From f970c511044c3feda9727da8b7689848bd0e52fa Mon Sep 17 00:00:00 2001
From: KaiGai Kohei <kaigai@fedoraproject.org>
Date: Tue, 20 Nov 2007 16:18:34 +0000
Subject: [PATCH] Add a security policy hotfix for labeled networking. It
 enables client     domains to communicate SE-PostgreSQL.

---
 sepostgresql.init |  2 +-
 sepostgresql.spec |  5 ++++-
 sepostgresql.te   | 29 ++++++++++++++++++++++++++++-
 3 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/sepostgresql.init b/sepostgresql.init
index 4e6ea56..944d06f 100644
--- a/sepostgresql.init
+++ b/sepostgresql.init
@@ -9,7 +9,7 @@
 
 PGVERSION="8.2.5"
 PGMAJORVERSION=`echo "$PGVERSION" | sed 's/^\([0-9]*\.[0-9]*\).*$/\1/'`
-SEPGVERSION="1.51"
+SEPGVERSION="1.66"
 
 # source function library
 . /etc/rc.d/init.d/functions
diff --git a/sepostgresql.spec b/sepostgresql.spec
index 5c6cf17..9744c5c 100644
--- a/sepostgresql.spec
+++ b/sepostgresql.spec
@@ -13,7 +13,7 @@
 Summary: Security Enhanced PostgreSQL
 Name: sepostgresql
 Version: 8.2.5
-Release: 1.51%{?sepgsql_extension}%{?dist}
+Release: 1.66%{?sepgsql_extension}%{?dist}
 License: BSD
 Group: Applications/Databases
 Url: http://code.google.com/p/sepgsql/
@@ -208,6 +208,9 @@ fi
 %attr(700,sepgsql,sepgsql) %dir %{_localstatedir}/lib/sepgsql/backups
 
 %changelog
+* Wed Nov 21 2007 <kaigai@kaigai.gr.jp> - 8.2.5-1.66
+- Add a policy module hotfix for labeled networking
+
 * Thu Nov 1 2007 <kaigai@kaigai.gr.jp> - 8.2.5-1.51
 - Re-organize repository to prepare to branch 8.3.x based tree.
   (no differences from 8.2.5-1.33)
diff --git a/sepostgresql.te b/sepostgresql.te
index b351a7c..0ede4a9 100644
--- a/sepostgresql.te
+++ b/sepostgresql.te
@@ -1,4 +1,4 @@
-policy_module(sepostgresql, 1.51)
+policy_module(sepostgresql, 1.66)
 
 gen_require(`
 	all_userspace_class_perms
@@ -281,3 +281,30 @@ tunable_policy(`! sepgsql_enable_auditdeny',`
 tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
 	dontaudit domain sepgsql_table_type : db_tuple all_db_tuple_perms;
 ')
+
+########################################
+#
+# Hotfixes for labeled networking
+# 
+# NOTE: These changes are to be merged in the later releases.
+optional_policy(`
+	gen_require(`
+		attribute sepgsql_server_type;
+		attribute sepgsql_users_domain;
+		attribute unconfined_domain_type;
+		type unlabeled_t;
+		type ipsec_spd_t;
+		type racoon_t;
+	')
+	# allow unconfined_t to set default SPD context
+	allow unconfined_domain_type ipsec_spd_t : association { setcontext };
+	# allow server/client domain to communicate via default SPD context
+	allow { sepgsql_server_type sepgsql_users_domain } ipsec_spd_t : association { polmatch };
+	allow { sepgsql_server_type sepgsql_users_domain } self : association { sendto };
+	allow sepgsql_server_type sepgsql_users_domain : { association tcp_socket } recvfrom;
+	allow sepgsql_users_domain sepgsql_server_type : { association tcp_socket } recvfrom;
+	# racoon_t/unlabeled_t related
+	allow unlabeled_t self : association { sendto };
+	allow unlabeled_t ipsec_spd_t : association { polmatch };
+	allow racoon_t unlabeled_t : association { setcontext };
+')