policy_module(postgresql, 1.20.0) gen_require(` class db_database all_db_database_perms; class db_table all_db_table_perms; class db_procedure all_db_procedure_perms; class db_column all_db_column_perms; class db_tuple all_db_tuple_perms; class db_blob all_db_blob_perms; class db_schema all_db_schema_perms; class db_view all_db_view_perms; class db_sequence all_db_sequence_perms; class db_language all_db_language_perms; ') ################################# # # Declarations # ## ##

## Allow unprived users to execute DDL statement ##

##
gen_tunable(sepgsql_enable_users_ddl, false) ## ##

## Allow transmit client label to foreign database ##

##
gen_tunable(sepgsql_transmit_client_label, false) ## ##

## Allow database admins to execute DML statement ##

##
gen_tunable(sepgsql_unconfined_dbadm, false) type postgresql_t; type postgresql_exec_t; init_daemon_domain(postgresql_t, postgresql_exec_t) type postgresql_db_t; files_type(postgresql_db_t) type postgresql_etc_t; files_config_file(postgresql_etc_t) type postgresql_initrc_exec_t; init_script_file(postgresql_initrc_exec_t) type postgresql_lock_t; files_lock_file(postgresql_lock_t) type postgresql_log_t; logging_log_file(postgresql_log_t) type postgresql_tmp_t; files_tmp_file(postgresql_tmp_t) type postgresql_unit_t; init_unit_file(postgresql_unit_t) type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) init_daemon_pid_file(postgresql_var_run_t, dir, "postgresql") # database clients attribute attribute sepgsql_admin_type; attribute sepgsql_client_type; attribute sepgsql_unconfined_type; # database objects attribute attribute sepgsql_database_type; attribute sepgsql_schema_type; attribute sepgsql_table_type; attribute sepgsql_sysobj_table_type; attribute sepgsql_sequence_type; attribute sepgsql_view_type; attribute sepgsql_procedure_type; attribute sepgsql_trusted_procedure_type; attribute sepgsql_language_type; attribute sepgsql_blob_type; attribute sepgsql_module_type; # database object types type sepgsql_blob_t; postgresql_blob_object(sepgsql_blob_t) type sepgsql_db_t; postgresql_database_object(sepgsql_db_t) type sepgsql_fixed_table_t; postgresql_table_object(sepgsql_fixed_table_t) type sepgsql_lang_t; postgresql_language_object(sepgsql_lang_t) type sepgsql_priv_lang_t; postgresql_language_object(sepgsql_priv_lang_t) type sepgsql_proc_exec_t; typealias sepgsql_proc_exec_t alias sepgsql_proc_t; postgresql_procedure_object(sepgsql_proc_exec_t) type sepgsql_ro_blob_t; postgresql_blob_object(sepgsql_ro_blob_t) type sepgsql_ro_table_t; postgresql_table_object(sepgsql_ro_table_t) type sepgsql_safe_lang_t; postgresql_language_object(sepgsql_safe_lang_t) type sepgsql_schema_t; postgresql_schema_object(sepgsql_schema_t) type sepgsql_secret_blob_t; postgresql_blob_object(sepgsql_secret_blob_t) type sepgsql_secret_table_t; postgresql_table_object(sepgsql_secret_table_t) type sepgsql_seq_t; postgresql_sequence_object(sepgsql_seq_t) type sepgsql_sysobj_t; postgresql_system_table_object(sepgsql_sysobj_t) type sepgsql_table_t; postgresql_table_object(sepgsql_table_t) type sepgsql_trusted_proc_exec_t; postgresql_trusted_procedure_object(sepgsql_trusted_proc_exec_t) # Ranged Trusted Procedure Domain type sepgsql_ranged_proc_t; domain_type(sepgsql_ranged_proc_t) role system_r types sepgsql_ranged_proc_t; type sepgsql_ranged_proc_exec_t; postgresql_trusted_procedure_object(sepgsql_ranged_proc_exec_t) # Types for temporary objects # # XXX - All the temporary objects are eliminated at end of database session # and invisible from other sessions, so it is unnecessary to restrict users # operations on temporary object. For policy simplification, only one type # is defined for temporary objects under the "pg_temp" schema. type sepgsql_temp_object_t; postgresql_table_object(sepgsql_temp_object_t) postgresql_sequence_object(sepgsql_temp_object_t) postgresql_view_object(sepgsql_temp_object_t) postgresql_procedure_object(sepgsql_temp_object_t) # Trusted Procedure Domain type sepgsql_trusted_proc_t; domain_type(sepgsql_trusted_proc_t) postgresql_unconfined(sepgsql_trusted_proc_t) role system_r types sepgsql_trusted_proc_t; type sepgsql_view_t; postgresql_view_object(sepgsql_view_t) # Types for unprivileged client type unpriv_sepgsql_blob_t; postgresql_blob_object(unpriv_sepgsql_blob_t) type unpriv_sepgsql_proc_exec_t; postgresql_procedure_object(unpriv_sepgsql_proc_exec_t) type unpriv_sepgsql_schema_t; postgresql_schema_object(unpriv_sepgsql_schema_t) type unpriv_sepgsql_seq_t; postgresql_sequence_object(unpriv_sepgsql_seq_t) type unpriv_sepgsql_sysobj_t; postgresql_system_table_object(unpriv_sepgsql_sysobj_t) type unpriv_sepgsql_table_t; postgresql_table_object(unpriv_sepgsql_table_t) type unpriv_sepgsql_view_t; postgresql_view_object(unpriv_sepgsql_view_t) # Types for UBAC type user_sepgsql_blob_t; typealias user_sepgsql_blob_t alias { staff_sepgsql_blob_t sysadm_sepgsql_blob_t }; typealias user_sepgsql_blob_t alias { auditadm_sepgsql_blob_t secadm_sepgsql_blob_t }; postgresql_blob_object(user_sepgsql_blob_t) type user_sepgsql_proc_exec_t; typealias user_sepgsql_proc_exec_t alias { staff_sepgsql_proc_exec_t sysadm_sepgsql_proc_exec_t }; typealias user_sepgsql_proc_exec_t alias { auditadm_sepgsql_proc_exec_t secadm_sepgsql_proc_exec_t }; postgresql_procedure_object(user_sepgsql_proc_exec_t) type user_sepgsql_schema_t; typealias user_sepgsql_schema_t alias { staff_sepgsql_schema_t sysadm_sepgsql_schema_t }; typealias user_sepgsql_schema_t alias { auditadm_sepgsql_schema_t secadm_sepgsql_schema_t }; postgresql_schema_object(user_sepgsql_schema_t) type user_sepgsql_seq_t; typealias user_sepgsql_seq_t alias { staff_sepgsql_seq_t sysadm_sepgsql_seq_t }; typealias user_sepgsql_seq_t alias { auditadm_sepgsql_seq_t secadm_sepgsql_seq_t }; postgresql_sequence_object(user_sepgsql_seq_t) type user_sepgsql_sysobj_t; typealias user_sepgsql_sysobj_t alias { staff_sepgsql_sysobj_t sysadm_sepgsql_sysobj_t }; typealias user_sepgsql_sysobj_t alias { auditadm_sepgsql_sysobj_t secadm_sepgsql_sysobj_t }; postgresql_system_table_object(user_sepgsql_sysobj_t) type user_sepgsql_table_t; typealias user_sepgsql_table_t alias { staff_sepgsql_table_t sysadm_sepgsql_table_t }; typealias user_sepgsql_table_t alias { auditadm_sepgsql_table_t secadm_sepgsql_table_t }; postgresql_table_object(user_sepgsql_table_t) type user_sepgsql_view_t; typealias user_sepgsql_view_t alias { staff_sepgsql_view_t sysadm_sepgsql_view_t }; typealias user_sepgsql_view_t alias { auditadm_sepgsql_view_t secadm_sepgsql_view_t }; postgresql_view_object(user_sepgsql_view_t) ######################################## # # postgresql Local policy # allow postgresql_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_admin sys_nice sys_tty_config }; dontaudit postgresql_t self:capability { sys_admin sys_tty_config }; allow postgresql_t self:process signal_perms; allow postgresql_t self:fifo_file rw_fifo_file_perms; allow postgresql_t self:file { getattr read }; allow postgresql_t self:sem create_sem_perms; allow postgresql_t self:shm create_shm_perms; allow postgresql_t self:tcp_socket create_stream_socket_perms; allow postgresql_t self:udp_socket create_stream_socket_perms; allow postgresql_t self:unix_dgram_socket create_socket_perms; allow postgresql_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow postgresql_t self:netlink_selinux_socket create_socket_perms; tunable_policy(`sepgsql_transmit_client_label',` allow postgresql_t self:process { setsockcreate }; ') allow postgresql_t sepgsql_database_type:db_database { create drop getattr setattr relabelfrom relabelto access install_module load_module get_param set_param }; allow postgresql_t sepgsql_module_type:db_database install_module; # Database/Loadable module allow sepgsql_database_type sepgsql_module_type:db_database load_module; allow postgresql_t {sepgsql_schema_type sepgsql_temp_object_t}:db_schema { create drop getattr setattr relabelfrom relabelto search add_name remove_name } ; type_transition postgresql_t sepgsql_database_type:db_schema sepgsql_schema_t; type_transition postgresql_t sepgsql_database_type:db_schema sepgsql_temp_object_t "pg_temp"; allow postgresql_t sepgsql_table_type:db_table { create drop getattr setattr relabelfrom relabelto select update insert delete lock }; allow postgresql_t sepgsql_table_type:db_column { create drop getattr setattr relabelfrom relabelto select update insert }; allow postgresql_t sepgsql_table_type:db_tuple { relabelfrom relabelto use select update insert delete }; type_transition postgresql_t sepgsql_schema_type:db_table sepgsql_sysobj_t; allow postgresql_t sepgsql_sequence_type:db_sequence { create drop getattr setattr relabelfrom relabelto get_value next_value set_value }; type_transition postgresql_t sepgsql_schema_type:db_sequence sepgsql_seq_t; allow postgresql_t sepgsql_view_type:db_view { create drop getattr setattr relabelfrom relabelto expand }; type_transition postgresql_t sepgsql_schema_type:db_view sepgsql_view_t; allow postgresql_t sepgsql_procedure_type:db_procedure { create drop getattr setattr relabelfrom relabelto execute entrypoint install }; type_transition postgresql_t sepgsql_schema_type:db_procedure sepgsql_proc_exec_t; allow postgresql_t sepgsql_blob_type:db_blob { create drop getattr setattr relabelfrom relabelto read write import export }; type_transition postgresql_t sepgsql_database_type:db_blob sepgsql_blob_t; manage_dirs_pattern(postgresql_t, postgresql_db_t, postgresql_db_t) manage_files_pattern(postgresql_t, postgresql_db_t, postgresql_db_t) manage_lnk_files_pattern(postgresql_t, postgresql_db_t, postgresql_db_t) manage_fifo_files_pattern(postgresql_t, postgresql_db_t, postgresql_db_t) manage_sock_files_pattern(postgresql_t, postgresql_db_t, postgresql_db_t) files_var_lib_filetrans(postgresql_t, postgresql_db_t, { dir file lnk_file sock_file fifo_file }) allow postgresql_t postgresql_etc_t:dir list_dir_perms; read_files_pattern(postgresql_t, postgresql_etc_t, postgresql_etc_t) read_lnk_files_pattern(postgresql_t, postgresql_etc_t, postgresql_etc_t) allow postgresql_t postgresql_exec_t:lnk_file { getattr read }; can_exec(postgresql_t, postgresql_exec_t ) allow postgresql_t postgresql_lock_t:file manage_file_perms; files_lock_filetrans(postgresql_t, postgresql_lock_t, file) manage_files_pattern(postgresql_t, postgresql_log_t, postgresql_log_t) logging_log_filetrans(postgresql_t, postgresql_log_t, { file dir }) allow postgresql_t postgresql_tmp_t:file map; manage_dirs_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) manage_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) manage_lnk_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) manage_fifo_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) manage_sock_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) files_tmp_filetrans(postgresql_t, postgresql_tmp_t, { dir file sock_file }) fs_tmpfs_filetrans(postgresql_t, postgresql_tmp_t, { dir file lnk_file sock_file fifo_file }) manage_dirs_pattern(postgresql_t, postgresql_var_run_t, postgresql_var_run_t) manage_files_pattern(postgresql_t, postgresql_var_run_t, postgresql_var_run_t) manage_sock_files_pattern(postgresql_t, postgresql_var_run_t, postgresql_var_run_t) files_pid_filetrans(postgresql_t, postgresql_var_run_t, { dir file }) kernel_read_kernel_sysctls(postgresql_t) kernel_read_system_state(postgresql_t) kernel_list_proc(postgresql_t) kernel_read_all_sysctls(postgresql_t) kernel_read_proc_symlinks(postgresql_t) corenet_all_recvfrom_unlabeled(postgresql_t) corenet_all_recvfrom_netlabel(postgresql_t) corenet_tcp_sendrecv_generic_if(postgresql_t) corenet_udp_sendrecv_generic_if(postgresql_t) corenet_tcp_sendrecv_generic_node(postgresql_t) corenet_udp_sendrecv_generic_node(postgresql_t) corenet_tcp_sendrecv_all_ports(postgresql_t) corenet_udp_sendrecv_all_ports(postgresql_t) corenet_udp_bind_generic_node(postgresql_t) corenet_tcp_bind_generic_node(postgresql_t) corenet_tcp_bind_postgresql_port(postgresql_t) corenet_tcp_connect_auth_port(postgresql_t) corenet_tcp_connect_postgresql_port(postgresql_t) corenet_sendrecv_postgresql_server_packets(postgresql_t) corenet_sendrecv_auth_client_packets(postgresql_t) dev_read_sysfs(postgresql_t) dev_read_urand(postgresql_t) fs_getattr_all_fs(postgresql_t) fs_search_auto_mountpoints(postgresql_t) fs_mmap_rw_hugetlbfs_files(postgresql_t) selinux_get_enforce_mode(postgresql_t) selinux_validate_context(postgresql_t) selinux_compute_access_vector(postgresql_t) selinux_compute_create_context(postgresql_t) selinux_compute_relabel_context(postgresql_t) term_use_controlling_term(postgresql_t) corecmd_exec_bin(postgresql_t) corecmd_exec_shell(postgresql_t) domain_dontaudit_list_all_domains_state(postgresql_t) domain_use_interactive_fds(postgresql_t) files_dontaudit_search_home(postgresql_t) files_manage_etc_files(postgresql_t) files_search_etc(postgresql_t) files_read_etc_runtime_files(postgresql_t) files_read_usr_files(postgresql_t) auth_use_pam(postgresql_t) init_read_utmp(postgresql_t) logging_send_syslog_msg(postgresql_t) logging_send_audit_msgs(postgresql_t) miscfiles_read_localization(postgresql_t) seutil_libselinux_linked(postgresql_t) seutil_read_default_contexts(postgresql_t) userdom_dontaudit_use_unpriv_user_fds(postgresql_t) userdom_dontaudit_search_user_home_dirs(postgresql_t) userdom_dontaudit_use_user_terminals(postgresql_t) optional_policy(` mta_getattr_spool(postgresql_t) ') tunable_policy(`allow_execmem',` allow postgresql_t self:process execmem; ') optional_policy(` consoletype_exec(postgresql_t) ') optional_policy(` cron_search_spool(postgresql_t) cron_system_entry(postgresql_t, postgresql_exec_t) ') optional_policy(` hostname_exec(postgresql_t) ') optional_policy(` ipsec_match_default_spd(postgresql_t) ') optional_policy(` kerberos_use(postgresql_t) ') optional_policy(` seutil_sigchld_newrole(postgresql_t) ') optional_policy(` udev_read_db(postgresql_t) ') ######################################## # # Ranged Trusted Procedure Domain # # XXX - the purpose of this domain is to switch security context of # the database client using dynamic domain transition; typically, # used for connection pooling software that shall assign a security # context at beginning of the user session based on the credentials # being invisible from unprivileged domains. # allow sepgsql_ranged_proc_t self:process setcurrent; domain_dyntrans_type(sepgsql_ranged_proc_t) mcs_process_set_categories(sepgsql_ranged_proc_t) mls_process_set_level(sepgsql_ranged_proc_t) postgresql_unconfined(sepgsql_ranged_proc_t) ######################################## # # Rules common to all clients # allow sepgsql_client_type sepgsql_db_t:db_database { getattr access get_param set_param }; type_transition sepgsql_client_type sepgsql_client_type:db_database sepgsql_db_t; allow sepgsql_client_type sepgsql_schema_t:db_schema { getattr search }; allow sepgsql_client_type sepgsql_fixed_table_t:db_table { getattr select insert lock }; allow sepgsql_client_type sepgsql_fixed_table_t:db_column { getattr select insert }; allow sepgsql_client_type sepgsql_fixed_table_t:db_tuple { select insert }; allow sepgsql_client_type sepgsql_table_t:db_table { getattr select update insert delete lock }; allow sepgsql_client_type sepgsql_table_t:db_column { getattr select update insert }; allow sepgsql_client_type sepgsql_table_t:db_tuple { select update insert delete }; allow sepgsql_client_type sepgsql_ro_table_t:db_table { getattr select lock }; allow sepgsql_client_type sepgsql_ro_table_t:db_column { getattr select }; allow sepgsql_client_type sepgsql_ro_table_t:db_tuple { select }; allow sepgsql_client_type sepgsql_secret_table_t:db_table getattr; allow sepgsql_client_type sepgsql_secret_table_t:db_column getattr; allow sepgsql_client_type sepgsql_sysobj_t:db_table { getattr select lock }; allow sepgsql_client_type sepgsql_sysobj_t:db_column { getattr select }; allow sepgsql_client_type sepgsql_sysobj_t:db_tuple { use select }; allow sepgsql_client_type sepgsql_seq_t:db_sequence { getattr get_value next_value }; allow sepgsql_client_type sepgsql_view_t:db_view { getattr expand }; allow sepgsql_client_type sepgsql_proc_exec_t:db_procedure { getattr execute install }; allow sepgsql_client_type sepgsql_trusted_procedure_type:db_procedure { getattr execute entrypoint }; allow sepgsql_client_type sepgsql_lang_t:db_language { getattr }; allow sepgsql_client_type sepgsql_safe_lang_t:db_language { getattr execute }; # Only DBA can implement SQL procedures using `unsafe' procedural languages. # The `unsafe' one provides a capability to access internal data structure, # so we don't allow user-defined function being implemented using `unsafe' one. allow sepgsql_proc_exec_t sepgsql_lang_t:db_language { implement }; allow sepgsql_procedure_type sepgsql_safe_lang_t:db_language { implement }; allow sepgsql_client_type sepgsql_blob_t:db_blob { create drop getattr setattr read write }; allow sepgsql_client_type sepgsql_ro_blob_t:db_blob { getattr read }; allow sepgsql_client_type sepgsql_secret_blob_t:db_blob getattr; # The purpose of the dontaudit rule in row-level access control is to prevent a flood of logs. # If a client tries to SELECT a table including violated tuples, these are filtered from # the result set as if not exist, but its access denied longs can be recorded within log files. # In generally, the number of tuples are much larger than the number of columns, tables and so on. # So, it makes a flood of logs when many tuples are violated. # # The default policy does not prevent anything for sepgsql_client_type sepgsql_unconfined_type, # so we don't need "dontaudit" rules in Type-Enforcement. However, MLS/MCS can prevent them # to access classified tuples and can make a audit record. # # Therefore, the following rule is applied for any domains which can connect SE-PostgreSQL. dontaudit { postgresql_t sepgsql_admin_type sepgsql_client_type sepgsql_unconfined_type } { sepgsql_table_type -sepgsql_sysobj_table_type }:db_tuple { use select update insert delete }; # It is always allowed to operate temporary objects for any database client. allow sepgsql_client_type sepgsql_temp_object_t:db_schema { create drop getattr setattr search add_name remove_name }; allow sepgsql_client_type sepgsql_temp_object_t:db_table { create drop getattr setattr select update insert delete lock }; allow sepgsql_client_type sepgsql_temp_object_t:db_column { create drop getattr setattr select update insert }; allow sepgsql_client_type sepgsql_temp_object_t:db_tuple { use select update insert delete }; allow sepgsql_client_type sepgsql_temp_object_t:db_sequence { create drop getattr setattr get_value next_value set_value }; allow sepgsql_client_type sepgsql_temp_object_t:db_view { create drop getattr setattr expand }; allow sepgsql_client_type sepgsql_temp_object_t:db_procedure { create drop getattr setattr execute entrypoint install }; # Note that permission of creation/deletion are eventually controlled by # create or drop permission of individual objects within shared schemas. # So, it just allows to create/drop user specific types. tunable_policy(`sepgsql_enable_users_ddl',` allow sepgsql_client_type sepgsql_schema_t:db_schema { add_name remove_name }; ') ######################################## # # Rules common to administrator clients # allow sepgsql_admin_type sepgsql_database_type:db_database { create drop getattr setattr relabelfrom relabelto access }; allow sepgsql_admin_type sepgsql_schema_type:db_schema { create drop getattr setattr relabelfrom relabelto search add_name remove_name }; type_transition sepgsql_admin_type sepgsql_database_type:db_schema sepgsql_schema_t; type_transition sepgsql_admin_type sepgsql_database_type:db_schema sepgsql_temp_object_t "pg_temp"; allow sepgsql_admin_type sepgsql_table_type:db_table { create drop getattr setattr relabelfrom relabelto lock }; allow sepgsql_admin_type sepgsql_table_type:db_column { create drop getattr setattr relabelfrom relabelto }; allow sepgsql_admin_type sepgsql_sysobj_table_type:db_tuple { relabelfrom relabelto use select update insert delete }; type_transition sepgsql_admin_type sepgsql_schema_type:db_table sepgsql_table_t; allow sepgsql_admin_type sepgsql_sequence_type:db_sequence { create drop getattr setattr relabelfrom relabelto get_value next_value set_value }; type_transition sepgsql_admin_type sepgsql_schema_type:db_sequence sepgsql_seq_t; allow sepgsql_admin_type sepgsql_view_type:db_view { create drop getattr setattr relabelfrom relabelto expand }; type_transition sepgsql_admin_type sepgsql_schema_type:db_view sepgsql_view_t; allow sepgsql_admin_type sepgsql_procedure_type:db_procedure { create drop getattr relabelfrom relabelto }; allow sepgsql_admin_type sepgsql_proc_exec_t:db_procedure execute; type_transition sepgsql_admin_type sepgsql_schema_type:db_procedure sepgsql_proc_exec_t; allow sepgsql_admin_type sepgsql_temp_object_t:db_schema { create drop getattr setattr search add_name remove_name }; allow sepgsql_admin_type sepgsql_temp_object_t:db_table { create drop getattr setattr select update insert delete lock }; allow sepgsql_admin_type sepgsql_temp_object_t:db_column { create drop getattr setattr select update insert }; allow sepgsql_admin_type sepgsql_temp_object_t:db_tuple { use select update insert delete }; allow sepgsql_admin_type sepgsql_temp_object_t:db_sequence { create drop getattr setattr get_value next_value set_value }; allow sepgsql_admin_type sepgsql_temp_object_t:db_view { create drop getattr setattr expand }; allow sepgsql_admin_type sepgsql_temp_object_t:db_procedure { create drop getattr setattr execute entrypoint install }; allow sepgsql_admin_type sepgsql_language_type:db_language { create drop getattr setattr relabelfrom relabelto execute }; type_transition sepgsql_admin_type sepgsql_database_type:db_language sepgsql_lang_t; allow sepgsql_admin_type sepgsql_blob_type:db_blob { create drop getattr setattr relabelfrom relabelto }; type_transition sepgsql_admin_type sepgsql_database_type:db_blob sepgsql_blob_t; allow sepgsql_admin_type sepgsql_module_type:db_database install_module; kernel_relabelfrom_unlabeled_database(sepgsql_admin_type) tunable_policy(`sepgsql_unconfined_dbadm',` allow sepgsql_admin_type sepgsql_database_type:db_database { create drop getattr setattr relabelfrom relabelto access install_module load_module get_param set_param }; allow sepgsql_admin_type sepgsql_schema_type:db_schema { create drop getattr setattr relabelfrom relabelto search add_name remove_name }; allow sepgsql_admin_type sepgsql_table_type:db_table { create drop getattr setattr relabelfrom relabelto select update insert delete lock }; allow sepgsql_admin_type sepgsql_table_type:db_column { create drop getattr setattr relabelfrom relabelto select update insert }; allow sepgsql_admin_type sepgsql_table_type:db_tuple { relabelfrom relabelto use select update insert delete }; allow sepgsql_admin_type sepgsql_sequence_type:db_sequence { create drop getattr setattr relabelfrom relabelto get_value next_value set_value }; allow sepgsql_admin_type sepgsql_view_type:db_view { create drop getattr setattr relabelfrom relabelto expand }; allow sepgsql_admin_type sepgsql_proc_exec_t:db_procedure { create drop getattr setattr relabelfrom relabelto execute entrypoint install }; allow sepgsql_admin_type sepgsql_trusted_procedure_type:db_procedure { create drop getattr setattr relabelfrom relabelto execute entrypoint }; allow sepgsql_admin_type sepgsql_procedure_type:db_procedure { create drop getattr setattr relabelfrom relabelto entrypoint }; allow sepgsql_admin_type sepgsql_language_type:db_language { create drop getattr setattr relabelfrom relabelto execute }; allow sepgsql_admin_type sepgsql_blob_type:db_blob { create drop getattr setattr relabelfrom relabelto read write import export }; ') ######################################## # # Unconfined access to this module # allow sepgsql_unconfined_type sepgsql_database_type:db_database { create drop getattr setattr relabelfrom relabelto access install_module load_module get_param set_param }; allow sepgsql_unconfined_type { sepgsql_schema_type sepgsql_temp_object_t }:db_schema { create drop getattr setattr relabelfrom relabelto search add_name remove_name }; type_transition sepgsql_unconfined_type sepgsql_database_type:db_schema sepgsql_schema_t; type_transition sepgsql_unconfined_type sepgsql_database_type:db_schema sepgsql_temp_object_t "pg_temp"; type_transition sepgsql_unconfined_type sepgsql_schema_type:db_table sepgsql_table_t; type_transition sepgsql_unconfined_type sepgsql_schema_type:db_sequence sepgsql_seq_t; type_transition sepgsql_unconfined_type sepgsql_schema_type:db_view sepgsql_view_t; type_transition sepgsql_unconfined_type sepgsql_schema_type:db_procedure sepgsql_proc_exec_t; type_transition sepgsql_unconfined_type sepgsql_database_type:db_language sepgsql_lang_t; type_transition sepgsql_unconfined_type sepgsql_database_type:db_blob sepgsql_blob_t; allow sepgsql_unconfined_type sepgsql_table_type:db_table { create drop getattr setattr relabelfrom relabelto select update insert delete lock }; allow sepgsql_unconfined_type sepgsql_table_type:db_column { create drop getattr setattr relabelfrom relabelto select update insert }; allow sepgsql_unconfined_type sepgsql_table_type:db_tuple { relabelfrom relabelto use select update insert delete }; allow sepgsql_unconfined_type sepgsql_sequence_type:db_sequence { create drop getattr setattr relabelfrom relabelto get_value next_value set_value }; allow sepgsql_unconfined_type sepgsql_view_type:db_view { create drop getattr setattr relabelfrom relabelto expand }; # unconfined domain is not allowed to invoke user defined procedure directly. # They have to confirm and relabel it at first. allow sepgsql_unconfined_type sepgsql_proc_exec_t:db_procedure { create drop getattr setattr relabelfrom relabelto execute entrypoint install }; allow sepgsql_unconfined_type sepgsql_trusted_procedure_type:db_procedure { create drop getattr setattr relabelfrom relabelto execute entrypoint }; allow sepgsql_unconfined_type sepgsql_procedure_type:db_procedure { create drop getattr setattr relabelfrom relabelto entrypoint }; allow sepgsql_unconfined_type sepgsql_language_type:db_language { create drop getattr setattr relabelfrom relabelto execute }; allow sepgsql_unconfined_type sepgsql_blob_type:db_blob { create drop getattr setattr relabelfrom relabelto read write import export }; allow sepgsql_unconfined_type sepgsql_module_type:db_database install_module; kernel_relabelfrom_unlabeled_database(sepgsql_unconfined_type)