nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move one block in postgresql.

Browse Source
This commit is contained in:
Chris PeBenito 2011-01-14 10:13:12 -05:00
parent 82c32d5cf4
commit c174d239d0
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
policy/modules/services/postgresql.te
View File

@ -367,12 +367,6 @@ allow sepgsql_client_type sepgsql_db_t:db_database { getattr access get_param se
type_transition sepgsql_client_type sepgsql_client_type:db_database sepgsql_db_t;
allow sepgsql_client_type sepgsql_schema_t:db_schema { getattr search };
# Note that permission of creation/deletion are eventually controlled by
# create or drop permission of individual objects within shared schemas.
# So, it just allows to create/drop user specific types.
tunable_policy(`sepgsql_enable_users_ddl',`
allow sepgsql_client_type sepgsql_schema_t:db_schema { add_name remove_name };
')
allow sepgsql_client_type sepgsql_fixed_table_t:db_table { getattr use select insert lock };
allow sepgsql_client_type sepgsql_fixed_table_t:db_column { getattr use select insert };
@ -426,6 +420,13 @@ allow sepgsql_client_type sepgsql_secret_blob_t:db_blob getattr;
# Therefore, the following rule is applied for any domains which can connect SE-PostgreSQL.
dontaudit { postgresql_t sepgsql_admin_type sepgsql_client_type sepgsql_unconfined_type } { sepgsql_table_type -sepgsql_sysobj_table_type }:db_tuple { use select update insert delete };
# Note that permission of creation/deletion are eventually controlled by
# create or drop permission of individual objects within shared schemas.
# So, it just allows to create/drop user specific types.
tunable_policy(`sepgsql_enable_users_ddl',`
allow sepgsql_client_type sepgsql_schema_t:db_schema { add_name remove_name };
')
########################################
#
# Rules common to administrator clients