82c32d5cf4
The attached patch adds a few database object classes, as follows: * db_schema ------------ A schema object performs as a namespace in database; similar to directories in filesystem. It seems some of (but not all) database objects are stored within a certain schema logically. We can qualify these objects using schema name. For example, a table: "my_tbl" within a schema: "my_scm" is identified by "my_scm.my_tbl". This table is completely different from "your_scm.my_tbl" that it a table within a schema: "your_scm". Its characteristics is similar to a directory in filesystem, so it has similar permissions. The 'search' controls to resolve object name within a schema. The 'add_name' and 'remove_name' controls to add/remove an object to/from a schema. See also, http://developer.postgresql.org/pgdocs/postgres/sql-createschema.html In the past discussion, a rubix folks concerned about no object class definition for schema and catalog which is an upper level namespace. Since I'm not certain whether we have a disadvantage when 'db_schema' class is applied on catalog class, I don't add this definition yet. Default security context of 'db_table' and 'db_procedure' classes get being computed using type_transition with 'db_schema' class, instead of 'db_database' class. It reflects logical hierarchy of database object more correctly. * db_view ---------- A view object performs as a virtual table. We can run SELECT statement on views, although it has no physical entities. The definition of views are expanded in run-time, so it allows us to describe complex queries with keeping readability. This object class uniquely provides 'expand' permission that controls whether user can expand this view, or not. The default security context shall be computed by type transition rule with a schema object that owning the view. See also, http://developer.postgresql.org/pgdocs/postgres/sql-createview.html * db_sequence -------------- A sequence object is a sequential number generator. This object class uniquely provides 'get_value', 'next_value' and 'set_value' permissions. The 'get_value' controls to reference the sequence object. The 'next_value' controls to fetch and increment the value of sequence object. The 'set_value' controls to set an arbitrary value. The default security context shall be computed by type transition rule with a schema object that owning the sequence. See also, http://developer.postgresql.org/pgdocs/postgres/sql-createsequence.html * db_language -------------- A language object is an installed engine to execute procedures. PostgreSQL supports to define SQL procedures using regular script languages; such as Perl, Tcl, not only SQL or binary modules. In addition, v9.0 or later supports DO statement. It allows us to execute a script statement on server side without defining a SQL procedure. It requires to control whether user can execute DO statement on this language, or not. This object class uniquely provides 'implement' and 'execute' permissions. The 'implement' controls whether a procedure can be implemented with this language, or not. So, it takes security context of the procedure as subject. The 'execute' controls to execute code block using DO statement. The default security context shall be computed by type transition rule with a database object, because it is not owned by a certain schema. In the default policy, we provide two types: 'sepgsql_lang_t' and 'sepgsql_safe_lang_t' that allows unpriv users to execute DO statement. The default is 'sepgsql_leng_t'. We assume newly installed language may be harm, so DBA has to relabel it explicitly, if he want user defined procedures using the language. See also, http://developer.postgresql.org/pgdocs/postgres/sql-createlanguage.html http://developer.postgresql.org/pgdocs/postgres/sql-do.html P.S) I found a bug in MCS. It didn't constraint 'relabelfrom' permission of 'db_procedure' class. IIRC, I fixed it before, but it might be only MLS side. Sorry. Thanks, -- KaiGai Kohei <kaigai@ak.jp.nec.com> policy/flask/access_vectors | 29 ++++++++ policy/flask/security_classes | 6 ++ policy/mcs | 16 ++++- policy/mls | 58 ++++++++++++++- policy/modules/kernel/kernel.if | 8 ++ policy/modules/services/postgresql.if | 125 +++++++++++++++++++++++++++++++-- policy/modules/services/postgresql.te | 116 +++++++++++++++++++++++++++++- 7 files changed, 342 insertions(+), 16 deletions(-)
135 lines
2.4 KiB
Plaintext
135 lines
2.4 KiB
Plaintext
# FLASK
|
|
|
|
#
|
|
# Define the security object classes
|
|
#
|
|
|
|
# Classes marked as userspace are classes
|
|
# for userspace object managers
|
|
|
|
class security
|
|
class process
|
|
class system
|
|
class capability
|
|
|
|
# file-related classes
|
|
class filesystem
|
|
class file
|
|
class dir
|
|
class fd
|
|
class lnk_file
|
|
class chr_file
|
|
class blk_file
|
|
class sock_file
|
|
class fifo_file
|
|
|
|
# network-related classes
|
|
class socket
|
|
class tcp_socket
|
|
class udp_socket
|
|
class rawip_socket
|
|
class node
|
|
class netif
|
|
class netlink_socket
|
|
class packet_socket
|
|
class key_socket
|
|
class unix_stream_socket
|
|
class unix_dgram_socket
|
|
|
|
# sysv-ipc-related classes
|
|
class sem
|
|
class msg
|
|
class msgq
|
|
class shm
|
|
class ipc
|
|
|
|
#
|
|
# userspace object manager classes
|
|
#
|
|
|
|
# passwd/chfn/chsh
|
|
class passwd # userspace
|
|
|
|
# SE-X Windows stuff (more classes below)
|
|
class x_drawable # userspace
|
|
class x_screen # userspace
|
|
class x_gc # userspace
|
|
class x_font # userspace
|
|
class x_colormap # userspace
|
|
class x_property # userspace
|
|
class x_selection # userspace
|
|
class x_cursor # userspace
|
|
class x_client # userspace
|
|
class x_device # userspace
|
|
class x_server # userspace
|
|
class x_extension # userspace
|
|
|
|
# extended netlink sockets
|
|
class netlink_route_socket
|
|
class netlink_firewall_socket
|
|
class netlink_tcpdiag_socket
|
|
class netlink_nflog_socket
|
|
class netlink_xfrm_socket
|
|
class netlink_selinux_socket
|
|
class netlink_audit_socket
|
|
class netlink_ip6fw_socket
|
|
class netlink_dnrt_socket
|
|
|
|
class dbus # userspace
|
|
class nscd # userspace
|
|
|
|
# IPSec association
|
|
class association
|
|
|
|
# Updated Netlink class for KOBJECT_UEVENT family.
|
|
class netlink_kobject_uevent_socket
|
|
|
|
class appletalk_socket
|
|
|
|
class packet
|
|
|
|
# Kernel access key retention
|
|
class key
|
|
|
|
class context # userspace
|
|
|
|
class dccp_socket
|
|
|
|
class memprotect
|
|
|
|
class db_database # userspace
|
|
class db_table # userspace
|
|
class db_procedure # userspace
|
|
class db_column # userspace
|
|
class db_tuple # userspace
|
|
class db_blob # userspace
|
|
|
|
# network peer labels
|
|
class peer
|
|
|
|
# Capabilities >= 32
|
|
class capability2
|
|
|
|
# More SE-X Windows stuff
|
|
class x_resource # userspace
|
|
class x_event # userspace
|
|
class x_synthetic_event # userspace
|
|
class x_application_data # userspace
|
|
|
|
# kernel services that need to override task security, e.g. cachefiles
|
|
class kernel_service
|
|
|
|
class tun_socket
|
|
|
|
# Still More SE-X Windows stuff
|
|
class x_pointer # userspace
|
|
class x_keyboard # userspace
|
|
|
|
# More Database stuff
|
|
class db_schema # userspace
|
|
class db_view # userspace
|
|
class db_sequence # userspace
|
|
class db_language # userspace
|
|
|
|
# FLASK
|