nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
88c8189207
selinux-refpolicy/policy/modules/services/postgresql.fc

57 lines
2.7 KiB
Plaintext
Raw Normal View History

final updates from nsa cvs
2005-09-19 21:17:45 +00:00
#
# /etc
#
Add two postgresql file contexts from gentoo policy Gentoo appends version numbers to the names of the init script and the config directory.
2014-02-08 17:31:52 +00:00
/etc/postgresql(-.*)?(/.*)? gen_context(system_u:object_r:postgresql_etc_t,s0)
Whitespace fix in postgresql.fc
2014-03-14 14:10:32 +00:00
/etc/rc\.d/init\.d/(se)?postgresql(-.*)? -- gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
Add two postgresql file contexts from gentoo policy Gentoo appends version numbers to the names of the init script and the config directory.
2014-02-08 17:31:52 +00:00
postgresql patch from Dan Walsh: "File context for /etc/sysconfig/pgsql and other bugs. Sends audit messages connect to posgresql_server port Reads its own process info" Moved signal interface for style.
2010-03-19 17:51:32 +00:00
/etc/sysconfig/pgsql(/.*)? gen_context(system_u:object_r:postgresql_etc_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
#
# /usr
#
trunk: add sepostgresql policy from kaigai kohei.
2008-06-10 15:33:18 +00:00
/usr/bin/initdb(\.sepgsql)? -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/bin/(se)?postgres -- gen_context(system_u:object_r:postgresql_exec_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
Simplify .fc in light of file_contexts.subs_dist Now that we have file_contexts.subs_dist, translations that were put in the file context definition files can now be cleaned up. Differences from v1: - removes a few duplicate entries in the libraries.fc file, and - removes the contrib references Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-05-07 18:36:06 +00:00
/usr/lib/pgsql/test/regress(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
/usr/lib/pgsql/test/regress/pg_regress -- gen_context(system_u:object_r:postgresql_exec_t,s0)
Only label administrative postgres commands as postgresql_exec_t Currently, all postgresql commands in are labeled as postgresql_exec_t. This means they can only be executed by db admins. However, the "normal" commands, such as createdb or psql, should also be executable by users. (The users in question still need to be granted postgresql_role(), so this is no security problem.)
2014-08-12 12:35:57 +00:00
Also apply the new postgres labeling scheme on Debian I'm sure this is the right thing to do; however, the Debian developers might want to have a say in this, so I made a separate patch.
2014-08-12 12:35:58 +00:00
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_archivecleanup -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_basebackup -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_controldata -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_ctl -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_resetxlog -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_standby -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_upgrade -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_xlogdump -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/postgres -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/lib/postgresql(-.*)?/(.*/)?bin/postmaster -l gen_context(system_u:object_r:postgresql_exec_t,s0)
fixes from thomas bleher Fri, 24 Mar 2006 13:25:54 +0100
2006-03-24 16:48:35 +00:00
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
ifdef(`distro_redhat', `
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/share/jonas/pgsql(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
')
#
# /var
#
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/lib/postgres(ql)?(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/lib/pgsql/data(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
trunk: 2 patches from dan.
2008-08-14 15:10:41 +00:00
/var/lib/pgsql/logfile(/.*)? gen_context(system_u:object_r:postgresql_log_t,s0)
patch to fix escaping of . in file contexts from james athey
2006-07-24 15:43:57 +00:00
/var/lib/pgsql/pgstartup\.log gen_context(system_u:object_r:postgresql_log_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
trunk: add sepostgresql policy from kaigai kohei.
2008-06-10 15:33:18 +00:00
/var/lib/sepgsql(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
/var/lib/sepgsql/pgstartup\.log -- gen_context(system_u:object_r:postgresql_log_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/log/postgres\.log.* -- gen_context(system_u:object_r:postgresql_log_t,s0)
/var/log/postgresql(/.*)? gen_context(system_u:object_r:postgresql_log_t,s0)
trunk: add sepostgresql policy from kaigai kohei.
2008-06-10 15:33:18 +00:00
/var/log/sepostgresql\.log.* -- gen_context(system_u:object_r:postgresql_log_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
ifdef(`distro_redhat', `
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/log/rhdb/rhdb(/.*)? gen_context(system_u:object_r:postgresql_log_t,s0)
final updates from nsa cvs
2005-09-19 21:17:45 +00:00
')
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/postgresql(/.*)? gen_context(system_u:object_r:postgresql_runtime_t,s0)
postgresql patch from Dan Walsh: "File context for /etc/sysconfig/pgsql and other bugs. Sends audit messages connect to posgresql_server port Reads its own process info" Moved signal interface for style.
2010-03-19 17:51:32 +00:00
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/postmaster.* gen_context(system_u:object_r:postgresql_runtime_t,s0)
Reference in New Issue Copy Permalink