rpms/sepostgresql
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add a security policy hotfix for labeled networking. It enables client

Browse source 
domains to communicate SE-PostgreSQL.
This commit is contained in:
KaiGai Kohei 2007-11-20 16:18:34 +00:00
commit f970c51104
3 changed files with 33 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
sepostgresql.init
View file

@ -9,7 +9,7 @@
PGVERSION="8.2.5"
PGMAJORVERSION=`echo "$PGVERSION" | sed 's/^\([0-9]*\.[0-9]*\).*$/\1/'`
SEPGVERSION="1.51"
SEPGVERSION="1.66"
# source function library
. /etc/rc.d/init.d/functions

5
sepostgresql.spec
View file

@ -13,7 +13,7 @@
Summary: Security Enhanced PostgreSQL
Name: sepostgresql
Version: 8.2.5
Release: 1.51%{?sepgsql_extension}%{?dist}
Release: 1.66%{?sepgsql_extension}%{?dist}
License: BSD
Group: Applications/Databases
Url: http://code.google.com/p/sepgsql/
@ -208,6 +208,9 @@ fi
%attr(700,sepgsql,sepgsql) %dir %{_localstatedir}/lib/sepgsql/backups
%changelog
* Wed Nov 21 2007 <kaigai@kaigai.gr.jp> - 8.2.5-1.66
- Add a policy module hotfix for labeled networking
* Thu Nov 1 2007 <kaigai@kaigai.gr.jp> - 8.2.5-1.51
- Re-organize repository to prepare to branch 8.3.x based tree.
(no differences from 8.2.5-1.33)

29
sepostgresql.te
View file

@ -1,4 +1,4 @@
policy_module(sepostgresql, 1.51)
policy_module(sepostgresql, 1.66)
gen_require(`
all_userspace_class_perms
@ -281,3 +281,30 @@ tunable_policy(`! sepgsql_enable_auditdeny',`
tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
dontaudit domain sepgsql_table_type : db_tuple all_db_tuple_perms;
')
########################################
#
# Hotfixes for labeled networking
#
# NOTE: These changes are to be merged in the later releases.
optional_policy(`
gen_require(`
attribute sepgsql_server_type;
attribute sepgsql_users_domain;
attribute unconfined_domain_type;
type unlabeled_t;
type ipsec_spd_t;
type racoon_t;
')
# allow unconfined_t to set default SPD context
allow unconfined_domain_type ipsec_spd_t : association { setcontext };
# allow server/client domain to communicate via default SPD context
allow { sepgsql_server_type sepgsql_users_domain } ipsec_spd_t : association { polmatch };
allow { sepgsql_server_type sepgsql_users_domain } self : association { sendto };
allow sepgsql_server_type sepgsql_users_domain : { association tcp_socket } recvfrom;
allow sepgsql_users_domain sepgsql_server_type : { association tcp_socket } recvfrom;
# racoon_t/unlabeled_t related
allow unlabeled_t self : association { sendto };
allow unlabeled_t ipsec_spd_t : association { polmatch };
allow racoon_t unlabeled_t : association { setcontext };
')