policy_module(sepostgresql, 2.179)

gen_require(`
        class db_database all_db_database_perms;
        class db_table all_db_table_perms;
        class db_procedure all_db_procedure_perms;
        class db_column all_db_column_perms;
        class db_tuple all_db_tuple_perms;
        class db_blob all_db_blob_perms;

	type postgresql_t, unlabeled_t;
	attribute domain, file_type;

	role system_r;
')

#################################
#
# SE-PostgreSQL Boolean declarations
#

## <desc>
## <p>
## Allow to enable unconfined domains
## </p>
## </desc>
gen_tunable(sepgsql_enable_unconfined, true)

## <desc>
## <p>
## Allow to generate auditallow logs
## </p>
## </desc>
gen_tunable(sepgsql_enable_auditallow, false)

## <desc>
## <p>
## Allow to generate auditdeny logs
## </p>
## </desc>
gen_tunable(sepgsql_enable_auditdeny,  true)

## <desc>
## <p>
## Allow to generate audit(allow|deny) logs for tuples
## </p>
## </desc>
gen_tunable(sepgsql_enable_audittuple, false)

## <desc>
## <p>
## Allow unprivileged users to execute DDL statement
## </p>
## </desc>
gen_tunable(sepgsql_enable_users_ddl,  true)

#################################
#
# SE-PostgreSQL Type/Attribute declarations
#

# database subjects
attribute sepgsql_server_type;
attribute sepgsql_client_type;
attribute sepgsql_unconfined_type;

# database objects attribute
attribute sepgsql_database_type;
attribute sepgsql_table_type;
attribute sepgsql_procedure_type;
attribute sepgsql_blob_type;
attribute sepgsql_module_type;

# database trusted domain
type sepgsql_trusted_domain_t;

# database object types
type sepgsql_db_t,		sepgsql_database_type;

type sepgsql_table_t,		sepgsql_table_type;
type sepgsql_sysobj_t,		sepgsql_table_type;
type sepgsql_secret_table_t,	sepgsql_table_type;
type sepgsql_ro_table_t,	sepgsql_table_type;
type sepgsql_fixed_table_t,	sepgsql_table_type;

type sepgsql_proc_t,		sepgsql_procedure_type;
type sepgsql_user_proc_t,	sepgsql_procedure_type;
type sepgsql_trusted_proc_t,	sepgsql_procedure_type;

type sepgsql_blob_t,		sepgsql_blob_type;
type sepgsql_ro_blob_t,		sepgsql_blob_type;
type sepgsql_secret_blob_t,	sepgsql_blob_type;

typeattribute unlabeled_t	sepgsql_database_type;
typeattribute unlabeled_t	sepgsql_table_type;
typeattribute unlabeled_t	sepgsql_procedure_type;
typeattribute unlabeled_t	sepgsql_blob_type;

########################################
#
# SE-PostgreSQL Server Local policy
#                    (sepgsql_server_type)
allow sepgsql_server_type self : netlink_selinux_socket create_socket_perms;
selinux_get_fs_mount(sepgsql_server_type)
selinux_get_enforce_mode(sepgsql_server_type)
selinux_validate_context(sepgsql_server_type)
selinux_compute_access_vector(sepgsql_server_type)
selinux_compute_create_context(sepgsql_server_type)
selinux_compute_relabel_context(sepgsql_server_type)

allow sepgsql_server_type sepgsql_database_type : db_database *;
allow sepgsql_server_type sepgsql_module_type : db_database { install_module };
allow sepgsql_server_type sepgsql_table_type : { db_table db_column db_tuple } *;
allow sepgsql_server_type sepgsql_procedure_type : db_procedure *;
allow sepgsql_server_type sepgsql_blob_type : db_blob *;

# server specific type transitions
type_transition sepgsql_server_type sepgsql_database_type : db_table sepgsql_sysobj_t;
type_transition sepgsql_server_type sepgsql_database_type : db_procedure sepgsql_proc_t;

########################################
#
# SE-PostgreSQL Administrative domain local policy
#                    (sepgsql_unconfined_type)

tunable_policy(`sepgsql_enable_unconfined',`
	allow sepgsql_unconfined_type sepgsql_database_type : db_database *;
	allow sepgsql_unconfined_type sepgsql_module_type : db_database { install_module };
	allow sepgsql_unconfined_type sepgsql_table_type : { db_table db_column db_tuple } *;
	allow sepgsql_unconfined_type { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure *;
	allow sepgsql_unconfined_type sepgsql_user_proc_t : db_procedure { create drop getattr setattr relabelfrom relabelto };
	allow sepgsql_unconfined_type sepgsql_blob_type : db_blob *;
	allow sepgsql_unconfined_type postgresql_t : db_blob { import export };

	type_transition { sepgsql_unconfined_type - sepgsql_server_type } sepgsql_database_type : db_procedure sepgsql_proc_t;
',`
	type_transition { sepgsql_unconfined_type - sepgsql_server_type } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
')

########################################
#
# SE-PostgreSQL Users domain local policy
#                     (sepgsql_client_type)

allow sepgsql_client_type sepgsql_db_t : db_database { getattr access get_param set_param};

allow sepgsql_client_type sepgsql_table_t : db_table { getattr use select update insert delete };
allow sepgsql_client_type sepgsql_table_t : db_column { getattr use select update insert };
allow sepgsql_client_type sepgsql_table_t : db_tuple { use select update insert delete };

allow sepgsql_client_type sepgsql_sysobj_t : db_table { getattr use select };
allow sepgsql_client_type sepgsql_sysobj_t : db_column { getattr use select };
allow sepgsql_client_type sepgsql_sysobj_t : db_tuple { use select };
tunable_policy(`sepgsql_enable_users_ddl',`
	allow sepgsql_client_type sepgsql_table_t : db_table { create drop setattr };
	allow sepgsql_client_type sepgsql_table_t : db_column { create drop setattr };
	allow sepgsql_client_type sepgsql_sysobj_t : db_tuple { update insert delete };
')

allow sepgsql_client_type sepgsql_secret_table_t : db_table { getattr };
allow sepgsql_client_type sepgsql_secret_table_t : db_column { getattr };

allow sepgsql_client_type sepgsql_ro_table_t : db_table { getattr use select };
allow sepgsql_client_type sepgsql_ro_table_t : db_column { getattr use select };
allow sepgsql_client_type sepgsql_ro_table_t : db_tuple { use select };

allow sepgsql_client_type sepgsql_fixed_table_t : db_table { getattr use select insert };
allow sepgsql_client_type sepgsql_fixed_table_t : db_column { getattr use select insert };
allow sepgsql_client_type sepgsql_fixed_table_t : db_tuple { use select insert };

allow sepgsql_client_type sepgsql_proc_t : db_procedure { getattr execute };
allow { sepgsql_client_type - sepgsql_unconfined_type } sepgsql_user_proc_t : db_procedure { create drop getattr setattr execute };
allow sepgsql_client_type sepgsql_trusted_proc_t : db_procedure { getattr execute entrypoint };

allow sepgsql_client_type sepgsql_blob_t : db_blob { create drop getattr setattr read write };
allow sepgsql_client_type sepgsql_ro_blob_t : db_blob { getattr read };
allow sepgsql_client_type sepgsql_secret_blob_t : db_blob { getattr };

# call trusted procedure
type_transition sepgsql_client_type sepgsql_trusted_proc_t : process sepgsql_trusted_domain_t;
allow sepgsql_client_type sepgsql_trusted_domain_t : process { transition };

# type transitions for rest of domains
type_transition domain domain : db_database sepgsql_db_t;
type_transition { domain - sepgsql_server_type } sepgsql_database_type : db_table sepgsql_table_t;
type_transition { domain - sepgsql_server_type - sepgsql_unconfined_type } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
type_transition domain sepgsql_database_type : db_blob sepgsql_blob_t;

########################################
#
# SE-PostgreSQL Misc policies
#

# Trusted Procedure Domain
domain_type(sepgsql_trusted_domain_t)
role system_r types sepgsql_trusted_domain_t;
sepgsql_unconfined_domain(sepgsql_trusted_domain_t)

# The following permissions are allowed, even if sepgsql_enable_unconfined is disabled.
allow sepgsql_trusted_domain_t sepgsql_database_type : db_database { getattr setattr access get_param set_param};
allow sepgsql_trusted_domain_t sepgsql_table_type : db_table { getattr use select update insert delete lock };
allow sepgsql_trusted_domain_t sepgsql_table_type : db_column { getattr use select update insert };
allow sepgsql_trusted_domain_t sepgsql_table_type : db_tuple { use select update insert delete };

allow sepgsql_trusted_domain_t { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure { getattr execute };
allow sepgsql_trusted_domain_t sepgsql_user_proc_t : db_procedure { getattr };
allow sepgsql_trusted_domain_t sepgsql_blob_type : db_blob { getattr setattr read write };

# Database/Loadable module
allow sepgsql_database_type sepgsql_module_type : db_database { load_module };

########################################
#
# SE-PostgreSQL audit switch
#
tunable_policy(`sepgsql_enable_auditallow',`
	auditallow domain sepgsql_database_type  : db_database all_db_database_perms;
	auditallow domain sepgsql_table_type     : db_table all_db_table_perms;
	auditallow domain sepgsql_table_type     : db_column all_db_column_perms;
	auditallow domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
	auditallow domain sepgsql_blob_type      : db_blob all_db_blob_perms;
	auditallow domain sepgsql_server_type    : db_blob { import export };
	auditallow domain sepgsql_module_type    : db_database { install_module };
')
tunable_policy(`sepgsql_enable_audittuple && sepgsql_enable_auditallow',`
	auditallow domain sepgsql_table_type     : db_tuple all_db_tuple_perms;
')
tunable_policy(`! sepgsql_enable_auditdeny',`
	dontaudit domain sepgsql_database_type   : db_database all_db_database_perms;
	dontaudit domain sepgsql_table_type      : db_table all_db_table_perms;
	dontaudit domain sepgsql_table_type      : db_column all_db_column_perms;
	dontaudit domain sepgsql_procedure_type  : db_procedure all_db_procedure_perms;
	dontaudit domain sepgsql_blob_type       : db_blob all_db_blob_perms;
	dontaudit domain sepgsql_server_type     : db_blob { import export };
	dontaudit domain sepgsql_module_type     : db_database { install_module };
')
tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
	dontaudit domain sepgsql_table_type      : db_tuple all_db_tuple_perms;
')
########################################
#
# Allow permission to external domains
#

# server domains
optional_policy(`
	gen_require(`
		type postgresql_t;
	')
	sepgsql_server_domain(postgresql_t)
')

# unconfined client domain
optional_policy(`
	gen_require(`
		type unconfined_t;
	')
	sepgsql_unconfined_domain(unconfined_t)
')

optional_policy(`
	gen_require(`
		type sysadm_t;
	')
	sepgsql_unconfined_domain(sysadm_t)
')

# generic client domain
optional_policy(`
	gen_require(`
		type user_t;
		role user_r;
	')
	sepgsql_client_domain(user_t)
	sepgsql_trusted_procedure_role(user_r)
')

optional_policy(`
	gen_require(`
		type staff_t;
		role staff_r;
	')
	sepgsql_client_domain(staff_t)
	sepgsql_trusted_procedure_role(staff_r)
')

optional_policy(`
	gen_require(`
		type user_t;
		role user_r;
	')
	sepgsql_client_domain(user_t)
	sepgsql_trusted_procedure_role(user_r)
')

optional_policy(`
	gen_require(`
		type guest_t;
		role guest_r;
	')
	sepgsql_client_domain(guest_t)
	sepgsql_trusted_procedure_role(guest_r)
')

optional_policy(`
	gen_require(`
		type xguest_t;
		role xguest_r;
	')
	sepgsql_client_domain(xguest_t)
	sepgsql_trusted_procedure_role(xguest_r)
')

optional_policy(`
	gen_require(`
		type httpd_sys_script_t;
	')
	sepgsql_client_domain(httpd_sys_script_t)
')

# RBAC
optional_policy(`
	gen_require(`
		role unconfined_r;
	')
	sepgsql_trusted_procedure_role(unconfined_r)
')

# loadable module types
optional_policy(`
	gen_require(`
		type lib_t;
	')
	sepgsql_loadable_module(lib_t)
')

optional_policy(`
	gen_require(`
		type textrel_shlib_t;
	')
	sepgsql_loadable_module(textrel_shlib_t)
')

########################################
#
# Hotfixes for labeled networking
# 
# NOTE: These changes are to be merged in the later releases.
corenet_tcp_recvfrom_labeled(sepgsql_server_type, sepgsql_client_type)
optional_policy(`
	ipsec_match_default_spd(sepgsql_server_type)
	ipsec_match_default_spd(sepgsql_client_type)
')