348 lines
11 KiB
Text
348 lines
11 KiB
Text
policy_module(sepostgresql, 2.121)
|
|
|
|
gen_require(`
|
|
all_userspace_class_perms
|
|
|
|
type postgresql_t, unlabeled_t;
|
|
attribute domain, file_type;
|
|
|
|
role system_r;
|
|
')
|
|
|
|
#################################
|
|
#
|
|
# SE-PostgreSQL Boolean declarations
|
|
#
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Allow to enable unconfined domains
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(sepgsql_enable_unconfined, true)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Allow to generate auditallow logs
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(sepgsql_enable_auditallow, false)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Allow to generate auditdeny logs
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(sepgsql_enable_auditdeny, true)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Allow to generate audit(allow|deny) logs for tuples
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(sepgsql_enable_audittuple, false)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Allow unprivileged users to execute DDL statement
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(sepgsql_enable_users_ddl, true)
|
|
|
|
#################################
|
|
#
|
|
# SE-PostgreSQL Type/Attribute declarations
|
|
#
|
|
|
|
# database subjects
|
|
attribute sepgsql_server_type;
|
|
attribute sepgsql_client_type;
|
|
attribute sepgsql_unconfined_type;
|
|
|
|
# database objects attribute
|
|
attribute sepgsql_database_type;
|
|
attribute sepgsql_table_type;
|
|
attribute sepgsql_procedure_type;
|
|
attribute sepgsql_blob_type;
|
|
attribute sepgsql_module_type;
|
|
|
|
# database trusted domain
|
|
type sepgsql_trusted_domain_t;
|
|
|
|
# database object types
|
|
type sepgsql_db_t, sepgsql_database_type;
|
|
|
|
type sepgsql_table_t, sepgsql_table_type;
|
|
type sepgsql_sysobj_t, sepgsql_table_type;
|
|
type sepgsql_secret_table_t, sepgsql_table_type;
|
|
type sepgsql_ro_table_t, sepgsql_table_type;
|
|
type sepgsql_fixed_table_t, sepgsql_table_type;
|
|
|
|
type sepgsql_proc_t, sepgsql_procedure_type;
|
|
type sepgsql_user_proc_t, sepgsql_procedure_type;
|
|
type sepgsql_trusted_proc_t, sepgsql_procedure_type;
|
|
|
|
type sepgsql_blob_t, sepgsql_blob_type;
|
|
type sepgsql_ro_blob_t, sepgsql_blob_type;
|
|
type sepgsql_secret_blob_t, sepgsql_blob_type;
|
|
|
|
typeattribute unlabeled_t sepgsql_database_type;
|
|
typeattribute unlabeled_t sepgsql_table_type;
|
|
typeattribute unlabeled_t sepgsql_procedure_type;
|
|
typeattribute unlabeled_t sepgsql_blob_type;
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL Server Local policy
|
|
# (sepgsql_server_type)
|
|
allow sepgsql_server_type self : netlink_selinux_socket create_socket_perms;
|
|
selinux_get_fs_mount(sepgsql_server_type)
|
|
selinux_get_enforce_mode(sepgsql_server_type)
|
|
selinux_validate_context(sepgsql_server_type)
|
|
selinux_compute_access_vector(sepgsql_server_type)
|
|
selinux_compute_create_context(sepgsql_server_type)
|
|
selinux_compute_relabel_context(sepgsql_server_type)
|
|
|
|
allow sepgsql_server_type sepgsql_database_type : db_database *;
|
|
allow sepgsql_server_type sepgsql_module_type : db_database { install_module };
|
|
allow sepgsql_server_type sepgsql_table_type : { db_table db_column db_tuple } *;
|
|
allow sepgsql_server_type sepgsql_procedure_type : db_procedure *;
|
|
allow sepgsql_server_type sepgsql_blob_type : db_blob *;
|
|
|
|
# server specific type transitions
|
|
type_transition sepgsql_server_type sepgsql_database_type : db_table sepgsql_sysobj_t;
|
|
type_transition sepgsql_server_type sepgsql_database_type : db_procedure sepgsql_proc_t;
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL Administrative domain local policy
|
|
# (sepgsql_unconfined_type)
|
|
|
|
tunable_policy(`sepgsql_enable_unconfined',`
|
|
allow sepgsql_unconfined_type sepgsql_database_type : db_database *;
|
|
allow sepgsql_unconfined_type sepgsql_module_type : db_database { install_module };
|
|
allow sepgsql_unconfined_type sepgsql_table_type : { db_table db_column db_tuple } *;
|
|
allow sepgsql_unconfined_type { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure *;
|
|
allow sepgsql_unconfined_type sepgsql_user_proc_t : db_procedure { create drop getattr setattr relabelfrom relabelto };
|
|
allow sepgsql_unconfined_type sepgsql_blob_type : db_blob *;
|
|
allow sepgsql_unconfined_type postgresql_t : db_blob { import export };
|
|
|
|
type_transition { sepgsql_unconfined_type - sepgsql_server_type } sepgsql_database_type : db_procedure sepgsql_proc_t;
|
|
',`
|
|
type_transition { sepgsql_unconfined_type - sepgsql_server_type } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL Users domain local policy
|
|
# (sepgsql_client_type)
|
|
|
|
allow sepgsql_client_type sepgsql_db_t : db_database { getattr access get_param set_param};
|
|
|
|
allow sepgsql_client_type sepgsql_table_t : db_table { getattr use select update insert delete };
|
|
allow sepgsql_client_type sepgsql_table_t : db_column { getattr use select update insert };
|
|
allow sepgsql_client_type sepgsql_table_t : db_tuple { use select update insert delete };
|
|
|
|
allow sepgsql_client_type sepgsql_sysobj_t : db_table { getattr use select };
|
|
allow sepgsql_client_type sepgsql_sysobj_t : db_column { getattr use select };
|
|
allow sepgsql_client_type sepgsql_sysobj_t : db_tuple { use select };
|
|
tunable_policy(`sepgsql_enable_users_ddl',`
|
|
allow sepgsql_client_type sepgsql_table_t : db_table { create drop setattr };
|
|
allow sepgsql_client_type sepgsql_table_t : db_column { create drop setattr };
|
|
allow sepgsql_client_type sepgsql_sysobj_t : db_tuple { update insert delete };
|
|
')
|
|
|
|
allow sepgsql_client_type sepgsql_secret_table_t : db_table { getattr };
|
|
allow sepgsql_client_type sepgsql_secret_table_t : db_column { getattr };
|
|
|
|
allow sepgsql_client_type sepgsql_ro_table_t : db_table { getattr use select };
|
|
allow sepgsql_client_type sepgsql_ro_table_t : db_column { getattr use select };
|
|
allow sepgsql_client_type sepgsql_ro_table_t : db_tuple { use select };
|
|
|
|
allow sepgsql_client_type sepgsql_fixed_table_t : db_table { getattr use select insert };
|
|
allow sepgsql_client_type sepgsql_fixed_table_t : db_column { getattr use select insert };
|
|
allow sepgsql_client_type sepgsql_fixed_table_t : db_tuple { use select insert };
|
|
|
|
allow sepgsql_client_type sepgsql_proc_t : db_procedure { getattr execute };
|
|
allow { sepgsql_client_type - sepgsql_unconfined_type } sepgsql_user_proc_t : db_procedure { create drop getattr setattr execute };
|
|
allow sepgsql_client_type sepgsql_trusted_proc_t : db_procedure { getattr execute entrypoint };
|
|
|
|
allow sepgsql_client_type sepgsql_blob_t : db_blob { create drop getattr setattr read write };
|
|
allow sepgsql_client_type sepgsql_ro_blob_t : db_blob { getattr read };
|
|
allow sepgsql_client_type sepgsql_secret_blob_t : db_blob { getattr };
|
|
|
|
# call trusted procedure
|
|
type_transition sepgsql_client_type sepgsql_trusted_proc_t : process sepgsql_trusted_domain_t;
|
|
allow sepgsql_client_type sepgsql_trusted_domain_t : process { transition };
|
|
|
|
# type transitions for rest of domains
|
|
type_transition domain domain : db_database sepgsql_db_t;
|
|
type_transition { domain - sepgsql_server_type } sepgsql_database_type : db_table sepgsql_table_t;
|
|
type_transition { domain - sepgsql_server_type - sepgsql_unconfined_type } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
|
|
type_transition domain sepgsql_database_type : db_blob sepgsql_blob_t;
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL Misc policies
|
|
#
|
|
|
|
# Trusted Procedure Domain
|
|
domain_type(sepgsql_trusted_domain_t)
|
|
role system_r types sepgsql_trusted_domain_t;
|
|
sepgsql_unconfined_domain(sepgsql_trusted_domain_t)
|
|
|
|
# The following permissions are allowed, even if sepgsql_enable_unconfined is disabled.
|
|
allow sepgsql_trusted_domain_t sepgsql_database_type : db_database { getattr setattr access get_param set_param};
|
|
allow sepgsql_trusted_domain_t sepgsql_table_type : db_table { getattr use select update insert delete lock };
|
|
allow sepgsql_trusted_domain_t sepgsql_table_type : db_column { getattr use select update insert };
|
|
allow sepgsql_trusted_domain_t sepgsql_table_type : db_tuple { use select update insert delete };
|
|
|
|
allow sepgsql_trusted_domain_t { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure { getattr execute };
|
|
allow sepgsql_trusted_domain_t sepgsql_user_proc_t : db_procedure { getattr };
|
|
allow sepgsql_trusted_domain_t sepgsql_blob_type : db_blob { getattr setattr read write };
|
|
|
|
# Database/Loadable module
|
|
allow sepgsql_database_type sepgsql_module_type : db_database { load_module };
|
|
|
|
########################################
|
|
#
|
|
# SE-PostgreSQL audit switch
|
|
#
|
|
tunable_policy(`sepgsql_enable_auditallow',`
|
|
auditallow domain sepgsql_database_type : db_database all_db_database_perms;
|
|
auditallow domain sepgsql_table_type : db_table all_db_table_perms;
|
|
auditallow domain sepgsql_table_type : db_column all_db_column_perms;
|
|
auditallow domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
|
|
auditallow domain sepgsql_blob_type : db_blob all_db_blob_perms;
|
|
auditallow domain sepgsql_server_type : db_blob { import export };
|
|
auditallow domain sepgsql_module_type : db_database { install_module };
|
|
')
|
|
tunable_policy(`sepgsql_enable_audittuple && sepgsql_enable_auditallow',`
|
|
auditallow domain sepgsql_table_type : db_tuple all_db_tuple_perms;
|
|
')
|
|
tunable_policy(`! sepgsql_enable_auditdeny',`
|
|
dontaudit domain sepgsql_database_type : db_database all_db_database_perms;
|
|
dontaudit domain sepgsql_table_type : db_table all_db_table_perms;
|
|
dontaudit domain sepgsql_table_type : db_column all_db_column_perms;
|
|
dontaudit domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
|
|
dontaudit domain sepgsql_blob_type : db_blob all_db_blob_perms;
|
|
dontaudit domain sepgsql_server_type : db_blob { import export };
|
|
dontaudit domain sepgsql_module_type : db_database { install_module };
|
|
')
|
|
tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
|
|
dontaudit domain sepgsql_table_type : db_tuple all_db_tuple_perms;
|
|
')
|
|
########################################
|
|
#
|
|
# Allow permission to external domains
|
|
#
|
|
|
|
# server domains
|
|
optional_policy(`
|
|
gen_require(`
|
|
type postgresql_t;
|
|
')
|
|
sepgsql_server_domain(postgresql_t)
|
|
')
|
|
|
|
# unconfined client domain
|
|
optional_policy(`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
sepgsql_unconfined_domain(unconfined_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type sysadm_t;
|
|
')
|
|
sepgsql_unconfined_domain(sysadm_t)
|
|
')
|
|
|
|
# generic client domain
|
|
optional_policy(`
|
|
gen_require(`
|
|
type user_t;
|
|
role user_r;
|
|
')
|
|
sepgsql_client_domain(user_t)
|
|
sepgsql_trusted_procedure_role(user_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type staff_t;
|
|
role staff_r;
|
|
')
|
|
sepgsql_client_domain(staff_t)
|
|
sepgsql_trusted_procedure_role(staff_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type user_t;
|
|
role user_r;
|
|
')
|
|
sepgsql_client_domain(user_t)
|
|
sepgsql_trusted_procedure_role(user_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type guest_t;
|
|
role guest_r;
|
|
')
|
|
sepgsql_client_domain(guest_t)
|
|
sepgsql_trusted_procedure_role(guest_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type xguest_t;
|
|
role xguest_r;
|
|
')
|
|
sepgsql_client_domain(xguest_t)
|
|
sepgsql_trusted_procedure_role(xguest_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type httpd_sys_script_t;
|
|
')
|
|
sepgsql_client_domain(httpd_sys_script_t)
|
|
')
|
|
|
|
# RBAC
|
|
optional_policy(`
|
|
gen_require(`
|
|
role unconfined_r;
|
|
')
|
|
sepgsql_trusted_procedure_role(unconfined_r)
|
|
')
|
|
|
|
# loadable module types
|
|
optional_policy(`
|
|
gen_require(`
|
|
type lib_t;
|
|
')
|
|
sepgsql_loadable_module(lib_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type textrel_shlib_t;
|
|
')
|
|
sepgsql_loadable_module(textrel_shlib_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Hotfixes for labeled networking
|
|
#
|
|
# NOTE: These changes are to be merged in the later releases.
|
|
corenet_tcp_recvfrom_labeled(sepgsql_server_type, sepgsql_client_type)
|
|
optional_policy(`
|
|
ipsec_match_default_spd(sepgsql_server_type)
|
|
ipsec_match_default_spd(sepgsql_client_type)
|
|
')
|