/utils/cac {StatisticRelationId, /* STATRELATT */ StatisticRelidAttnumIndexId, Anum_pg_statistic_starelid, +*************** GetSysCacheOid(int cacheId, +*** 931,937 **** + return result; + } + +- + /* + * SearchSysCacheAttName + * +--- 956,961 ---- diff -Nrpc base/src/backend/utils/fmgr/dfmgr.c sepgsql/src/backend/utils/fmgr/dfmgr.c -*** base/src/backend/utils/fmgr/dfmgr.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/fmgr/dfmgr.c Wed Jul 15 19:48:58 2009 +*** base/src/backend/utils/fmgr/dfmgr.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/utils/fmgr/dfmgr.c Sun Sep 6 19:53:10 2009 *************** *** 23,28 **** --- 23,29 ---- @@ -11666,8 +12760,8 @@ diff -Nrpc base/src/backend/utils/fmgr/fmgr.c sepgsql/src/backend/utils/fmgr/fmg } diff -Nrpc base/src/backend/utils/init/postinit.c sepgsql/src/backend/utils/init/postinit.c -*** base/src/backend/utils/init/postinit.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/init/postinit.c Thu Jul 16 17:22:29 2009 +*** base/src/backend/utils/init/postinit.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/utils/init/postinit.c Mon Sep 7 00:55:45 2009 *************** *** 32,37 **** --- 32,38 ---- @@ -11679,32 +12773,37 @@ diff -Nrpc base/src/backend/utils/init/postinit.c sepgsql/src/backend/utils/init #include "storage/bufmgr.h" #include "storage/fd.h" *************** CheckMyDatabase(const char *name, bool a -*** 200,211 **** +*** 201,207 **** name))); /* ! * Check privilege to connect to the database. (The am_superuser test -! * is redundant, but since we have the flag, might as well check it -! * and save a few cycles.) + * is redundant, but since we have the flag, might as well check it + * and save a few cycles.) */ -! if (!am_superuser && -! pg_database_aclcheck(MyDatabaseId, GetUserId(), - ACL_CONNECT) != ACLCHECK_OK) - ereport(FATAL, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), ---- 201,209 ---- +--- 202,208 ---- name))); /* -! * Check privilege to connect to the database. +! * Check privilege to connect to the database. (The am_superuser test + * is redundant, but since we have the flag, might as well check it + * and save a few cycles.) */ -! if (pg_database_aclcheck(MyDatabaseId, GetUserId(), - ACL_CONNECT) != ACLCHECK_OK) - ereport(FATAL, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), +*************** CheckMyDatabase(const char *name, bool a +*** 213,218 **** +--- 214,222 ---- + errmsg("permission denied for database \"%s\"", name), + errdetail("User does not have CONNECT privilege."))); + ++ /* SELinux: db_database:{access} */ ++ sepgsqlCheckDatabaseAccess(MyDatabaseId); ++ + /* + * Check connection limit for this database. + * *************** InitPostgres(const char *in_dbname, Oid -*** 574,579 **** ---- 572,580 ---- +*** 575,580 **** +--- 579,587 ---- */ RelationCacheInitializePhase2(); @@ -11715,8 +12814,8 @@ diff -Nrpc base/src/backend/utils/init/postinit.c sepgsql/src/backend/utils/init * Figure out our postgres user id, and see if we are a superuser. * diff -Nrpc base/src/backend/utils/misc/guc.c sepgsql/src/backend/utils/misc/guc.c -*** base/src/backend/utils/misc/guc.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/backend/utils/misc/guc.c Wed Jul 15 19:39:56 2009 +*** base/src/backend/utils/misc/guc.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/utils/misc/guc.c Sun Sep 6 19:53:10 2009 *************** *** 56,61 **** --- 56,62 ---- @@ -11763,8 +12862,8 @@ diff -Nrpc base/src/backend/utils/misc/guc.c sepgsql/src/backend/utils/misc/guc. /* End-of-list marker */ { diff -Nrpc base/src/backend/utils/misc/postgresql.conf.sample sepgsql/src/backend/utils/misc/postgresql.conf.sample -*** base/src/backend/utils/misc/postgresql.conf.sample Tue Apr 28 16:52:59 2009 ---- sepgsql/src/backend/utils/misc/postgresql.conf.sample Thu Jul 16 23:18:11 2009 +*** base/src/backend/utils/misc/postgresql.conf.sample Sun Sep 6 19:40:49 2009 +--- sepgsql/src/backend/utils/misc/postgresql.conf.sample Thu Sep 10 00:06:47 2009 *************** *** 51,57 **** @@ -11791,11 +12890,12 @@ diff -Nrpc base/src/backend/utils/misc/postgresql.conf.sample sepgsql/src/backen #------------------------------------------------------------------------------ # RESOURCE USAGE (except WAL) ---- 95,101 ---- +--- 95,102 ---- # 0 selects the system default #tcp_keepalives_count = 0 # TCP_KEEPCNT; # 0 selects the system default ! #sepostgresql = off # SE-PostgreSQL support +! sepostgresql = on #------------------------------------------------------------------------------ # RESOURCE USAGE (except WAL) @@ -11918,52 +13018,48 @@ diff -Nrpc base/src/bin/initdb/initdb.c sepgsql/src/bin/initdb/initdb.c show_setting = true; break; diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c -*** base/src/bin/pg_dump/pg_dump.c Thu Jun 18 10:20:52 2009 ---- sepgsql/src/bin/pg_dump/pg_dump.c Wed Jul 15 20:03:59 2009 +*** base/src/bin/pg_dump/pg_dump.c Sun Sep 6 19:40:49 2009 +--- sepgsql/src/bin/pg_dump/pg_dump.c Tue Sep 8 17:13:41 2009 *************** static int disable_dollar_quoting = 0; -*** 111,116 **** ---- 111,119 ---- +*** 112,117 **** +--- 112,119 ---- static int dump_inserts = 0; static int column_inserts = 0; -+ /* flag to turn on/off security_label and security_acl */ -+ static int security_label = 0; -+ static int security_acl = 0; ++ /* flag to turn on/off security_context */ ++ static int security_context = 0; static void help(const char *progname); static void expand_schema_name_patterns(SimpleStringList *patterns, *************** main(int argc, char **argv) -*** 276,281 **** ---- 279,286 ---- +*** 277,282 **** +--- 279,285 ---- {"no-tablespaces", no_argument, &outputNoTablespaces, 1}, {"role", required_argument, NULL, 3}, {"use-set-session-authorization", no_argument, &use_setsessauth, 1}, -+ {"security-label", no_argument, &security_label, 1}, -+ {"security-acl", no_argument, &security_acl, 1}, ++ {"security-context", no_argument, &security_context, 1}, {NULL, 0, NULL, 0} }; *************** main(int argc, char **argv) -*** 424,429 **** ---- 429,438 ---- +*** 425,430 **** +--- 428,435 ---- outputNoTablespaces = 1; else if (strcmp(optarg, "use-set-session-authorization") == 0) use_setsessauth = 1; -+ else if (strcmp(optarg, "security-label") == 0) -+ security_label = 1; -+ else if (strcmp(optarg, "security-acl") == 0) -+ security_acl = 1; ++ else if (strcmp(optarg, "security-context") == 0) ++ security_context = 1; else { fprintf(stderr, *************** main(int argc, char **argv) -*** 572,577 **** ---- 581,608 ---- +*** 573,578 **** +--- 578,605 ---- std_strings = PQparameterStatus(g_conn, "standard_conforming_strings"); g_fout->std_strings = (std_strings && strcmp(std_strings, "on") == 0); + /* Check availability of SE-PostgreSQL */ -+ if (security_label > 0) ++ if (security_context > 0) + { + PGresult *res; + @@ -11981,15 +13077,15 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c + * It needs to force column insertion mode, when --inserts + * and either --security-label or --security-acl is given. + */ -+ if ((security_label > 0 || security_acl > 0) && dump_inserts) ++ if (security_context > 0 && dump_inserts) + column_inserts = 1; + /* Set the role if requested */ if (use_role && g_fout->remoteVersion >= 80100) { *************** help(const char *progname) -*** 825,830 **** ---- 856,863 ---- +*** 826,831 **** +--- 853,860 ---- printf(_(" --use-set-session-authorization\n" " use SET SESSION AUTHORIZATION commands instead of\n" " ALTER OWNER commands to set ownership\n")); @@ -11999,7 +13095,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c printf(_("\nConnection options:\n")); printf(_(" -h, --host=HOSTNAME database server host or socket directory\n")); *************** dumpTableData_insert(Archive *fout, void -*** 1226,1232 **** +*** 1227,1233 **** if (fout->remoteVersion >= 70100) { appendPQExpBuffer(q, "DECLARE _pg_dump_cursor CURSOR FOR " @@ -12007,18 +13103,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c fmtQualifiedId(tbinfo->dobj.namespace->dobj.name, classname)); } ---- 1259,1267 ---- +--- 1256,1263 ---- if (fout->remoteVersion >= 70100) { appendPQExpBuffer(q, "DECLARE _pg_dump_cursor CURSOR FOR " -! "SELECT %s%s* FROM ONLY %s", -! (security_label > 0 ? "security_label, " : ""), -! (security_acl > 0 ? "security_acl, " : ""), +! "SELECT %s* FROM ONLY %s", +! (security_context > 0 ? "security_context, " : ""), fmtQualifiedId(tbinfo->dobj.namespace->dobj.name, classname)); } *************** dumpDatabase(Archive *AH) -*** 1582,1588 **** +*** 1583,1589 **** i_collate, i_ctype, i_frozenxid, @@ -12026,7 +13121,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c CatalogId dbCatId; DumpId dbDumpId; const char *datname, ---- 1617,1624 ---- +--- 1613,1620 ---- i_collate, i_ctype, i_frozenxid, @@ -12036,7 +13131,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c DumpId dbDumpId; const char *datname, *************** dumpDatabase(Archive *AH) -*** 1590,1596 **** +*** 1591,1597 **** *encoding, *collate, *ctype, @@ -12044,7 +13139,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c uint32 frozenxid; datname = PQdb(g_conn); ---- 1626,1633 ---- +--- 1622,1629 ---- *encoding, *collate, *ctype, @@ -12054,7 +13149,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c datname = PQdb(g_conn); *************** dumpDatabase(Archive *AH) -*** 1609,1619 **** +*** 1610,1620 **** "pg_encoding_to_char(encoding) AS encoding, " "datcollate, datctype, datfrozenxid, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = dattablespace) AS tablespace, " @@ -12066,21 +13161,21 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c appendStringLiteralAH(dbQry, datname, AH); } else if (g_fout->remoteVersion >= 80200) ---- 1646,1657 ---- +--- 1642,1653 ---- "pg_encoding_to_char(encoding) AS encoding, " "datcollate, datctype, datfrozenxid, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = dattablespace) AS tablespace, " ! "shobj_description(oid, 'pg_database') AS description, " -! "%s as security_label " +! "%s as security_context " "FROM pg_database " "WHERE datname = ", ! username_subquery, -! security_label ? "security_label" : "NULL"); +! security_context ? "security_context" : "NULL"); appendStringLiteralAH(dbQry, datname, AH); } else if (g_fout->remoteVersion >= 80200) *************** dumpDatabase(Archive *AH) -*** 1623,1630 **** +*** 1624,1631 **** "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, datfrozenxid, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = dattablespace) AS tablespace, " @@ -12089,17 +13184,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_database " "WHERE datname = ", username_subquery); ---- 1661,1668 ---- +--- 1657,1664 ---- "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, datfrozenxid, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = dattablespace) AS tablespace, " ! "shobj_description(oid, 'pg_database') AS description, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_database " "WHERE datname = ", username_subquery); *************** dumpDatabase(Archive *AH) -*** 1636,1642 **** +*** 1637,1643 **** "(%s datdba) AS dba, " "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, datfrozenxid, " @@ -12107,17 +13202,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_database " "WHERE datname = ", username_subquery); ---- 1674,1681 ---- +--- 1670,1677 ---- "(%s datdba) AS dba, " "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, datfrozenxid, " ! "(SELECT spcname FROM pg_tablespace t WHERE t.oid = dattablespace) AS tablespace, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_database " "WHERE datname = ", username_subquery); *************** dumpDatabase(Archive *AH) -*** 1649,1655 **** +*** 1650,1656 **** "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, " "0 AS datfrozenxid, " @@ -12125,17 +13220,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_database " "WHERE datname = ", username_subquery); ---- 1688,1695 ---- +--- 1684,1691 ---- "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, " "0 AS datfrozenxid, " ! "NULL AS tablespace, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_database " "WHERE datname = ", username_subquery); *************** dumpDatabase(Archive *AH) -*** 1664,1670 **** +*** 1665,1671 **** "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, " "0 AS datfrozenxid, " @@ -12143,28 +13238,28 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_database " "WHERE datname = ", username_subquery); ---- 1704,1711 ---- +--- 1700,1707 ---- "pg_encoding_to_char(encoding) AS encoding, " "NULL AS datcollate, NULL AS datctype, " "0 AS datfrozenxid, " ! "NULL AS tablespace, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_database " "WHERE datname = ", username_subquery); *************** dumpDatabase(Archive *AH) -*** 1698,1703 **** ---- 1739,1745 ---- +*** 1699,1704 **** +--- 1735,1741 ---- i_ctype = PQfnumber(res, "datctype"); i_frozenxid = PQfnumber(res, "datfrozenxid"); i_tablespace = PQfnumber(res, "tablespace"); -+ i_seclabel = PQfnumber(res, "security_label"); ++ i_seclabel = PQfnumber(res, "security_context"); dbCatId.tableoid = atooid(PQgetvalue(res, 0, i_tableoid)); dbCatId.oid = atooid(PQgetvalue(res, 0, i_oid)); *************** dumpDatabase(Archive *AH) -*** 1707,1712 **** ---- 1749,1755 ---- +*** 1708,1713 **** +--- 1745,1751 ---- ctype = PQgetvalue(res, 0, i_ctype); frozenxid = atooid(PQgetvalue(res, 0, i_frozenxid)); tablespace = PQgetvalue(res, 0, i_tablespace); @@ -12173,20 +13268,20 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c appendPQExpBuffer(creaQry, "CREATE DATABASE %s WITH TEMPLATE = template0", fmtId(datname)); *************** dumpDatabase(Archive *AH) -*** 1728,1733 **** ---- 1771,1779 ---- +*** 1729,1734 **** +--- 1767,1775 ---- if (strlen(tablespace) > 0 && strcmp(tablespace, "pg_default") != 0) appendPQExpBuffer(creaQry, " TABLESPACE = %s", fmtId(tablespace)); + if (strlen(seclabel) > 0) -+ appendPQExpBuffer(creaQry, " SECURITY_LABEL = '%s'", seclabel); ++ appendPQExpBuffer(creaQry, " SECURITY_CONTEXT = '%s'", seclabel); + appendPQExpBuffer(creaQry, ";\n"); if (binary_upgrade) *************** getTables(int *numTables) -*** 3143,3148 **** ---- 3189,3195 ---- +*** 3190,3195 **** +--- 3231,3237 ---- int i_reltablespace; int i_reloptions; int i_toastreloptions; @@ -12195,7 +13290,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c /* Make sure we are in proper schema */ selectSourceSchema("pg_catalog"); *************** getTables(int *numTables) -*** 3184,3190 **** +*** 3231,3237 **** "d.refobjsubid AS owning_col, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " "array_to_string(c.reloptions, ', ') AS reloptions, " @@ -12203,27 +13298,27 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " ---- 3231,3238 ---- +--- 3273,3280 ---- "d.refobjsubid AS owning_col, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " "array_to_string(c.reloptions, ', ') AS reloptions, " ! "array_to_string(array(SELECT 'toast.' || x FROM unnest(tc.reloptions) x), ', ') AS toast_reloptions, " -! "%s as security_label " +! "%s as security_context " "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " *************** getTables(int *numTables) -*** 3195,3200 **** ---- 3243,3249 ---- +*** 3242,3247 **** +--- 3285,3291 ---- "WHERE c.relkind in ('%c', '%c', '%c', '%c') " "ORDER BY c.oid", username_subquery, -+ security_label ? "c.security_label" : "NULL", ++ security_context ? "c.security_context" : "NULL", RELKIND_SEQUENCE, RELKIND_RELATION, RELKIND_SEQUENCE, RELKIND_VIEW, RELKIND_COMPOSITE_TYPE); *************** getTables(int *numTables) -*** 3216,3222 **** +*** 3263,3269 **** "d.refobjsubid AS owning_col, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " "array_to_string(c.reloptions, ', ') AS reloptions, " @@ -12231,17 +13326,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " ---- 3265,3272 ---- +--- 3307,3314 ---- "d.refobjsubid AS owning_col, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " "array_to_string(c.reloptions, ', ') AS reloptions, " ! "NULL AS toast_reloptions, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " *************** getTables(int *numTables) -*** 3247,3253 **** +*** 3294,3300 **** "d.refobjsubid AS owning_col, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " "NULL AS reloptions, " @@ -12249,17 +13344,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " ---- 3297,3304 ---- +--- 3339,3346 ---- "d.refobjsubid AS owning_col, " "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " "NULL AS reloptions, " ! "NULL AS toast_reloptions, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " *************** getTables(int *numTables) -*** 3278,3284 **** +*** 3325,3331 **** "d.refobjsubid AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " @@ -12267,17 +13362,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " ---- 3329,3336 ---- +--- 3371,3378 ---- "d.refobjsubid AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " ! "NULL AS toast_reloptions, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_class c " "LEFT JOIN pg_depend d ON " "(c.relkind = '%c' AND " *************** getTables(int *numTables) -*** 3305,3311 **** +*** 3352,3358 **** "NULL::int4 AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " @@ -12285,17 +13380,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class " "WHERE relkind IN ('%c', '%c', '%c') " "ORDER BY oid", ---- 3357,3364 ---- +--- 3399,3406 ---- "NULL::int4 AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " ! "NULL AS toast_reloptions, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_class " "WHERE relkind IN ('%c', '%c', '%c') " "ORDER BY oid", *************** getTables(int *numTables) -*** 3327,3333 **** +*** 3374,3380 **** "NULL::int4 AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " @@ -12303,17 +13398,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class " "WHERE relkind IN ('%c', '%c', '%c') " "ORDER BY oid", ---- 3380,3387 ---- +--- 3422,3429 ---- "NULL::int4 AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " ! "NULL AS toast_reloptions, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_class " "WHERE relkind IN ('%c', '%c', '%c') " "ORDER BY oid", *************** getTables(int *numTables) -*** 3359,3365 **** +*** 3406,3412 **** "NULL::int4 AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " @@ -12321,28 +13416,28 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_class c " "WHERE relkind IN ('%c', '%c') " "ORDER BY oid", ---- 3413,3420 ---- +--- 3455,3462 ---- "NULL::int4 AS owning_col, " "NULL AS reltablespace, " "NULL AS reloptions, " ! "NULL AS toast_reloptions, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_class c " "WHERE relkind IN ('%c', '%c') " "ORDER BY oid", *************** getTables(int *numTables) -*** 3404,3409 **** ---- 3459,3465 ---- +*** 3451,3456 **** +--- 3501,3507 ---- i_reltablespace = PQfnumber(res, "reltablespace"); i_reloptions = PQfnumber(res, "reloptions"); i_toastreloptions = PQfnumber(res, "toast_reloptions"); -+ i_relseclabel = PQfnumber(res, "security_label"); ++ i_relseclabel = PQfnumber(res, "security_context"); if (lockWaitTimeout && g_fout->remoteVersion >= 70300) { *************** getTables(int *numTables) -*** 3451,3456 **** ---- 3507,3513 ---- +*** 3498,3503 **** +--- 3549,3555 ---- tblinfo[i].reltablespace = strdup(PQgetvalue(res, i, i_reltablespace)); tblinfo[i].reloptions = strdup(PQgetvalue(res, i, i_reloptions)); tblinfo[i].toast_reloptions = strdup(PQgetvalue(res, i, i_toastreloptions)); @@ -12351,8 +13446,8 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c /* other fields were zeroed above */ *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4650,4655 **** ---- 4707,4713 ---- +*** 4697,4702 **** +--- 4749,4755 ---- int i_attlen; int i_attalign; int i_attislocal; @@ -12361,7 +13456,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c int ntups; bool hasdefaults; *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4694,4705 **** +*** 4741,4752 **** "a.attstattarget, a.attstorage, t.typstorage, " "a.attnotnull, a.atthasdef, a.attisdropped, " "a.attlen, a.attalign, a.attislocal, " @@ -12374,70 +13469,70 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c tbinfo->dobj.catId.oid); } else if (g_fout->remoteVersion >= 70100) ---- 4752,4765 ---- +--- 4794,4807 ---- "a.attstattarget, a.attstorage, t.typstorage, " "a.attnotnull, a.atthasdef, a.attisdropped, " "a.attlen, a.attalign, a.attislocal, " ! "pg_catalog.format_type(t.oid,a.atttypmod) AS atttypname, " -! "%s as security_label " +! "%s as security_context " "FROM pg_catalog.pg_attribute a LEFT JOIN pg_catalog.pg_type t " "ON a.atttypid = t.oid " "WHERE a.attrelid = '%u'::pg_catalog.oid " "AND a.attnum > 0::pg_catalog.int2 " "ORDER BY a.attrelid, a.attnum", -+ security_label ? "a.security_label" : "NULL", ++ security_context ? "a.security_context" : "NULL", tbinfo->dobj.catId.oid); } else if (g_fout->remoteVersion >= 70100) *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4714,4720 **** +*** 4761,4767 **** "t.typstorage, a.attnotnull, a.atthasdef, " - "false AS attisdropped, 0 AS attlen, " - "' ' AS attalign, false AS attislocal, " + "false AS attisdropped, a.attlen, " + "a.attalign, false AS attislocal, " ! "format_type(t.oid,a.atttypmod) AS atttypname " "FROM pg_attribute a LEFT JOIN pg_type t " "ON a.atttypid = t.oid " "WHERE a.attrelid = '%u'::oid " ---- 4774,4781 ---- +--- 4816,4823 ---- "t.typstorage, a.attnotnull, a.atthasdef, " - "false AS attisdropped, 0 AS attlen, " - "' ' AS attalign, false AS attislocal, " + "false AS attisdropped, a.attlen, " + "a.attalign, false AS attislocal, " ! "format_type(t.oid,a.atttypmod) AS atttypname, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_attribute a LEFT JOIN pg_type t " "ON a.atttypid = t.oid " "WHERE a.attrelid = '%u'::oid " *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4731,4737 **** +*** 4778,4784 **** "attnotnull, atthasdef, false AS attisdropped, " - "0 AS attlen, ' ' AS attalign, " + "attlen, attalign, " "false AS attislocal, " ! "(SELECT typname FROM pg_type WHERE oid = atttypid) AS atttypname " "FROM pg_attribute a " "WHERE attrelid = '%u'::oid " "AND attnum > 0::int2 " ---- 4792,4799 ---- +--- 4834,4841 ---- "attnotnull, atthasdef, false AS attisdropped, " - "0 AS attlen, ' ' AS attalign, " + "attlen, attalign, " "false AS attislocal, " ! "(SELECT typname FROM pg_type WHERE oid = atttypid) AS atttypname, " -! "NULL as security_label " +! "NULL as security_context " "FROM pg_attribute a " "WHERE attrelid = '%u'::oid " "AND attnum > 0::int2 " *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4757,4762 **** ---- 4819,4825 ---- +*** 4804,4809 **** +--- 4861,4867 ---- i_attlen = PQfnumber(res, "attlen"); i_attalign = PQfnumber(res, "attalign"); i_attislocal = PQfnumber(res, "attislocal"); -+ i_attseclabel = PQfnumber(res, "security_label"); ++ i_attseclabel = PQfnumber(res, "security_context"); tbinfo->numatts = ntups; tbinfo->attnames = (char **) malloc(ntups * sizeof(char *)); *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4769,4774 **** ---- 4832,4838 ---- +*** 4816,4821 **** +--- 4874,4880 ---- tbinfo->attlen = (int *) malloc(ntups * sizeof(int)); tbinfo->attalign = (char *) malloc(ntups * sizeof(char)); tbinfo->attislocal = (bool *) malloc(ntups * sizeof(bool)); @@ -12446,8 +13541,8 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c tbinfo->attrdefs = (AttrDefInfo **) malloc(ntups * sizeof(AttrDefInfo *)); tbinfo->inhAttrs = (bool *) malloc(ntups * sizeof(bool)); *************** getTableAttrs(TableInfo *tblinfo, int nu -*** 4794,4799 **** ---- 4858,4864 ---- +*** 4841,4846 **** +--- 4900,4906 ---- tbinfo->attlen[j] = atoi(PQgetvalue(res, j, i_attlen)); tbinfo->attalign[j] = *(PQgetvalue(res, j, i_attalign)); tbinfo->attislocal[j] = (PQgetvalue(res, j, i_attislocal)[0] == 't'); @@ -12456,8 +13551,8 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c tbinfo->attrdefs[j] = NULL; /* fix below */ if (PQgetvalue(res, j, i_atthasdef)[0] == 't') *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7058,7063 **** ---- 7123,7129 ---- +*** 7091,7096 **** +--- 7151,7157 ---- char *proconfig; char *procost; char *prorows; @@ -12466,7 +13561,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c char *rettypename; int nallargs; *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7094,7102 **** +*** 7127,7135 **** "pg_catalog.pg_get_function_result(oid) AS funcresult, " "proiswindow, provolatile, proisstrict, prosecdef, " "proconfig, procost, prorows, " @@ -12476,20 +13571,20 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c finfo->dobj.catId.oid); } else if (g_fout->remoteVersion >= 80300) ---- 7160,7170 ---- +--- 7188,7198 ---- "pg_catalog.pg_get_function_result(oid) AS funcresult, " "proiswindow, provolatile, proisstrict, prosecdef, " "proconfig, procost, prorows, " ! "(SELECT lanname FROM pg_catalog.pg_language WHERE oid = prolang) AS lanname, " -! "%s as security_label " +! "%s as security_context " "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", -+ security_label ? "security_label" : "NULL", ++ security_context ? "security_context" : "NULL", finfo->dobj.catId.oid); } else if (g_fout->remoteVersion >= 80300) *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7107,7113 **** +*** 7140,7146 **** "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "proconfig, procost, prorows, " @@ -12497,17 +13592,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); ---- 7175,7182 ---- +--- 7203,7210 ---- "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "proconfig, procost, prorows, " ! "(SELECT lanname FROM pg_catalog.pg_language WHERE oid = prolang) AS lanname, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7120,7126 **** +*** 7153,7159 **** "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " @@ -12515,17 +13610,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); ---- 7189,7196 ---- +--- 7217,7224 ---- "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " ! "(SELECT lanname FROM pg_catalog.pg_language WHERE oid = prolang) AS lanname, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7135,7141 **** +*** 7168,7174 **** "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " @@ -12533,17 +13628,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); ---- 7205,7212 ---- +--- 7233,7240 ---- "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " ! "(SELECT lanname FROM pg_catalog.pg_language WHERE oid = prolang) AS lanname, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7150,7156 **** +*** 7183,7189 **** "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " @@ -12551,17 +13646,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); ---- 7221,7228 ---- +--- 7249,7256 ---- "false AS proiswindow, " "provolatile, proisstrict, prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " ! "(SELECT lanname FROM pg_catalog.pg_language WHERE oid = prolang) AS lanname, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_catalog.pg_proc " "WHERE oid = '%u'::pg_catalog.oid", finfo->dobj.catId.oid); *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7167,7173 **** +*** 7200,7206 **** "proisstrict, " "false AS prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " @@ -12569,17 +13664,17 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_proc " "WHERE oid = '%u'::oid", finfo->dobj.catId.oid); ---- 7239,7246 ---- +--- 7267,7274 ---- "proisstrict, " "false AS prosecdef, " "null AS proconfig, 0 AS procost, 0 AS prorows, " ! "(SELECT lanname FROM pg_language WHERE oid = prolang) AS lanname, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_proc " "WHERE oid = '%u'::oid", finfo->dobj.catId.oid); *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7184,7190 **** +*** 7217,7223 **** "false AS proisstrict, " "false AS prosecdef, " "NULL AS proconfig, 0 AS procost, 0 AS prorows, " @@ -12587,85 +13682,79 @@ diff -Nrpc base/src/bin/pg_dump/pg_dump.c sepgsql/src/bin/pg_dump/pg_dump.c "FROM pg_proc " "WHERE oid = '%u'::oid", finfo->dobj.catId.oid); ---- 7257,7264 ---- +--- 7285,7292 ---- "false AS proisstrict, " "false AS prosecdef, " "NULL AS proconfig, 0 AS procost, 0 AS prorows, " ! "(SELECT lanname FROM pg_language WHERE oid = prolang) AS lanname, " -! "NULL AS security_label " +! "NULL AS security_context " "FROM pg_proc " "WHERE oid = '%u'::oid", finfo->dobj.catId.oid); *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7228,7233 **** ---- 7302,7308 ---- +*** 7261,7266 **** +--- 7330,7336 ---- proconfig = PQgetvalue(res, 0, PQfnumber(res, "proconfig")); procost = PQgetvalue(res, 0, PQfnumber(res, "procost")); prorows = PQgetvalue(res, 0, PQfnumber(res, "prorows")); -+ proseclabel = PQgetvalue(res, 0, PQfnumber(res, "security_label")); ++ proseclabel = PQgetvalue(res, 0, PQfnumber(res, "security_context")); lanname = PQgetvalue(res, 0, PQfnumber(res, "lanname")); /* *************** dumpFunc(Archive *fout, FuncInfo *finfo) -*** 7386,7391 **** ---- 7461,7469 ---- +*** 7419,7424 **** +--- 7489,7497 ---- if (prosecdef[0] == 't') appendPQExpBuffer(q, " SECURITY DEFINER"); -+ if (security_label > 0 && strlen(proseclabel) > 0) -+ appendPQExpBuffer(q, " SECURITY_LABEL = '%s'", proseclabel); ++ if (security_context > 0 && strlen(proseclabel) > 0) ++ appendPQExpBuffer(q, " SECURITY_CONTEXT = '%s'", proseclabel); + /* * COST and ROWS are emitted only if present and not default, so as not to * break backwards-compatibility of the dump without need. Keep this code *************** dumpTableSchema(Archive *fout, TableInfo -*** 9826,9831 **** ---- 9904,9918 ---- - if (tbinfo->notnull[j] && !tbinfo->inhNotNull[j]) +*** 9877,9882 **** +--- 9950,9966 ---- + if (tbinfo->notnull[j] && + (!tbinfo->inhNotNull[j] || binary_upgrade)) appendPQExpBuffer(q, " NOT NULL"); - ++ + /* + * Security label -- if SE-PostgreSQL enabled + */ -+ if (security_label > 0 && ++ if (security_context > 0 && + strlen(tbinfo->attseclabel[j]) > 0 && + strcmp(tbinfo->relseclabel, tbinfo->attseclabel[j]) != 0) -+ appendPQExpBuffer(q, " SECURITY_LABEL = '%s'", ++ appendPQExpBuffer(q, " SECURITY_CONTEXT = '%s'", + tbinfo->attseclabel[j]); + - actual_atts++; ++ actual_atts++; } } + *************** dumpTableSchema(Archive *fout, TableInfo -*** 9889,9894 **** ---- 9976,9984 ---- +*** 9939,9944 **** +--- 10023,10031 ---- appendPQExpBuffer(q, ")"); } -+ if (security_label > 0 && strlen(tbinfo->relseclabel) > 0) -+ appendPQExpBuffer(q, " SECURITY_LABEL = '%s'", tbinfo->relseclabel); ++ if (security_context > 0 && strlen(tbinfo->relseclabel) > 0) ++ appendPQExpBuffer(q, " SECURITY_CONTEXT = '%s'", tbinfo->relseclabel); + appendPQExpBuffer(q, ";\n"); /* *************** fmtCopyColumnList(const TableInfo *ti) -*** 11418,11423 **** ---- 11508,11528 ---- +*** 11508,11513 **** +--- 11595,11607 ---- appendPQExpBuffer(q, "("); needComma = false; + -+ if (security_label > 0) ++ if (security_context > 0) + { -+ appendPQExpBuffer(q, "security_label"); -+ needComma = true; -+ } -+ -+ if (security_acl > 0) -+ { -+ if (needComma) -+ appendPQExpBuffer(q, ", "); -+ appendPQExpBuffer(q, "security_acl"); ++ appendPQExpBuffer(q, "security_context"); + needComma = true; + } + @@ -12949,7 +14038,7 @@ diff -Nrpc base/src/bin/pg_dump/pg_dumpall.c sepgsql/src/bin/pg_dump/pg_dumpall. if (strcmp(dbistemplate, "t") == 0) diff -Nrpc base/src/include/access/htup.h sepgsql/src/include/access/htup.h *** base/src/include/access/htup.h Thu Jun 18 10:20:52 2009 ---- sepgsql/src/include/access/htup.h Wed Jul 15 19:30:50 2009 +--- sepgsql/src/include/access/htup.h Tue Sep 8 23:55:48 2009 *************** typedef HeapTupleHeaderData *HeapTupleHe *** 163,169 **** #define HEAP_HASVARWIDTH 0x0002 /* has variable-width attribute(s) */ @@ -12963,7 +14052,7 @@ diff -Nrpc base/src/include/access/htup.h sepgsql/src/include/access/htup.h #define HEAP_HASVARWIDTH 0x0002 /* has variable-width attribute(s) */ #define HEAP_HASEXTERNAL 0x0004 /* has external stored attribute(s) */ #define HEAP_HASOID 0x0008 /* has an object-id field */ -! #define HEAP_HAS_SECLABEL 0x0010 /* tuple has security label */ +! #define HEAP_HASSECID 0x0010 /* has an security-id field */ #define HEAP_COMBOCID 0x0020 /* t_cid is a combo cid */ #define HEAP_XMAX_EXCL_LOCK 0x0040 /* xmax is exclusive locker */ #define HEAP_XMAX_SHARED_LOCK 0x0080 /* xmax is shared locker */ @@ -12985,24 +14074,24 @@ diff -Nrpc base/src/include/access/htup.h sepgsql/src/include/access/htup.h (tup)->t_infomask2 = ((tup)->t_infomask2 & ~HEAP_NATTS_MASK) | (natts) \ ) -+ #define HeapTupleHeaderHasSecLabel(tup) \ -+ ((tup)->t_infomask & HEAP_HAS_SECLABEL) ++ #define HeapTupleHeaderHasSecid(tup) \ ++ ((tup)->t_infomask & HEAP_HASSECID) + -+ #define HeapTupleHeaderGetSecLabel(tup) \ -+ ( \ -+ HeapTupleHeaderHasSecLabel(tup) \ ++ #define HeapTupleHeaderGetSecid(tup) \ ++ ( \ ++ HeapTupleHeaderHasSecid(tup) \ + ? (*(Oid *)((char *)(tup) + (tup)->t_hoff \ + - (HeapTupleHeaderHasOid(tup) ? sizeof(Oid) : 0) \ + - sizeof(Oid))) \ + : InvalidOid \ + ) + -+ #define HeapTupleHeaderSetSecLabel(tup, seclabel) \ ++ #define HeapTupleHeaderSetSecid(tup, secid) \ + do { \ -+ Assert(HeapTupleHeaderHasSecLabel(tup)); \ ++ Assert(HeapTupleHeaderHasSecid(tup)); \ + *((Oid *)((char *)(tup) + (tup)->t_hoff \ + - (HeapTupleHeaderHasOid(tup) ? sizeof(Oid) : 0) \ -+ - sizeof(Oid))) = (seclabel); \ ++ - sizeof(Oid))) = (secid); \ + } while(0) /* @@ -13013,20 +14102,20 @@ diff -Nrpc base/src/include/access/htup.h sepgsql/src/include/access/htup.h #define HeapTupleSetOid(tuple, oid) \ HeapTupleHeaderSetOid((tuple)->t_data, (oid)) -+ #define HeapTupleHasSecLabel(tuple) \ -+ HeapTupleHeaderHasSecLabel((tuple)->t_data) ++ #define HeapTupleHasSecid(tuple) \ ++ HeapTupleHeaderHasSecid((tuple)->t_data) + -+ #define HeapTupleGetSecLabel(tuple) \ -+ HeapTupleHeaderGetSecLabel((tuple)->t_data) ++ #define HeapTupleGetSecid(tuple) \ ++ HeapTupleHeaderGetSecid((tuple)->t_data) + -+ #define HeapTupleSetSecLabel(tuple, seclabel) \ -+ HeapTupleHeaderSetSecLabel((tuple)->t_data, (seclabel)) ++ #define HeapTupleSetSecid(tuple, secid) \ ++ HeapTupleHeaderSetSecid((tuple)->t_data, (secid)) /* * WAL record definitions for heapam.c's WAL operations diff -Nrpc base/src/include/access/sysattr.h sepgsql/src/include/access/sysattr.h *** base/src/include/access/sysattr.h Sat Jan 3 12:25:21 2009 ---- sepgsql/src/include/access/sysattr.h Wed Jul 15 19:38:52 2009 +--- sepgsql/src/include/access/sysattr.h Wed Sep 9 16:47:01 2009 *************** *** 25,31 **** #define MaxTransactionIdAttributeNumber (-5) @@ -13040,7 +14129,7 @@ diff -Nrpc base/src/include/access/sysattr.h sepgsql/src/include/access/sysattr. #define MaxTransactionIdAttributeNumber (-5) #define MaxCommandIdAttributeNumber (-6) #define TableOidAttributeNumber (-7) -! #define SecurityLabelAttributeNumber (-8) +! #define SecurityAttributeNumber (-8) ! #define FirstLowInvalidHeapAttributeNumber (-9) + /* @@ -13053,19 +14142,19 @@ diff -Nrpc base/src/include/access/sysattr.h sepgsql/src/include/access/sysattr. + #define MaxTransactionIdAttributeName "xmax" + #define MaxCommandIdAttributeName "cmax" + #define TableOidAttributeName "tableoid" -+ #define SecurityLabelAttributeName "security_label" ++ #define SecurityAttributeName "security_context" #endif /* SYSATTR_H */ diff -Nrpc base/src/include/access/tupdesc.h sepgsql/src/include/access/tupdesc.h *** base/src/include/access/tupdesc.h Sat Jan 3 12:25:21 2009 ---- sepgsql/src/include/access/tupdesc.h Wed Jul 15 19:30:50 2009 +--- sepgsql/src/include/access/tupdesc.h Wed Sep 9 13:14:37 2009 *************** typedef struct tupleDesc *** 75,80 **** --- 75,81 ---- Oid tdtypeid; /* composite type ID for tuple type */ int32 tdtypmod; /* typmod for tuple type */ bool tdhasoid; /* tuple has oid attribute in its header */ -+ bool tdhasseclabel; /* tuple has security label in its header */ ++ bool tdhassecid; /* tuple has secid attribute in its header */ int tdrefcount; /* reference count, or -1 if not counting */ } *TupleDesc; @@ -13164,14 +14253,14 @@ diff -Nrpc base/src/include/catalog/indexing.h sepgsql/src/include/catalog/index diff -Nrpc base/src/include/catalog/pg_attribute.h sepgsql/src/include/catalog/pg_attribute.h *** base/src/include/catalog/pg_attribute.h Thu Jun 18 10:20:52 2009 ---- sepgsql/src/include/catalog/pg_attribute.h Wed Jul 15 19:38:52 2009 +--- sepgsql/src/include/catalog/pg_attribute.h Thu Sep 10 15:29:52 2009 *************** DATA(insert ( 1247 cmin 29 0 4 -4 0 *** 276,281 **** --- 276,282 ---- DATA(insert ( 1247 xmax 28 0 4 -5 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1247 cmax 29 0 4 -6 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1247 tableoid 26 0 4 -7 0 -1 -1 t p i t f f t 0 _null_)); -+ DATA(insert ( 1247 security_label 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); ++ DATA(insert ( 1247 security_context 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); /* ---------------- * pg_proc @@ -13181,7 +14270,7 @@ diff -Nrpc base/src/include/catalog/pg_attribute.h sepgsql/src/include/catalog/p DATA(insert ( 1255 xmax 28 0 4 -5 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1255 cmax 29 0 4 -6 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1255 tableoid 26 0 4 -7 0 -1 -1 t p i t f f t 0 _null_)); -+ DATA(insert ( 1255 security_label 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); ++ DATA(insert ( 1255 security_context 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); /* ---------------- * pg_attribute @@ -13191,7 +14280,7 @@ diff -Nrpc base/src/include/catalog/pg_attribute.h sepgsql/src/include/catalog/p DATA(insert ( 1249 xmax 28 0 4 -5 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1249 cmax 29 0 4 -6 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1249 tableoid 26 0 4 -7 0 -1 -1 t p i t f f t 0 _null_)); -+ DATA(insert ( 1249 security_label 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); ++ DATA(insert ( 1249 security_context 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); /* ---------------- * pg_class @@ -13201,7 +14290,7 @@ diff -Nrpc base/src/include/catalog/pg_attribute.h sepgsql/src/include/catalog/p DATA(insert ( 1259 xmax 28 0 4 -5 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1259 cmax 29 0 4 -6 0 -1 -1 t p i t f f t 0 _null_)); DATA(insert ( 1259 tableoid 26 0 4 -7 0 -1 -1 t p i t f f t 0 _null_)); -+ DATA(insert ( 1259 security_label 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); ++ DATA(insert ( 1259 security_context 25 0 -1 -8 0 -1 -1 f x i t f f t 0 _null_)); /* ---------------- * pg_index @@ -13288,10 +14377,10 @@ diff -Nrpc base/src/include/catalog/pg_proc_fn.h sepgsql/src/include/catalog/pg_ diff -Nrpc base/src/include/catalog/pg_security.h sepgsql/src/include/catalog/pg_security.h *** base/src/include/catalog/pg_security.h Thu Jan 1 09:00:00 1970 ---- sepgsql/src/include/catalog/pg_security.h Wed Jul 15 21:17:18 2009 +--- sepgsql/src/include/catalog/pg_security.h Thu Sep 10 15:18:03 2009 *************** *** 0 **** ---- 1,104 ---- +--- 1,101 ---- + /* + * src/include/catalog/pg_security.h + * Definition of the security label relation (pg_security) @@ -13363,7 +14452,7 @@ diff -Nrpc base/src/include/catalog/pg_security.h sepgsql/src/include/catalog/pg + securityOnDropDatabase(Oid datid); + + extern bool -+ securityTupleDescHasSecLabel(Oid relid, char relkind); ++ securityTupleDescHasSecid(Oid relid, char relkind); + + extern Oid + securityRawSecLabelIn(Oid relid, char *seclabel); @@ -13377,11 +14466,8 @@ diff -Nrpc base/src/include/catalog/pg_security.h sepgsql/src/include/catalog/pg + extern char * + securityTransSecLabelOut(Oid relid, Oid secid); + -+ extern Oid -+ securityMoveSecLabel(Oid dst_relid, Oid src_relid, Oid secid); -+ -+ Datum -+ securityHeapGetSecLabelSysattr(HeapTuple tuple); ++ extern Datum ++ securitySysattSecLabelOut(Oid relid, HeapTuple tuple); + + extern void + securityReclaimOnDropTable(Oid relid); @@ -13476,8 +14562,8 @@ diff -Nrpc base/src/include/commands/tablecmds.h sepgsql/src/include/commands/ta extern void ExecuteTruncate(TruncateStmt *stmt); diff -Nrpc base/src/include/executor/executor.h sepgsql/src/include/executor/executor.h -*** base/src/include/executor/executor.h Thu Jun 18 10:20:52 2009 ---- sepgsql/src/include/executor/executor.h Wed Jul 15 19:30:50 2009 +*** base/src/include/executor/executor.h Sun Sep 6 19:40:49 2009 +--- sepgsql/src/include/executor/executor.h Wed Sep 9 13:14:37 2009 *************** extern TupleHashEntry FindTupleHashEntry *** 130,136 **** /* @@ -13501,7 +14587,7 @@ diff -Nrpc base/src/include/executor/executor.h sepgsql/src/include/executor/exe bool doInstrument); extern ResultRelInfo *ExecGetTriggerResultRel(EState *estate, Oid relid); extern bool ExecContextForcesOids(PlanState *planstate, bool *hasoids); -+ extern bool ExecContextForcesSecLabel(PlanState *planstate, bool *hasseclabel); ++ extern bool ExecContextForcesSecids(PlanState *planstate, bool *hassecids); extern void ExecConstraints(ResultRelInfo *resultRelInfo, TupleTableSlot *slot, EState *estate); extern TupleTableSlot *EvalPlanQual(EState *estate, Index rti, @@ -13747,10 +14833,10 @@ diff -Nrpc base/src/include/security/rowlevel.h sepgsql/src/include/security/row + #endif /* ROWLEVEL_H */ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepgsql.h *** base/src/include/security/sepgsql.h Thu Jan 1 09:00:00 1970 ---- sepgsql/src/include/security/sepgsql.h Thu Jul 16 17:22:29 2009 +--- sepgsql/src/include/security/sepgsql.h Thu Sep 10 15:18:03 2009 *************** *** 0 **** ---- 1,514 ---- +--- 1,534 ---- + /* + * src/include/security/sepgsql.h + * Headers of SE-PostgreSQL @@ -13834,7 +14920,7 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define SEPG_DB_DATABASE__SETATTR (1<<3) + #define SEPG_DB_DATABASE__RELABELFROM (1<<4) + #define SEPG_DB_DATABASE__RELABELTO (1<<5) -+ #define SEPG_DB_DATABASE__CONNECT (1<<6) ++ #define SEPG_DB_DATABASE__ACCESS (1<<6) + #define SEPG_DB_DATABASE__INSTALL_MODULE (1<<7) + #define SEPG_DB_DATABASE__LOAD_MODULE (1<<8) + #define SEPG_DB_DATABASE__SUPERUSER (1<<9) @@ -13845,9 +14931,9 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define SEPG_DB_SCHEMA__SETATTR (SEPG_DB_DATABASE__SETATTR) + #define SEPG_DB_SCHEMA__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM) + #define SEPG_DB_SCHEMA__RELABELTO (SEPG_DB_DATABASE__RELABELTO) -+ #define SEPG_DB_SCHEMA__USAGE (1<<6) -+ #define SEPG_DB_SCHEMA__ADD_OBJECT (1<<7) -+ #define SEPG_DB_SCHEMA__REMOVE_OBJECT (1<<8) ++ #define SEPG_DB_SCHEMA__SEARCH (1<<6) ++ #define SEPG_DB_SCHEMA__ADD_NAME (1<<7) ++ #define SEPG_DB_SCHEMA__REMOVE_NAME (1<<8) + + #define SEPG_DB_SCHEMA_TEMP__CREATE (SEPG_DB_DATABASE__CREATE) + #define SEPG_DB_SCHEMA_TEMP__DROP (SEPG_DB_DATABASE__DROP) @@ -13855,9 +14941,9 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define SEPG_DB_SCHEMA_TEMP__SETATTR (SEPG_DB_DATABASE__SETATTR) + #define SEPG_DB_SCHEMA_TEMP__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM) + #define SEPG_DB_SCHEMA_TEMP__RELABELTO (SEPG_DB_DATABASE__RELABELTO) -+ #define SEPG_DB_SCHEMA_TEMP__USAGE (SEPG_DB_SCHEMA__USAGE) -+ #define SEPG_DB_SCHEMA_TEMP__ADD_OBJECT (SEPG_DB_SCHEMA__ADD_OBJECT) -+ #define SEPG_DB_SCHEMA_TEMP__REMOVE_OBJECT (SEPG_DB_SCHEMA__REMOVE_OBJECT) ++ #define SEPG_DB_SCHEMA_TEMP__SEARCH (SEPG_DB_SCHEMA__SEARCH) ++ #define SEPG_DB_SCHEMA_TEMP__ADD_NAME (SEPG_DB_SCHEMA__ADD_NAME) ++ #define SEPG_DB_SCHEMA_TEMP__REMOVE_NAME (SEPG_DB_SCHEMA__REMOVE_NAME) + + #define SEPG_DB_TABLE__CREATE (SEPG_DB_DATABASE__CREATE) + #define SEPG_DB_TABLE__DROP (SEPG_DB_DATABASE__DROP) @@ -13891,6 +14977,7 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define SEPG_DB_PROCEDURE__EXECUTE (1<<6) + #define SEPG_DB_PROCEDURE__ENTRYPOINT (1<<7) + #define SEPG_DB_PROCEDURE__INSTALL (1<<8) ++ #define SEPG_DB_PROCEDURE__UNTRUSTED (1<<9) + + #define SEPG_DB_COLUMN__CREATE (SEPG_DB_DATABASE__CREATE) + #define SEPG_DB_COLUMN__DROP (SEPG_DB_DATABASE__DROP) @@ -13922,6 +15009,16 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define SEPG_DB_BLOB__EXPORT (1<<9) + + /* ++ * sepgsql_sid_t : alternative representation of security context ++ */ ++ typedef struct { ++ Oid relid; ++ Oid secid; ++ } sepgsql_sid_t; ++ ++ #define SidIsValid(sid) (OidIsValid((sid).relid) && OidIsValid((sid).secid)) ++ ++ /* + * avc.c : userspace access vector caches + */ + @@ -13939,33 +15036,29 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + + extern bool sepgsqlGetEnforce(void); + extern int sepgsqlSetEnforce(int new_mode); ++ extern void sepgsqlAvcReset(void); + extern void sepgsqlAvcSwitchClient(const char *scontext); + + extern bool -+ sepgsqlClientHasPermsSid(Oid relid, Oid secid, -+ uint16 tclass, uint32 required, -+ const char *audit_name, bool abort); -+ extern bool -+ sepgsqlClientHasPermsTup(Oid relid, HeapTuple tuple, -+ uint16 tclass, uint32 required, bool abort); -+ extern Oid -+ sepgsqlClientCreateSecid(Oid trelid, Oid tsecid, uint16 tclass, Oid nrelid); ++ sepgsqlClientHasPerms(sepgsql_sid_t tsid, ++ uint16 tclass, uint32 required, ++ const char *audit_name, bool abort); ++ extern sepgsql_sid_t ++ sepgsqlClientCreateSecid(sepgsql_sid_t tsid, uint16 tclass, Oid nrelid); + + extern security_context_t -+ sepgsqlClientCreateLabel(Oid trelid, Oid tsecid, -+ security_class_t tclass); ++ sepgsqlClientCreateLabel(sepgsql_sid_t tsid, uint16 tclass); + + extern bool + sepgsqlComputePerms(security_context_t scontext, + security_context_t tcontext, -+ security_class_t tclass, -+ access_vector_t required, ++ uint16 tclass, uint32 required, + const char *audit_name, bool abort); + + extern security_context_t + sepgsqlComputeCreate(security_context_t scontext, + security_context_t tcontext, -+ security_class_t tclass); ++ uint16 tclass); + + extern pid_t sepgsqlStartupWorkerProcess(void); + @@ -14015,32 +15108,34 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + * hooks.c : routines to check certain permissions + */ + extern Oid -+ sepgsqlCheckDatabaseCreate(const char *datname, DefElem *new_label); ++ sepgsqlCheckDatabaseCreate(const char *datname, DefElem *newLabel); + extern void -+ sepgsqlCheckDatabaseDrop(Oid database_oid); ++ sepgsqlCheckDatabaseDrop(Oid datOid); + extern void -+ sepgsqlCheckDatabaseSetattr(Oid database_oid); ++ sepgsqlCheckDatabaseSetattr(Oid datOid); + extern Oid -+ sepgsqlCheckDatabaseRelabel(Oid database_oid, DefElem *new_label); -+ extern bool -+ sepgsqlCheckDatabaseConnect(Oid database_oid); ++ sepgsqlCheckDatabaseRelabel(Oid datOid, DefElem *newLlabel); ++ extern void ++ sepgsqlCheckDatabaseAccess(Oid datOid); + extern bool + sepgsqlCheckDatabaseSuperuser(void); + extern void -+ sepgsqlCheckDatabaseInstallModule(const char *probin, HeapTuple protup); -+ extern void + sepgsqlCheckDatabaseLoadModule(const char *filename); + + extern Oid -+ sepgsqlCheckSchemaCreate(const char *nspname, DefElem *new_label, bool temp_schame); ++ sepgsqlCheckSchemaCreate(const char *nspName, DefElem *new_label, bool isTemp); + extern void -+ sepgsqlCheckSchemaDrop(Oid namespace_oid); ++ sepgsqlCheckSchemaDrop(Oid nspOid); + extern void -+ sepgsqlCheckSchemaSetattr(Oid namespace_oid); ++ sepgsqlCheckSchemaSetattr(Oid nspOid); + extern Oid -+ sepgsqlCheckSchemaRelabel(Oid namespace_oid, DefElem *new_label); ++ sepgsqlCheckSchemaRelabel(Oid nspOid, DefElem *new_label); ++ extern void ++ sepgsqlCheckSchemaAddName(Oid nspOid); ++ extern void ++ sepgsqlCheckSchemaRemoveName(Oid nspOid); + extern bool -+ sepgsqlCheckSchemaUsage(Oid nsid); ++ sepgsqlCheckSchemaSearch(Oid nspOid, bool abort); + + extern void + sepgsqlCheckTableDrop(Oid table_oid); @@ -14056,35 +15151,38 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + sepgsqlCheckTableReference(Relation rel, int16 *attnums, int natts); + + extern void -+ sepgsqlCheckSequenceGetValue(Oid seqid); ++ sepgsqlCheckSequenceGetValue(Oid seqOid); + extern void -+ sepgsqlCheckSequenceNextValue(Oid seqid); ++ sepgsqlCheckSequenceNextValue(Oid seqOid); + extern void -+ sepgsqlCheckSequenceSetValue(Oid seqid); ++ sepgsqlCheckSequenceSetValue(Oid seqOid); + + extern Oid -+ sepgsqlCheckColumnCreate(Oid table_oid, const char *attname, DefElem *new_label); ++ sepgsqlCheckColumnCreate(Oid relOid, const char *attname, DefElem *newLabel); + extern void -+ sepgsqlCheckColumnDrop(Oid table_oid, AttrNumber attno); ++ sepgsqlCheckColumnDrop(Oid relOid, AttrNumber attno); + extern void -+ sepgsqlCheckColumnSetattr(Oid table_oid, AttrNumber attno); ++ sepgsqlCheckColumnSetattr(Oid relOid, AttrNumber attno); + extern Oid -+ sepgsqlCheckColumnRelabel(Oid table_oid, AttrNumber attno, DefElem *new_label); ++ sepgsqlCheckColumnRelabel(Oid relOid, AttrNumber attno, DefElem *newLabel); + + extern Oid -+ sepgsqlCheckProcedureCreate(const char *proname, Oid namespace_oid, DefElem *new_label); ++ sepgsqlCheckProcedureCreate(const char *procName, Oid procOid, ++ Oid procNsp, Oid procLang, DefElem *newLabel); + extern void -+ sepgsqlCheckProcedureDrop(Oid proc_oid); ++ sepgsqlCheckProcedureDrop(Oid procOid); + extern void -+ sepgsqlCheckProcedureSetattr(Oid proc_oid); ++ sepgsqlCheckProcedureSetattr(Oid procOid); + extern Oid -+ sepgsqlCheckProcedureRelabel(Oid proc_oid, DefElem *new_label); ++ sepgsqlCheckProcedureRelabel(Oid procOid, DefElem *newLabel); ++ extern void ++ sepgsqlCheckProcedureExecute(Oid procOid); ++ extern void ++ sepgsqlCheckProcedureInstall(Oid procOid); + extern bool -+ sepgsqlCheckProcedureExecute(Oid proc_oid); ++ sepgsqlHintProcedureInlined(HeapTuple protup); + extern void -+ sepgsqlCheckProcedureEntrypoint(FmgrInfo *finfo, HeapTuple protup); -+ extern void -+ sepgsqlCheckProcedureInstall(Oid proc_oid); ++ sepgsqlCheckProcedureEntrypoint(FmgrInfo *flinfo, HeapTuple protup); + + extern void + sepgsqlCheckBlobCreate(Relation rel, HeapTuple lotup); @@ -14112,42 +15210,47 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + extern void + sepgsqlCheckFileWrite(int fdesc, const char *filename); + -+ void -+ sepgsqlCheckObjectDrop(const ObjectAddress *object); -+ -+ /* optimizar hints */ -+ extern bool -+ sepgsqlAllowFunctionInlined(HeapTuple protup); ++ extern Oid ++ sepgsqlCheckSysobjCreate(Oid relid, const char *auditName); ++ extern void ++ sepgsqlCheckSysobjGetattr(Oid relid, Oid secid, const char *auditName); ++ extern void ++ sepgsqlCheckSysobjSetattr(Oid relid, Oid secid, const char *auditName); ++ extern void ++ sepgsqlCheckSysobjDrop(const ObjectAddress *object); + + /* + * label.c : security label management + */ + extern bool -+ sepgsqlTupleDescHasSecLabel(Oid relid, char relkind); -+ extern security_context_t -+ sepgsqlMetaSecurityLabel(void); -+ extern void -+ sepgsqlSetDefaultSecLabel(Relation rel, HeapTuple tuple); ++ sepgsqlTupleDescHasSecid(Oid relid, char relkind); + -+ extern Oid sepgsqlGetDefaultDatabaseSecLabel(void); -+ extern Oid sepgsqlGetDefaultSchemaSecLabel(Oid database_oid); -+ extern Oid sepgsqlGetDefaultSchemaTempSecLabel(Oid database_oid); -+ extern Oid sepgsqlGetDefaultTableSecLabel(Oid namespace_oid); -+ extern Oid sepgsqlGetDefaultSequenceSecLabel(Oid namespace_oid); -+ extern Oid sepgsqlGetDefaultProcedureSecLabel(Oid namespace_oid); -+ extern Oid sepgsqlGetDefaultColumnSecLabel(Oid table_oid); -+ extern Oid sepgsqlGetDefaultTupleSecLabel(Oid table_oid); -+ extern Oid sepgsqlGetDefaultBlobSecLabel(Oid database_oid); ++ extern void sepgsqlSetDefaultSecid(Relation rel, HeapTuple tuple); ++ extern sepgsql_sid_t sepgsqlGetDefaultDatabaseSecid(void); ++ extern sepgsql_sid_t sepgsqlGetDefaultSchemaSecid(Oid database_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultSchemaTempSecid(Oid database_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultTableSecid(Oid namespace_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultSequenceSecid(Oid namespace_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultProcedureSecid(Oid namespace_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultColumnSecid(Oid table_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultTupleSecid(Oid table_oid); ++ extern sepgsql_sid_t sepgsqlGetDefaultBlobSecid(Oid database_oid); + + extern Oid *sepgsqlCreateTableColumns(CreateStmt *stmt, + const char *relname, Oid namespace_oid, + TupleDesc tupdesc, char relkind); + extern Oid *sepgsqlCopyTableColumns(Relation source); + ++ extern sepgsql_sid_t ++ sepgsqlGetTupleContext(Oid tableOid, HeapTuple tuple, uint16 *tclass); ++ extern sepgsql_sid_t ++ sepgsqlGetSysobjContext(Oid tableOid, Oid objectId, int32 objsubId, uint16 *tclass); ++ + extern char *sepgsqlTransSecLabelIn(char *seclabel); + extern char *sepgsqlTransSecLabelOut(char *seclabel); + extern char *sepgsqlRawSecLabelIn(char *seclabel); + extern char *sepgsqlRawSecLabelOut(char *seclabel); ++ extern char *sepgsqlSysattSecLabelOut(Oid relid, HeapTuple tuple); + + /* + * perms.c : SELinux permission related stuff @@ -14191,14 +15294,15 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define sepgsqlCheckDatabaseRelabel(a,b) (InvalidOid) + #define sepgsqlCheckDatabaseAccess(a) (true) + #define sepgsqlCheckDatabaseSuperuser() (true) -+ #define sepgsqlCheckDatabaseInstallModule(a,b) do {} while(0) + #define sepgsqlCheckDatabaseLoadModule(a) do {} while(0) + + #define sepgsqlCheckSchemaCreate(a,b,c) (InvalidOid) + #define sepgsqlCheckSchemaDrop(a) do {} while(0) + #define sepgsqlCheckSchemaSetattr(a) do {} while(0) + #define sepgsqlCheckSchemaRelabel(a,b) (InvalidOid) -+ #define sepgsqlCheckSchemaUsage(a) (true) ++ #define sepgsqlCheckSchemaAddName(a) do {} while(0) ++ #define sepgsqlCheckSchemaRemoveName(a) do {} while(0) ++ #define sepgsqlCheckSchemaSearch(a,b) (true) + + #define sepgsqlCheckTableDrop(a) do {} while(0) + #define sepgsqlCheckTableSetattr(a) do {} while(0) @@ -14216,13 +15320,14 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define sepgsqlCheckColumnSetattr(a,b) do {} while(0) + #define sepgsqlCheckColumnRelabel(a,b,c) (InvalidOid) + -+ #define sepgsqlCheckProcedureCreate(a,b,c) (InvalidOid) ++ #define sepgsqlCheckProcedureCreate(a,b,c,d) (InvalidOid) + #define sepgsqlCheckProcedureDrop(a) do {} while(0) + #define sepgsqlCheckProcedureSetattr(a) do {} while(0) + #define sepgsqlCheckProcedureRelabel(a,b) (InvalidOid) + #define sepgsqlCheckProcedureExecute(a) (true) -+ #define sepgsqlCheckProcedureEntrypoint(a,b) do {} while(0) + #define sepgsqlCheckProcedureInstall(a) do {} while(0) ++ #define sepgsqlHintProcedureInlined(a) (true) ++ #define sepgsqlCheckProcedureEntrypoint(a,b) do {} while(0) + + #define sepgsqlCheckBlobCreate(a,b) do {} while(0) + #define sepgsqlCheckBlobDrop(a,b) do {} while(0) @@ -14236,9 +15341,10 @@ diff -Nrpc base/src/include/security/sepgsql.h sepgsql/src/include/security/sepg + #define sepgsqlCheckFileRead(a,b) do {} while(0) + #define sepgsqlCheckFileWrite(a,b) do {} while(0) + -+ #define sepgsqlCheckObjectDrop(a) do {} while(0) -+ -+ #define sepgsqlAllowFunctionInlined(a) (true) ++ #define sepgsqlCheckSysobjCreate(a,b) (InvalidOid) ++ #define sepgsqlCheckSysobjGetattr(a,b,c) do {} while(0) ++ #define sepgsqlCheckSysobjSetattr(a,b,c) do {} while(0) ++ #define sepgsqlCheckSysobjDrop(a) do {} while(0) + + /* label.c */ + #define sepgsqlTupleDescHasSecLabel(a,b) (false) @@ -14333,7 +15439,7 @@ diff -Nrpc base/src/include/utils/errcodes.h sepgsql/src/include/utils/errcodes. #define ERRCODE_INTERNAL_ERROR MAKE_SQLSTATE('X','X', '0','0','0') diff -Nrpc base/src/include/utils/syscache.h sepgsql/src/include/utils/syscache.h *** base/src/include/utils/syscache.h Sat Jan 3 12:25:21 2009 ---- sepgsql/src/include/utils/syscache.h Thu Jul 16 23:18:11 2009 +--- sepgsql/src/include/utils/syscache.h Wed Sep 9 21:29:33 2009 *************** enum SysCacheIdentifier *** 69,74 **** --- 69,76 ---- diff --git a/sepostgresql.init b/sepostgresql.init index 6fd032b..866aaba 100644 --- a/sepostgresql.init +++ b/sepostgresql.init @@ -7,9 +7,8 @@ # pidfile: /var/run/postmaster.pid #--------------------------------------------------------------------- -PGVERSION="8.3.7" +PGVERSION="8.4.1" PGMAJORVERSION=`echo "$PGVERSION" | sed 's/^\([0-9]*\.[0-9a-z]*\).*$/\1/'` -SEPGVERSION="1990" # source function library . /etc/rc.d/init.d/functions diff --git a/sepostgresql.spec b/sepostgresql.spec index c7901ff..49d6727 100644 --- a/sepostgresql.spec +++ b/sepostgresql.spec @@ -11,8 +11,8 @@ Summary: Security Enhanced PostgreSQL Name: sepostgresql -Version: 8.4.0 -Release: 2238%{?dist} +Version: 8.4.1 +Release: 2305%{?dist} License: BSD Group: Applications/Databases Url: http://code.google.com/p/sepgsql/ @@ -192,6 +192,10 @@ fi %attr(700,sepgsql,sepgsql) %dir %{_localstatedir}/lib/sepgsql/backups %changelog +* Fri Sep 11 2009 KaiGai Kohei - 8.4.1-2305 +- Upgrade base SE-PostgreSQL v8.4.0->v8.4.1 +- rework: backport features from v8.5devel tree + * Fri Aug 21 2009 Tomas Mraz - 8.4.0-2238 - rebuilt with new openssl diff --git a/sources b/sources index b998673..91e78c6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -1f172d5f60326e972837f58fa5acd130 postgresql-8.4.0.tar.bz2 +f2015af17bacbbfe140daf0d1067f9c9 postgresql-8.4.1.tar.bz2