Teach sepgsql about database labels.

This is still a bit of a hack, but it's better than the old way, for sure.

KaiGai Kohei, with one change by me to make it compile

diff --git a/contrib/sepgsql/Makefile b/contrib/sepgsql/Makefile
index c83b2e3cef80d826b83d41c37aa7d905a050037c..033c41a819920ca029925ba6a34f6e87c9361067 100644 (file)
--- a/contrib/sepgsql/Makefile
+++ b/contrib/sepgsql/Makefile
@@ -2,7 +2,7 @@
 
 MODULE_big = sepgsql
 OBJS = hooks.o selinux.o uavc.o label.o dml.o \
-   schema.o relation.o proc.o
+   database.o schema.o relation.o proc.o
 DATA_built = sepgsql.sql
 
 REGRESS = label dml misc

diff --git a/contrib/sepgsql/database.c b/contrib/sepgsql/database.c
new file mode 100644 (file)
index 0000000..7f15d9c
--- /dev/null
+++ b/contrib/sepgsql/database.c
@@ -0,0 +1,88 @@
+/* -------------------------------------------------------------------------
+ *
+ * contrib/sepgsql/database.c
+ *
+ * Routines corresponding to database objects
+ *
+ * Copyright (c) 2010-2011, PostgreSQL Global Development Group
+ *
+ * -------------------------------------------------------------------------
+ */
+#include "postgres.h"
+
+#include "catalog/dependency.h"
+#include "catalog/pg_database.h"
+#include "commands/seclabel.h"
+#include "sepgsql.h"
+
+void
+sepgsql_database_post_create(Oid databaseId)
+{
+   char   *scontext = sepgsql_get_client_label();
+   char   *tcontext;
+   char   *ncontext;
+   ObjectAddress   object;
+
+   /*
+    * Compute a default security label of the newly created database
+    * based on a pair of security label of client and source database.
+    *
+    * XXX - Right now, this logic uses "template1" as its source, because
+    * here is no way to know the Oid of source database.
+    */
+   object.classId = DatabaseRelationId;
+   object.objectId = TemplateDbOid;
+   object.objectSubId = 0;
+   tcontext = GetSecurityLabel(&object, SEPGSQL_LABEL_TAG);
+
+   ncontext = sepgsql_compute_create(scontext, tcontext,
+                                     SEPG_CLASS_DB_DATABASE);
+
+   /*
+    * Assign the default security label on the new database
+    */
+   object.classId = DatabaseRelationId;
+   object.objectId = databaseId;
+   object.objectSubId = 0;
+
+   SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
+
+   pfree(ncontext);
+   pfree(tcontext);
+}
+
+/*
+ * sepgsql_database_relabel
+ *
+ * It checks privileges to relabel the supplied database with the `seclabel'
+ */
+void
+sepgsql_database_relabel(Oid databaseId, const char *seclabel)
+{
+   ObjectAddress   object;
+   char           *audit_name;
+
+   object.classId = DatabaseRelationId;
+   object.objectId = databaseId;
+   object.objectSubId = 0;
+   audit_name = getObjectDescription(&object);
+
+   /*
+    * check db_database:{setattr relabelfrom} permission
+    */
+   sepgsql_avc_check_perms(&object,
+                           SEPG_CLASS_DB_DATABASE,
+                           SEPG_DB_DATABASE__SETATTR |
+                           SEPG_DB_DATABASE__RELABELFROM,
+                           audit_name,
+                           true);
+   /*
+    * check db_database:{relabelto} permission
+    */
+   sepgsql_avc_check_perms_label(seclabel,
+                                 SEPG_CLASS_DB_DATABASE,
+                                 SEPG_DB_DATABASE__RELABELTO,
+                                 audit_name,
+                                 true);
+   pfree(audit_name);
+}

diff --git a/contrib/sepgsql/hooks.c b/contrib/sepgsql/hooks.c
index ca6ce99808001cc74925f9033e466a103802fb0d..331bbd7e78365e27350014c2c6e5fe6fe2482eaf 100644 (file)
--- a/contrib/sepgsql/hooks.c
+++ b/contrib/sepgsql/hooks.c
@@ -12,6 +12,7 @@
 
 #include "catalog/objectaccess.h"
 #include "catalog/pg_class.h"
+#include "catalog/pg_database.h"
 #include "catalog/pg_namespace.h"
 #include "catalog/pg_proc.h"
 #include "commands/seclabel.h"
@@ -125,6 +126,10 @@ sepgsql_object_access(ObjectAccessType access,
        case OAT_POST_CREATE:
            switch (classId)
            {
+               case DatabaseRelationId:
+                   sepgsql_database_post_create(objectId);
+                   break;
+
                case NamespaceRelationId:
                    sepgsql_schema_post_create(objectId);
                    break;

diff --git a/contrib/sepgsql/label.c b/contrib/sepgsql/label.c
index 669ee35ac3e4a6d3515364e662568d865af1dbb2..a2bf57151ebd6af5bb8742b4ac2178c42e540619 100644 (file)
--- a/contrib/sepgsql/label.c
+++ b/contrib/sepgsql/label.c
@@ -17,6 +17,7 @@
 #include "catalog/indexing.h"
 #include "catalog/pg_attribute.h"
 #include "catalog/pg_class.h"
+#include "catalog/pg_database.h"
 #include "catalog/pg_namespace.h"
 #include "catalog/pg_proc.h"
 #include "commands/dbcommands.h"
@@ -121,9 +122,14 @@ sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
     */
    switch (object->classId)
    {
+       case DatabaseRelationId:
+           sepgsql_database_relabel(object->objectId, seclabel);
+           break;
+
        case NamespaceRelationId:
            sepgsql_schema_relabel(object->objectId, seclabel);
            break;
+
        case RelationRelationId:
            if (object->objectSubId == 0)
                sepgsql_relation_relabel(object->objectId,
@@ -133,6 +139,7 @@ sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
                                          object->objectSubId,
                                          seclabel);
            break;
+
        case ProcedureRelationId:
            sepgsql_proc_relabel(object->objectId, seclabel);
            break;
@@ -315,6 +322,7 @@ exec_object_restorecon(struct selabel_handle * sehnd, Oid catalogId)
                               SnapshotNow, 0, NULL);
    while (HeapTupleIsValid(tuple = systable_getnext(sscan)))
    {
+       Form_pg_database datForm;
        Form_pg_namespace nspForm;
        Form_pg_class relForm;
        Form_pg_attribute attForm;
@@ -330,6 +338,19 @@ exec_object_restorecon(struct selabel_handle * sehnd, Oid catalogId)
         */
        switch (catalogId)
        {
+           case DatabaseRelationId:
+               datForm = (Form_pg_database) GETSTRUCT(tuple);
+
+               objtype = SELABEL_DB_DATABASE;
+
+               objname = quote_object_name(NameStr(datForm->datname),
+                                           NULL, NULL, NULL);
+
+               object.classId = DatabaseRelationId;
+               object.objectId = HeapTupleGetOid(tuple);
+               object.objectSubId = 0;
+               break;
+
            case NamespaceRelationId:
                nspForm = (Form_pg_namespace) GETSTRUCT(tuple);
 
@@ -506,10 +527,7 @@ sepgsql_restorecon(PG_FUNCTION_ARGS)
               errmsg("SELinux: failed to initialize labeling handle: %m")));
    PG_TRY();
    {
-       /*
-        * Right now, we have no support labeling on the shared database
-        * objects, such as database, role, or tablespace.
-        */
+       exec_object_restorecon(sehnd, DatabaseRelationId);
        exec_object_restorecon(sehnd, NamespaceRelationId);
        exec_object_restorecon(sehnd, RelationRelationId);
        exec_object_restorecon(sehnd, AttributeRelationId);

diff --git a/contrib/sepgsql/schema.c b/contrib/sepgsql/schema.c
index aae68ef964bc2867aee45e0ebd5fcf2bb212a4c2..a167be17b233f27428c60c82529790fa5d76eda8 100644 (file)
--- a/contrib/sepgsql/schema.c
+++ b/contrib/sepgsql/schema.c
@@ -11,8 +11,10 @@
 #include "postgres.h"
 
 #include "catalog/dependency.h"
+#include "catalog/pg_database.h"
 #include "catalog/pg_namespace.h"
 #include "commands/seclabel.h"
+#include "miscadmin.h"
 #include "utils/lsyscache.h"
 
 #include "sepgsql.h"
@@ -26,22 +28,17 @@
 void
 sepgsql_schema_post_create(Oid namespaceId)
 {
-   char       *scontext = sepgsql_get_client_label();
+   char       *scontext;
    char       *tcontext;
    char       *ncontext;
    ObjectAddress object;
 
-   /*
-    * FIXME: Right now, we assume pg_database object has a fixed security
-    * label, because pg_seclabel does not support to store label of shared
-    * database objects.
-    */
-   tcontext = "system_u:object_r:sepgsql_db_t:s0";
-
    /*
     * Compute a default security label when we create a new schema object
     * under the working database.
     */
+   scontext = sepgsql_get_client_label();
+   tcontext = sepgsql_get_label(DatabaseRelationId, MyDatabaseId, 0);
    ncontext = sepgsql_compute_create(scontext, tcontext,
                                      SEPG_CLASS_DB_SCHEMA);
 
@@ -54,6 +51,7 @@ sepgsql_schema_post_create(Oid namespaceId)
    SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
 
    pfree(ncontext);
+   pfree(tcontext);
 }
 
 /*

diff --git a/contrib/sepgsql/sepgsql.h b/contrib/sepgsql/sepgsql.h
index 35b500c3ffa8a4d7b067e45cfebfd61ab05f373f..b4c1dfdfe76bfb50cdbf1ed2395b2b7f615a80e2 100644 (file)
--- a/contrib/sepgsql/sepgsql.h
+++ b/contrib/sepgsql/sepgsql.h
@@ -283,6 +283,12 @@ extern Datum sepgsql_restorecon(PG_FUNCTION_ARGS);
  */
 extern bool sepgsql_dml_privileges(List *rangeTabls, bool abort);
 
+/*
+ * database.c
+ */
+extern void sepgsql_database_post_create(Oid databaseId);
+extern void sepgsql_database_relabel(Oid databaseId, const char *seclabel);
+
 /*
  * schema.c
  */