mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-14 10:05:02 +00:00
70aeeb918a
for the given database object identified by its name and object class.
It is necessary to implement a feature something like the restorecon on databases.
The specfile shall be described as follows:
------------------------
#
# The specfile for database objects
# (for SE-PostgreSQL)
#
# <object class> <object name> <security context>
#
db_database * system_u:object_r:sepgsql_db_t:s0
db_schema *.pg_catalog system_u:obejct_r:sepgsql_sys_schema_t:s0
db_schema *.* system_u:object_r:sepgsql_schema_t:s0
db_table *.pg_catalog.* system_u:object_r:sepgsql_sysobj_t:s0
db_table *.*.* system_u:object_r:sepgsql_table_t:s0
------------------------
- All the characters after the '#' are ignored.
- Wildcards ('*' and '?') are available.
- It returns the first match security context.
Note that hierarchy of the namespace of database objects depends on RDBMS.
So, author of the specfile needs to write correct patterns which are suitable
for the target RDBMS. The patched selabel_*() interfaces don't have any
heuristics for the namespace hierarchy to be suitable for widespread RDBMSs.
In the case of SE-PgSQL, when we lookup an expected security context for the
'my_table' table in the 'public' schema and 'postgres' database, the caller
shall provide 'postgres.public.my_table' as a key.
In the default, it tries to read a specfile which maps database objects and security
context from the /etc/selinux/$POLICYTYPE/contexts/sepgsql_contexts.
Note that when another RDBMS uses this interface, it needs to give an explicit
SELABEL_OPT_PATH option on the selabel_open().
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
94 lines
2.9 KiB
Groff
94 lines
2.9 KiB
Groff
.\" Hey Emacs! This file is -*- nroff -*- source.
|
|
.\"
|
|
.\" Author: KaiGai Kohei <kaigai@ak.jp.nec.com> 2009
|
|
.TH "selabel_db" "5" "22 Nov 2009" "" "SELinux API documentation"
|
|
.SH "NAME"
|
|
selabel_db \- userspace SELinux labeling interface: DB objects contexts backend.
|
|
.SH "SYNOPSIS"
|
|
.B #include <selinux/selinux.h>
|
|
|
|
.B #include <selinux/label.h>
|
|
.sp
|
|
.BI "int selabel_lookup(struct selabel_handle *" hnd ,
|
|
.in +\w'int selabel_lookup('u
|
|
.BI "security_context_t *" context ,
|
|
|
|
.BI "const char *" object_name ", int " object_type ");"
|
|
|
|
.SH "DESCRIPTION"
|
|
The DB contexts backend maps from a pair of object name and class into security contexts. It is used to find the appropriate context for database objects when relabeling a certain database.
|
|
|
|
The
|
|
.I object_name
|
|
should be fully qualified name using the hierarchy of database objects.
|
|
For example, the
|
|
.B pg_class
|
|
table in the
|
|
.B postgres
|
|
database and
|
|
.B pg_catalog
|
|
schema should be qualified as
|
|
.B postgres.pg_catalog.pg_class .
|
|
|
|
The
|
|
.I object_type
|
|
argument should be set to one of the following values:
|
|
.TP
|
|
.B SELABEL_DB_DATABASE
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a database itself, such as "postgres".
|
|
.TP
|
|
.B SELABEL_DB_SCHEMA
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a schema object, such as "postgres.public".
|
|
.TP
|
|
.B SELABEL_DB_TABLE
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a table object, such as "postgres.public.my_table"
|
|
.TP
|
|
.B SELABEL_DB_COLUMN
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a column object, such as "postgres.public.my_table.user_id"
|
|
.TP
|
|
.B SELABEL_DB_TUPLE
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a table object which contains the tuples to be relabeled, such as "postgresql.public.my_table". Note that we have no way to identify individual tuple objects, except for WHERE clause on DML statements, because it has no name.
|
|
.TP
|
|
.B SELABEL_DB_PROCEDURE
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a procedure object, such as "postgres.public.my_func". Note that we don't support to lookup individual security contexts for each procedures which have same name but different arguments.
|
|
.TP
|
|
.B SELABEL_DB_SEQUENCE
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a sequence object, such as "postgres.public.my_seq".
|
|
.TP
|
|
.B SELABEL_DB_BLOB
|
|
The
|
|
.I object_name
|
|
argument specifies the name of a large object, such as "postgres.16308".
|
|
Note that a large object does not have its name, so it is identified by its identifier value.
|
|
|
|
.SH "OPTIONS"
|
|
In addition to the global options described in
|
|
.BR selabel_open (3),
|
|
this backend recognizes the following options:
|
|
|
|
.TP
|
|
.B SELABEL_OPT_PATH
|
|
A non-null value for this option specifies a path to a file that will be opened in lieu of the standard DB contexts file.
|
|
It tries to open the specfile designed for SE-PostgreSQL in the default, so if another RDBMS uses this interface, it needs to give an explicit specfile designed for the RDBMS.
|
|
|
|
.SH "SEE ALSO"
|
|
.BR selabel_open (3),
|
|
.BR selabel_lookup (3),
|
|
.BR selabel_stats (3),
|
|
.BR selinux (8)
|
|
|