283 lines
9.9 KiB
Text
283 lines
9.9 KiB
Text
policy_module(sepostgresql, 1.51)
|
|
|
|
gen_require(`
|
|
all_userspace_class_perms
|
|
|
|
type postgresql_t;
|
|
type lib_t, shlib_t;
|
|
type unlabeled_t;
|
|
|
|
attribute domain;
|
|
attribute file_type;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
# ---- Booleans ----
|
|
gen_tunable(sepgsql_enable_unconfined, true)
|
|
gen_tunable(sepgsql_enable_auditallow, false)
|
|
gen_tunable(sepgsql_enable_auditdeny, true)
|
|
gen_tunable(sepgsql_enable_audittuple, false)
|
|
gen_tunable(sepgsql_enable_users_ddl, true)
|
|
|
|
# ---- Database client type ----
|
|
attribute sepgsql_admin_domain;
|
|
attribute sepgsql_users_domain;
|
|
|
|
# ---- Database object type ----
|
|
attribute sepgsql_server_type;
|
|
attribute sepgsql_database_type;
|
|
attribute sepgsql_table_type;
|
|
attribute sepgsql_procedure_type;
|
|
attribute sepgsql_blob_type;
|
|
attribute sepgsql_module_type;
|
|
|
|
#---------------------------------------
|
|
# SE-PostgreSQL userspace-managed objects
|
|
|
|
# for database class
|
|
type sepgsql_db_t, sepgsql_database_type;
|
|
|
|
# for table/column/tuple class
|
|
type sepgsql_table_t, sepgsql_table_type;
|
|
type sepgsql_sysobj_t, sepgsql_table_type;
|
|
type sepgsql_secret_table_t, sepgsql_table_type;
|
|
type sepgsql_ro_table_t, sepgsql_table_type;
|
|
type sepgsql_fixed_table_t, sepgsql_table_type;
|
|
|
|
# for procedure class
|
|
type sepgsql_proc_t, sepgsql_procedure_type;
|
|
type sepgsql_user_proc_t, sepgsql_procedure_type;
|
|
type sepgsql_trusted_proc_t, sepgsql_procedure_type;
|
|
|
|
# for blob class
|
|
type sepgsql_blob_t, sepgsql_blob_type;
|
|
type sepgsql_ro_blob_t, sepgsql_blob_type;
|
|
type sepgsql_secret_blob_t, sepgsql_blob_type;
|
|
|
|
#---------------------------------------
|
|
# SE-PostgreSQL trusted procedure domain
|
|
type sepgsql_trusted_domain_t;
|
|
domain_type(sepgsql_trusted_domain_t)
|
|
sepgsql_unconfined_domain(sepgsql_trusted_domain_t)
|
|
|
|
#---------------------------------------
|
|
# SE-PostgreSQL loadable shared library modules
|
|
sepgsql_module_object(lib_t)
|
|
sepgsql_module_object(shlib_t)
|
|
|
|
#---------------------------------------
|
|
# unlabeled object (unlabeled_t)
|
|
typeattribute unlabeled_t sepgsql_database_type;
|
|
typeattribute unlabeled_t sepgsql_table_type;
|
|
typeattribute unlabeled_t sepgsql_procedure_type;
|
|
typeattribute unlabeled_t sepgsql_blob_type;
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL server domain's policy
|
|
#
|
|
optional_policy(`
|
|
gen_require(`
|
|
type postgresql_t;
|
|
')
|
|
sepgsql_server_domain(postgresql_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL client domains
|
|
#
|
|
|
|
# -- unconfined_t --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
sepgsql_unconfined_domain(unconfined_t)
|
|
')
|
|
|
|
# -- sysadm_t --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type sysadm_t;
|
|
')
|
|
sepgsql_unconfined_domain(sysadm_t)
|
|
')
|
|
|
|
# -- user_t --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type user_t;
|
|
')
|
|
sepgsql_client_domain(user_t)
|
|
')
|
|
|
|
# -- staff_t --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type staff_t;
|
|
')
|
|
sepgsql_client_domain(staff_t)
|
|
')
|
|
|
|
# -- guest_t --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type guest_t;
|
|
')
|
|
sepgsql_client_domain(guest_t)
|
|
')
|
|
|
|
# -- httpd_t (PHP script) --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type httpd_t;
|
|
')
|
|
sepgsql_client_domain(httpd_t)
|
|
')
|
|
|
|
# -- httpd_sys_script_t (CGI script) --
|
|
optional_policy(`
|
|
gen_require(`
|
|
type httpd_sys_script_t;
|
|
')
|
|
sepgsql_client_domain(httpd_sys_script_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL Type Transition
|
|
#
|
|
type_transition domain domain : db_database sepgsql_db_t;
|
|
type_transition { domain - sepgsql_server_type } sepgsql_database_type : db_table sepgsql_table_t;
|
|
type_transition sepgsql_server_type sepgsql_database_type : db_table sepgsql_sysobj_t;
|
|
type_transition domain sepgsql_database_type : db_blob sepgsql_blob_t;
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL policy for server domain
|
|
#
|
|
allow sepgsql_server_type self : netlink_selinux_socket create_socket_perms;
|
|
selinux_get_fs_mount(sepgsql_server_type)
|
|
selinux_get_enforce_mode(sepgsql_server_type)
|
|
selinux_validate_context(sepgsql_server_type)
|
|
selinux_compute_access_vector(sepgsql_server_type)
|
|
selinux_compute_create_context(sepgsql_server_type)
|
|
selinux_compute_relabel_context(sepgsql_server_type)
|
|
|
|
allow sepgsql_server_type sepgsql_database_type : db_database all_db_database_perms;
|
|
allow sepgsql_server_type sepgsql_module_type : db_database { install_module };
|
|
allow sepgsql_server_type sepgsql_table_type : db_table all_db_table_perms;
|
|
allow sepgsql_server_type sepgsql_table_type : db_column all_db_column_perms;
|
|
allow sepgsql_server_type sepgsql_table_type : db_tuple all_db_tuple_perms;
|
|
allow sepgsql_server_type sepgsql_procedure_type : db_procedure all_db_procedure_perms;
|
|
allow sepgsql_server_type sepgsql_blob_type : db_blob all_db_blob_perms;
|
|
# type transition for procedure
|
|
type_transition sepgsql_server_type sepgsql_database_type : db_procedure sepgsql_proc_t;
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL policy for administrative domain
|
|
#
|
|
tunable_policy(`sepgsql_enable_unconfined',`
|
|
allow sepgsql_admin_domain sepgsql_database_type : db_database all_db_database_perms;
|
|
allow sepgsql_admin_domain sepgsql_module_type : db_database { install_module };
|
|
allow sepgsql_admin_domain sepgsql_table_type : db_table all_db_table_perms;
|
|
allow sepgsql_admin_domain sepgsql_table_type : db_column all_db_column_perms;
|
|
allow sepgsql_admin_domain sepgsql_table_type : db_tuple all_db_tuple_perms;
|
|
allow sepgsql_admin_domain { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure all_db_procedure_perms;
|
|
allow sepgsql_admin_domain sepgsql_user_proc_t : db_procedure { create drop getattr setattr relabelfrom relabelto };
|
|
allow sepgsql_admin_domain sepgsql_blob_type : db_blob all_db_blob_perms;
|
|
allow sepgsql_admin_domain sepgsql_server_type : db_blob { import export };
|
|
# type transition for procedure
|
|
type_transition sepgsql_admin_domain sepgsql_database_type : db_procedure sepgsql_proc_t;
|
|
',`
|
|
# type transition for procedure
|
|
type_transition sepgsql_admin_domain sepgsql_database_type : db_procedure sepgsql_user_proc_t;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL policy for generic domain
|
|
#
|
|
|
|
allow sepgsql_users_domain sepgsql_db_t : db_database { getattr access };
|
|
|
|
allow sepgsql_users_domain sepgsql_table_t : db_table { getattr use select update insert delete };
|
|
allow sepgsql_users_domain sepgsql_table_t : db_column { getattr use select update insert };
|
|
allow sepgsql_users_domain sepgsql_table_t : db_tuple { use select update insert delete };
|
|
|
|
allow sepgsql_users_domain sepgsql_sysobj_t : db_table { getattr use select };
|
|
allow sepgsql_users_domain sepgsql_sysobj_t : db_column { getattr use select };
|
|
allow sepgsql_users_domain sepgsql_sysobj_t : db_tuple { use select };
|
|
tunable_policy(`sepgsql_enable_users_ddl',`
|
|
allow sepgsql_users_domain sepgsql_table_t : db_table { create drop setattr };
|
|
allow sepgsql_users_domain sepgsql_table_t : db_column { create drop setattr };
|
|
allow sepgsql_users_domain sepgsql_sysobj_t : db_tuple { update insert delete };
|
|
')
|
|
|
|
allow sepgsql_users_domain sepgsql_secret_table_t : db_table { getattr };
|
|
allow sepgsql_users_domain sepgsql_secret_table_t : db_column { getattr };
|
|
|
|
allow sepgsql_users_domain sepgsql_ro_table_t : db_table { getattr use select };
|
|
allow sepgsql_users_domain sepgsql_ro_table_t : db_column { getattr use select };
|
|
allow sepgsql_users_domain sepgsql_ro_table_t : db_tuple { use select };
|
|
|
|
allow sepgsql_users_domain sepgsql_fixed_table_t : db_table { getattr use select insert };
|
|
allow sepgsql_users_domain sepgsql_fixed_table_t : db_column { getattr use select insert };
|
|
allow sepgsql_users_domain sepgsql_fixed_table_t : db_tuple { use select insert };
|
|
|
|
allow sepgsql_users_domain sepgsql_proc_t : db_procedure { getattr execute };
|
|
allow { sepgsql_users_domain - sepgsql_admin_domain} sepgsql_user_proc_t : db_procedure { create drop getattr setattr execute };
|
|
allow sepgsql_users_domain sepgsql_trusted_proc_t : db_procedure { getattr execute entrypoint };
|
|
|
|
allow sepgsql_users_domain sepgsql_blob_t : db_blob { create drop getattr setattr read write };
|
|
allow sepgsql_users_domain sepgsql_ro_blob_t : db_blob { getattr read };
|
|
allow sepgsql_users_domain sepgsql_secret_blob_t : db_blob { getattr };
|
|
|
|
# type transition for procedure
|
|
type_transition { sepgsql_users_domain - sepgsql_admin_domain } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
|
|
|
|
# trusted procedure
|
|
type_transition sepgsql_users_domain sepgsql_trusted_proc_t : process sepgsql_trusted_domain_t;
|
|
allow sepgsql_users_domain sepgsql_trusted_domain_t : process { transition };
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL loadable shared library policy
|
|
#
|
|
|
|
allow sepgsql_database_type sepgsql_module_type : db_database { load_module };
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL audit switch
|
|
#
|
|
tunable_policy(`sepgsql_enable_auditallow',`
|
|
auditallow domain sepgsql_database_type : db_database all_db_database_perms;
|
|
auditallow domain sepgsql_table_type : db_table all_db_table_perms;
|
|
auditallow domain sepgsql_table_type : db_column all_db_column_perms;
|
|
auditallow domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
|
|
auditallow domain sepgsql_blob_type : db_blob all_db_blob_perms;
|
|
auditallow domain sepgsql_server_type : db_blob { import export };
|
|
auditallow domain file_type : db_database { install_module };
|
|
')
|
|
tunable_policy(`sepgsql_enable_audittuple && sepgsql_enable_auditallow',`
|
|
auditallow domain sepgsql_table_type : db_tuple all_db_tuple_perms;
|
|
')
|
|
tunable_policy(`! sepgsql_enable_auditdeny',`
|
|
dontaudit domain sepgsql_database_type : db_database all_db_database_perms;
|
|
dontaudit domain sepgsql_table_type : db_table all_db_table_perms;
|
|
dontaudit domain sepgsql_table_type : db_column all_db_column_perms;
|
|
dontaudit domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
|
|
dontaudit domain sepgsql_blob_type : db_blob all_db_blob_perms;
|
|
dontaudit domain sepgsql_server_type : db_blob { import export };
|
|
dontaudit domain file_type : db_database { install_module };
|
|
')
|
|
tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
|
|
dontaudit domain sepgsql_table_type : db_tuple all_db_tuple_perms;
|
|
')
|