rpms/sepostgresql
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add a security policy hotfix for labeled networking. It enables client

Browse source 
domains to communicate SE-PostgreSQL.
This commit is contained in:
KaiGai Kohei 2007-11-20 16:18:34 +00:00
commit f970c51104
3 changed files with 33 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

29
sepostgresql.te
View file

@ -1,4 +1,4 @@
policy_module(sepostgresql, 1.51)
policy_module(sepostgresql, 1.66)
gen_require(`
all_userspace_class_perms
@ -281,3 +281,30 @@ tunable_policy(`! sepgsql_enable_auditdeny',`
tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
dontaudit domain sepgsql_table_type : db_tuple all_db_tuple_perms;
')
########################################
#
# Hotfixes for labeled networking
#
# NOTE: These changes are to be merged in the later releases.
optional_policy(`
gen_require(`
attribute sepgsql_server_type;
attribute sepgsql_users_domain;
attribute unconfined_domain_type;
type unlabeled_t;
type ipsec_spd_t;
type racoon_t;
')
# allow unconfined_t to set default SPD context
allow unconfined_domain_type ipsec_spd_t : association { setcontext };
# allow server/client domain to communicate via default SPD context
allow { sepgsql_server_type sepgsql_users_domain } ipsec_spd_t : association { polmatch };
allow { sepgsql_server_type sepgsql_users_domain } self : association { sendto };
allow sepgsql_server_type sepgsql_users_domain : { association tcp_socket } recvfrom;
allow sepgsql_users_domain sepgsql_server_type : { association tcp_socket } recvfrom;
# racoon_t/unlabeled_t related
allow unlabeled_t self : association { sendto };
allow unlabeled_t ipsec_spd_t : association { polmatch };
allow racoon_t unlabeled_t : association { setcontext };
')