1 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>F.40. sepgsql — SELinux-, label-based mandatory access control (MAC) security module</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="seg.html" title="F.39. seg — a datatype for line segments or floating point intervals" /><link rel="next" href="contrib-spi.html" title="F.41. spi — Server Programming Interface features/examples" /></head><body id="docContent" class="container-fluid col-10"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">F.40. sepgsql —
3 SELinux-, label-based mandatory access control (MAC) security module</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="seg.html" title="F.39. seg — a datatype for line segments or floating point intervals">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="contrib.html" title="Appendix F. Additional Supplied Modules and Extensions">Up</a></td><th width="60%" align="center">Appendix F. Additional Supplied Modules and Extensions</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 18.0 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="contrib-spi.html" title="F.41. spi — Server Programming Interface features/examples">Next</a></td></tr></table><hr /></div><div class="sect1" id="SEPGSQL"><div class="titlepage"><div><div><h2 class="title" style="clear: both">F.40. sepgsql —
4 SELinux-, label-based mandatory access control (MAC) security module <a href="#SEPGSQL" class="id_link">#</a></h2></div></div></div><div class="toc"><dl class="toc"><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-OVERVIEW">F.40.1. Overview</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-INSTALLATION">F.40.2. Installation</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-REGRESSION">F.40.3. Regression Tests</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-PARAMETERS">F.40.4. GUC Parameters</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-FEATURES">F.40.5. Features</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-FUNCTIONS">F.40.6. Sepgsql Functions</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-LIMITATIONS">F.40.7. Limitations</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-RESOURCES">F.40.8. External Resources</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-AUTHOR">F.40.9. Author</a></span></dt></dl></div><a id="id-1.11.7.50.2" class="indexterm"></a><p>
5 <code class="filename">sepgsql</code> is a loadable module that supports label-based
6 mandatory access control (MAC) based on <span class="productname">SELinux</span> security
8 </p><div class="warning"><h3 class="title">Warning</h3><p>
9 The current implementation has significant limitations, and does not
10 enforce mandatory access control for all actions. See
11 <a class="xref" href="sepgsql.html#SEPGSQL-LIMITATIONS" title="F.40.7. Limitations">Section F.40.7</a>.
12 </p></div><div class="sect2" id="SEPGSQL-OVERVIEW"><div class="titlepage"><div><div><h3 class="title">F.40.1. Overview <a href="#SEPGSQL-OVERVIEW" class="id_link">#</a></h3></div></div></div><p>
13 This module integrates with <span class="productname">SELinux</span> to provide an
14 additional layer of security checking above and beyond what is normally
15 provided by <span class="productname">PostgreSQL</span>. From the perspective of
16 <span class="productname">SELinux</span>, this module allows
17 <span class="productname">PostgreSQL</span> to function as a user-space object
18 manager. Each table or function access initiated by a DML query will be
19 checked against the system security policy. This check is in addition to
20 the usual SQL permissions checking performed by
21 <span class="productname">PostgreSQL</span>.
23 <span class="productname">SELinux</span> access control decisions are made using
24 security labels, which are represented by strings such as
25 <code class="literal">system_u:object_r:sepgsql_table_t:s0</code>. Each access control
26 decision involves two labels: the label of the subject attempting to
27 perform the action, and the label of the object on which the operation is
28 to be performed. Since these labels can be applied to any sort of object,
29 access control decisions for objects stored within the database can be
30 (and, with this module, are) subjected to the same general criteria used
31 for objects of any other type, such as files. This design is intended to
32 allow a centralized security policy to protect information assets
33 independent of the particulars of how those assets are stored.
35 The <a class="link" href="sql-security-label.html" title="SECURITY LABEL"><code class="command">SECURITY LABEL</code></a> statement allows assignment of
36 a security label to a database object.
37 </p></div><div class="sect2" id="SEPGSQL-INSTALLATION"><div class="titlepage"><div><div><h3 class="title">F.40.2. Installation <a href="#SEPGSQL-INSTALLATION" class="id_link">#</a></h3></div></div></div><p>
38 <code class="filename">sepgsql</code> can only be used on <span class="productname">Linux</span>
39 2.6.28 or higher with <span class="productname">SELinux</span> enabled.
40 It is not available on any other platform. You will also need
41 <span class="productname">libselinux</span> 2.1.10 or higher and
42 <span class="productname">selinux-policy</span> 3.9.13 or higher (although some
43 distributions may backport the necessary rules into older policy
46 The <code class="command">sestatus</code> command allows you to check the status of
47 <span class="productname">SELinux</span>. A typical display is:
48 </p><pre class="screen">
50 SELinux status: enabled
51 SELinuxfs mount: /selinux
52 Current mode: enforcing
53 Mode from config file: enforcing
55 Policy from config file: targeted
57 If <span class="productname">SELinux</span> is disabled or not installed, you must set
58 that product up first before installing this module.
60 To build this module, specify <a class="xref" href="install-make.html#CONFIGURE-OPTION-WITH-SEPGSQL"><code class="option">--with-selinux</code></a> (when using <a class="link" href="install-make.html" title="17.3. Building and Installation with Autoconf and Make">make and autoconf</a> ) or <a class="xref" href="install-meson.html#CONFIGURE-WITH-SEPGSQL-MESON"><code class="option">-Dselinux={ auto | enabled | disabled }</code></a> (when using <a class="link" href="install-meson.html" title="17.4. Building and Installation with Meson">meson</a>).
62 Be sure that the <code class="filename">libselinux-devel</code> RPM is installed at
65 To use this module, you must include <code class="literal">sepgsql</code>
66 in the <a class="xref" href="runtime-config-client.html#GUC-SHARED-PRELOAD-LIBRARIES">shared_preload_libraries</a> parameter in
67 <code class="filename">postgresql.conf</code>. The module will not function correctly
68 if loaded in any other manner. Once the module is loaded, you
69 should execute <code class="filename">sepgsql.sql</code> in each database.
70 This will install functions needed for security label management, and
71 assign initial security labels.
73 Here is an example showing how to initialize a fresh database cluster
74 with <code class="filename">sepgsql</code> functions and security labels installed.
75 Adjust the paths shown as appropriate for your installation:
76 </p><pre class="screen">
77 $ export PGDATA=/path/to/data/directory
79 $ vi $PGDATA/postgresql.conf
81 #shared_preload_libraries = '' # (change requires restart)
83 shared_preload_libraries = 'sepgsql' # (change requires restart)
84 $ for DBNAME in template0 template1 postgres; do
85 postgres --single -F -c exit_on_error=true $DBNAME \
86 </usr/local/pgsql/share/contrib/sepgsql.sql >/dev/null
89 Please note that you may see some or all of the following notifications
90 depending on the particular versions you have of
91 <span class="productname">libselinux</span> and <span class="productname">selinux-policy</span>:
92 </p><pre class="screen">
93 /etc/selinux/targeted/contexts/sepgsql_contexts: line 33 has invalid object type db_blobs
94 /etc/selinux/targeted/contexts/sepgsql_contexts: line 36 has invalid object type db_language
95 /etc/selinux/targeted/contexts/sepgsql_contexts: line 37 has invalid object type db_language
96 /etc/selinux/targeted/contexts/sepgsql_contexts: line 38 has invalid object type db_language
97 /etc/selinux/targeted/contexts/sepgsql_contexts: line 39 has invalid object type db_language
98 /etc/selinux/targeted/contexts/sepgsql_contexts: line 40 has invalid object type db_language
100 These messages are harmless and should be ignored.
102 If the installation process completes without error, you can now start the
104 </p></div><div class="sect2" id="SEPGSQL-REGRESSION"><div class="titlepage"><div><div><h3 class="title">F.40.3. Regression Tests <a href="#SEPGSQL-REGRESSION" class="id_link">#</a></h3></div></div></div><p>
105 The <code class="filename">sepgsql</code> test suite is run if
106 <code class="literal">PG_TEST_EXTRA</code> contains <code class="literal">sepgsql</code> (see
107 <a class="xref" href="regress-run.html#REGRESS-ADDITIONAL" title="31.1.3. Additional Test Suites">Section 31.1.3</a>). This method is suitable during
108 development of <span class="productname">PostgreSQL</span>. Alternatively, there
109 is a way to run the tests to checks whether a database instance has been
110 set up properly for <code class="literal">sepgsql</code>.
112 Due to the nature of <span class="productname">SELinux</span>, running the
113 regression tests for <code class="filename">sepgsql</code> requires several extra
114 configuration steps, some of which must be done as root.
116 The manual tests must be run in the <code class="filename">contrib/sepgsql</code> directory
117 of a configured PostgreSQL build tree. Although they require a build tree,
118 the tests are designed to be executed against an installed server,
119 that is they are comparable to <code class="literal">make installcheck</code> not
120 <code class="literal">make check</code>.
122 First, set up <code class="filename">sepgsql</code> in a working database
123 according to the instructions in <a class="xref" href="sepgsql.html#SEPGSQL-INSTALLATION" title="F.40.2. Installation">Section F.40.2</a>.
124 Note that the current operating system user must be able to connect to the
125 database as superuser without password authentication.
127 Second, build and install the policy package for the regression test.
128 The <code class="filename">sepgsql-regtest</code> policy is a special purpose policy package
129 which provides a set of rules to be allowed during the regression tests.
130 It should be built from the policy source file
131 <code class="filename">sepgsql-regtest.te</code>, which is done using
132 <code class="command">make</code> with a Makefile supplied by SELinux.
133 You will need to locate the appropriate
134 Makefile on your system; the path shown below is only an example.
135 (This Makefile is usually supplied by the
136 <code class="filename">selinux-policy-devel</code> or
137 <code class="filename">selinux-policy</code> RPM.)
138 Once built, install this policy package using the
139 <code class="command">semodule</code> command, which loads supplied policy packages
140 into the kernel. If the package is correctly installed,
141 <code class="literal"><code class="command">semodule</code> -l</code> should list <code class="literal">sepgsql-regtest</code> as an
142 available policy package:
143 </p><pre class="screen">
144 $ cd .../contrib/sepgsql
145 $ make -f /usr/share/selinux/devel/Makefile
146 $ sudo semodule -u sepgsql-regtest.pp
147 $ sudo semodule -l | grep sepgsql
150 Third, turn on <code class="literal">sepgsql_regression_test_mode</code>.
151 For security reasons, the rules in <code class="filename">sepgsql-regtest</code>
152 are not enabled by default;
153 the <code class="literal">sepgsql_regression_test_mode</code> parameter enables
154 the rules needed to launch the regression tests.
155 It can be turned on using the <code class="command">setsebool</code> command:
156 </p><pre class="screen">
157 $ sudo setsebool sepgsql_regression_test_mode on
158 $ getsebool sepgsql_regression_test_mode
159 sepgsql_regression_test_mode --> on
161 Fourth, verify your shell is operating in the <code class="literal">unconfined_t</code>
163 </p><pre class="screen">
165 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
167 See <a class="xref" href="sepgsql.html#SEPGSQL-RESOURCES" title="F.40.8. External Resources">Section F.40.8</a> for details on adjusting your
168 working domain, if necessary.
170 Finally, run the regression test script:
171 </p><pre class="screen">
174 This script will attempt to verify that you have done all the configuration
175 steps correctly, and then it will run the regression tests for the
176 <code class="filename">sepgsql</code> module.
178 After completing the tests, it's recommended you disable
179 the <code class="literal">sepgsql_regression_test_mode</code> parameter:
180 </p><pre class="screen">
181 $ sudo setsebool sepgsql_regression_test_mode off
183 You might prefer to remove the <code class="filename">sepgsql-regtest</code> policy
185 </p><pre class="screen">
186 $ sudo semodule -r sepgsql-regtest
187 </pre></div><div class="sect2" id="SEPGSQL-PARAMETERS"><div class="titlepage"><div><div><h3 class="title">F.40.4. GUC Parameters <a href="#SEPGSQL-PARAMETERS" class="id_link">#</a></h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt id="GUC-SEPGSQL-PERMISSIVE"><span class="term">
188 <code class="varname">sepgsql.permissive</code> (<code class="type">boolean</code>)
189 <a id="id-1.11.7.50.8.2.1.1.3" class="indexterm"></a>
190 </span> <a href="#GUC-SEPGSQL-PERMISSIVE" class="id_link">#</a></dt><dd><p>
191 This parameter enables <code class="filename">sepgsql</code> to function
192 in permissive mode, regardless of the system setting.
194 This parameter can only be set in the <code class="filename">postgresql.conf</code>
195 file or on the server command line.
197 When this parameter is on, <code class="filename">sepgsql</code> functions
198 in permissive mode, even if SELinux in general is working in enforcing
199 mode. This parameter is primarily useful for testing purposes.
200 </p></dd><dt id="GUC-SEPGSQL-DEBUG-AUDIT"><span class="term">
201 <code class="varname">sepgsql.debug_audit</code> (<code class="type">boolean</code>)
202 <a id="id-1.11.7.50.8.2.2.1.3" class="indexterm"></a>
203 </span> <a href="#GUC-SEPGSQL-DEBUG-AUDIT" class="id_link">#</a></dt><dd><p>
204 This parameter enables the printing of audit messages regardless of
205 the system policy settings.
206 The default is off, which means that messages will be printed according
207 to the system settings.
209 The security policy of <span class="productname">SELinux</span> also has rules to
210 control whether or not particular accesses are logged.
211 By default, access violations are logged, but allowed
214 This parameter forces all possible logging to be turned on, regardless
215 of the system policy.
216 </p></dd></dl></div></div><div class="sect2" id="SEPGSQL-FEATURES"><div class="titlepage"><div><div><h3 class="title">F.40.5. Features <a href="#SEPGSQL-FEATURES" class="id_link">#</a></h3></div></div></div><div class="sect3" id="SEPGSQL-FEATURES-CONTROLLED-OBJ-CLASSES"><div class="titlepage"><div><div><h4 class="title">F.40.5.1. Controlled Object Classes <a href="#SEPGSQL-FEATURES-CONTROLLED-OBJ-CLASSES" class="id_link">#</a></h4></div></div></div><p>
217 The security model of <span class="productname">SELinux</span> describes all the access
218 control rules as relationships between a subject entity (typically,
219 a client of the database) and an object entity (such as a database
220 object), each of which is
221 identified by a security label. If access to an unlabeled object is
222 attempted, the object is treated as if it were assigned the label
223 <code class="literal">unlabeled_t</code>.
225 Currently, <code class="filename">sepgsql</code> allows security labels to be
226 assigned to schemas, tables, columns, sequences, views, and functions.
227 When <code class="filename">sepgsql</code> is in use, security labels are
228 automatically assigned to supported database objects at creation time.
229 This label is called a default security label, and is decided according
230 to the system security policy, which takes as input the creator's label,
231 the label assigned to the new object's parent object and optionally name
232 of the constructed object.
234 A new database object basically inherits the security label of the parent
235 object, except when the security policy has special rules known as
236 type-transition rules, in which case a different label may be applied.
237 For schemas, the parent object is the current database; for tables,
238 sequences, views, and functions, it is the containing schema; for columns,
239 it is the containing table.
240 </p></div><div class="sect3" id="SEPGSQL-FEATURES-DML-PERMISSIONS"><div class="titlepage"><div><div><h4 class="title">F.40.5.2. DML Permissions <a href="#SEPGSQL-FEATURES-DML-PERMISSIONS" class="id_link">#</a></h4></div></div></div><p>
241 For tables, <code class="literal">db_table:select</code>, <code class="literal">db_table:insert</code>,
242 <code class="literal">db_table:update</code> or <code class="literal">db_table:delete</code> are
243 checked for all the referenced target tables depending on the kind of
244 statement; in addition, <code class="literal">db_table:select</code> is also checked for
245 all the tables that contain columns referenced in the
246 <code class="literal">WHERE</code> or <code class="literal">RETURNING</code> clause, as a data source
247 for <code class="literal">UPDATE</code>, and so on.
249 Column-level permissions will also be checked for each referenced column.
250 <code class="literal">db_column:select</code> is checked on not only the columns being
251 read using <code class="literal">SELECT</code>, but those being referenced in other DML
252 statements; <code class="literal">db_column:update</code> or <code class="literal">db_column:insert</code>
253 will also be checked for columns being modified by <code class="literal">UPDATE</code> or
254 <code class="literal">INSERT</code>.
256 For example, consider:
257 </p><pre class="synopsis">
258 UPDATE t1 SET x = 2, y = func1(y) WHERE z = 100;
261 Here, <code class="literal">db_column:update</code> will be checked for
262 <code class="literal">t1.x</code>, since it is being updated,
263 <code class="literal">db_column:{select update}</code> will be checked for
264 <code class="literal">t1.y</code>, since it is both updated and referenced, and
265 <code class="literal">db_column:select</code> will be checked for <code class="literal">t1.z</code>, since
266 it is only referenced.
267 <code class="literal">db_table:{select update}</code> will also be checked
270 For sequences, <code class="literal">db_sequence:get_value</code> is checked when we
271 reference a sequence object using <code class="literal">SELECT</code>; however, note that we
272 do not currently check permissions on execution of corresponding functions
273 such as <code class="literal">lastval()</code>.
275 For views, <code class="literal">db_view:expand</code> will be checked, then any other
276 required permissions will be checked on the objects being
277 expanded from the view, individually.
279 For functions, <code class="literal">db_procedure:{execute}</code> will be checked when
280 user tries to execute a function as a part of query, or using fast-path
281 invocation. If this function is a trusted procedure, it also checks
282 <code class="literal">db_procedure:{entrypoint}</code> permission to check whether it
283 can perform as entry point of trusted procedure.
285 In order to access any schema object, <code class="literal">db_schema:search</code>
286 permission is required on the containing schema. When an object is
287 referenced without schema qualification, schemas on which this
288 permission is not present will not be searched (just as if the user did
289 not have <code class="literal">USAGE</code> privilege on the schema). If an explicit schema
290 qualification is present, an error will occur if the user does not have
291 the requisite permission on the named schema.
293 The client must be allowed to access all referenced tables and
294 columns, even if they originated from views which were then expanded,
295 so that we apply consistent access control rules independent of the manner
296 in which the table contents are referenced.
298 The default database privilege system allows database superusers to
299 modify system catalogs using DML commands, and reference or modify
300 toast tables. These operations are prohibited when
301 <code class="filename">sepgsql</code> is enabled.
302 </p></div><div class="sect3" id="SEPGSQL-FEATURES-DDL-PERMISSIONS"><div class="titlepage"><div><div><h4 class="title">F.40.5.3. DDL Permissions <a href="#SEPGSQL-FEATURES-DDL-PERMISSIONS" class="id_link">#</a></h4></div></div></div><p>
303 <span class="productname">SELinux</span> defines several permissions to control common
304 operations for each object type; such as creation, alter, drop and
305 relabel of security label. In addition, several object types have
306 special permissions to control their characteristic operations; such as
307 addition or deletion of name entries within a particular schema.
309 Creating a new database object requires <code class="literal">create</code> permission.
310 <span class="productname">SELinux</span> will grant or deny this permission based on the
311 client's security label and the proposed security label for the new
312 object. In some cases, additional privileges are required:
313 </p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
314 <a class="link" href="sql-createdatabase.html" title="CREATE DATABASE"><code class="command">CREATE DATABASE</code></a> additionally requires
315 <code class="literal">getattr</code> permission for the source or template database.
316 </p></li><li class="listitem"><p>
317 Creating a schema object additionally requires <code class="literal">add_name</code>
318 permission on the parent schema.
319 </p></li><li class="listitem"><p>
320 Creating a table additionally requires permission to create each
321 individual table column, just as if each table column were a
322 separate top-level object.
323 </p></li><li class="listitem"><p>
324 Creating a function marked as <code class="literal">LEAKPROOF</code> additionally
325 requires <code class="literal">install</code> permission. (This permission is also
326 checked when <code class="literal">LEAKPROOF</code> is set for an existing function.)
327 </p></li></ul></div><p>
328 When <code class="literal">DROP</code> command is executed, <code class="literal">drop</code> will be
329 checked on the object being removed. Permissions will be also checked for
330 objects dropped indirectly via <code class="literal">CASCADE</code>. Deletion of objects
331 contained within a particular schema (tables, views, sequences and
332 procedures) additionally requires <code class="literal">remove_name</code> on the schema.
334 When <code class="literal">ALTER</code> command is executed, <code class="literal">setattr</code> will be
335 checked on the object being modified for each object types, except for
336 subsidiary objects such as the indexes or triggers of a table, where
337 permissions are instead checked on the parent object. In some cases,
338 additional permissions are required:
339 </p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
340 Moving an object to a new schema additionally requires
341 <code class="literal">remove_name</code> permission on the old schema and
342 <code class="literal">add_name</code> permission on the new one.
343 </p></li><li class="listitem"><p>
344 Setting the <code class="literal">LEAKPROOF</code> attribute on a function requires
345 <code class="literal">install</code> permission.
346 </p></li><li class="listitem"><p>
347 Using <a class="link" href="sql-security-label.html" title="SECURITY LABEL"><code class="command">SECURITY LABEL</code></a> on an object additionally
348 requires <code class="literal">relabelfrom</code> permission for the object in
349 conjunction with its old security label and <code class="literal">relabelto</code>
350 permission for the object in conjunction with its new security label.
351 (In cases where multiple label providers are installed and the user
352 tries to set a security label, but it is not managed by
353 <span class="productname">SELinux</span>, only <code class="literal">setattr</code> should be checked here.
354 This is currently not done due to implementation restrictions.)
355 </p></li></ul></div></div><div class="sect3" id="SEPGSQL-FEATURES-TRUSTED-PROCEDURES"><div class="titlepage"><div><div><h4 class="title">F.40.5.4. Trusted Procedures <a href="#SEPGSQL-FEATURES-TRUSTED-PROCEDURES" class="id_link">#</a></h4></div></div></div><p>
356 Trusted procedures are similar to security definer functions or setuid
357 commands. <span class="productname">SELinux</span> provides a feature to allow trusted
358 code to run using a security label different from that of the client,
359 generally for the purpose of providing highly controlled access to
360 sensitive data (e.g., rows might be omitted, or the precision of stored
361 values might be reduced). Whether or not a function acts as a trusted
362 procedure is controlled by its security label and the operating system
363 security policy. For example:
364 </p><pre class="screen">
365 postgres=# CREATE TABLE customer (
371 postgres=# SECURITY LABEL ON COLUMN customer.credit
372 IS 'system_u:object_r:sepgsql_secret_table_t:s0';
374 postgres=# CREATE FUNCTION show_credit(int) RETURNS text
375 AS 'SELECT regexp_replace(credit, ''-[0-9]+$'', ''-xxxx'', ''g'')
376 FROM customer WHERE cid = $1'
379 postgres=# SECURITY LABEL ON FUNCTION show_credit(int)
380 IS 'system_u:object_r:sepgsql_trusted_proc_exec_t:s0';
383 The above operations should be performed by an administrative user.
384 </p><pre class="screen">
385 postgres=# SELECT * FROM customer;
386 ERROR: SELinux: security policy violation
387 postgres=# SELECT cid, cname, show_credit(cid) FROM customer;
388 cid | cname | show_credit
389 -----+--------+---------------------
390 1 | taro | 1111-2222-3333-xxxx
391 2 | hanako | 5555-6666-7777-xxxx
394 In this case, a regular user cannot reference <code class="literal">customer.credit</code>
395 directly, but a trusted procedure <code class="literal">show_credit</code> allows the user
396 to print the credit card numbers of customers with some of the digits
398 </p></div><div class="sect3" id="SEPGSQL-FEATURES-DYNAMIC-DOMAIN-TRANSITIONS"><div class="titlepage"><div><div><h4 class="title">F.40.5.5. Dynamic Domain Transitions <a href="#SEPGSQL-FEATURES-DYNAMIC-DOMAIN-TRANSITIONS" class="id_link">#</a></h4></div></div></div><p>
399 It is possible to use SELinux's dynamic domain transition feature
400 to switch the security label of the client process, the client domain,
401 to a new context, if that is allowed by the security policy.
402 The client domain needs the <code class="literal">setcurrent</code> permission and also
403 <code class="literal">dyntransition</code> from the old to the new domain.
405 Dynamic domain transitions should be considered carefully, because they
406 allow users to switch their label, and therefore their privileges,
407 at their option, rather than (as in the case of a trusted procedure)
408 as mandated by the system.
409 Thus, the <code class="literal">dyntransition</code> permission is only considered
410 safe when used to switch to a domain with a smaller set of privileges than
411 the original one. For example:
412 </p><pre class="screen">
413 regression=# select sepgsql_getcon();
415 -------------------------------------------------------
416 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
419 regression=# SELECT sepgsql_setcon('unconfined_u:unconfined_r:unconfined_t:s0-s0:c1.c4');
425 regression=# SELECT sepgsql_setcon('unconfined_u:unconfined_r:unconfined_t:s0-s0:c1.c1023');
426 ERROR: SELinux: security policy violation
428 In this example above we were allowed to switch from the larger MCS
429 range <code class="literal">c1.c1023</code> to the smaller range <code class="literal">c1.c4</code>, but
430 switching back was denied.
432 A combination of dynamic domain transition and trusted procedure
433 enables an interesting use case that fits the typical process life-cycle
434 of connection pooling software.
435 Even if your connection pooling software is not allowed to run most
436 of SQL commands, you can allow it to switch the security label
437 of the client using the <code class="literal">sepgsql_setcon()</code> function
438 from within a trusted procedure; that should take some
439 credential to authorize the request to switch the client label.
440 After that, this session will have the privileges of the target user,
441 rather than the connection pooler.
442 The connection pooler can later revert the security label change by
443 again using <code class="literal">sepgsql_setcon()</code> with
444 <code class="literal">NULL</code> argument, again invoked from within a trusted
445 procedure with appropriate permissions checks.
446 The point here is that only the trusted procedure actually has permission
447 to change the effective security label, and only does so when given proper
448 credentials. Of course, for secure operation, the credential store
449 (table, procedure definition, or whatever) must be protected from
451 </p></div><div class="sect3" id="SEPGSQL-FEATURES-MISC"><div class="titlepage"><div><div><h4 class="title">F.40.5.6. Miscellaneous <a href="#SEPGSQL-FEATURES-MISC" class="id_link">#</a></h4></div></div></div><p>
452 We reject the <a class="link" href="sql-load.html" title="LOAD"><code class="command">LOAD</code></a> command across the board, because
453 any module loaded could easily circumvent security policy enforcement.
454 </p></div></div><div class="sect2" id="SEPGSQL-FUNCTIONS"><div class="titlepage"><div><div><h3 class="title">F.40.6. Sepgsql Functions <a href="#SEPGSQL-FUNCTIONS" class="id_link">#</a></h3></div></div></div><p>
455 <a class="xref" href="sepgsql.html#SEPGSQL-FUNCTIONS-TABLE" title="Table F.32. Sepgsql Functions">Table F.32</a> shows the available functions.
456 </p><div class="table" id="SEPGSQL-FUNCTIONS-TABLE"><p class="title"><strong>Table F.32. Sepgsql Functions</strong></p><div class="table-contents"><table class="table" summary="Sepgsql Functions" border="1"><colgroup><col /></colgroup><thead><tr><th class="func_table_entry"><p class="func_signature">
461 </p></th></tr></thead><tbody><tr><td class="func_table_entry"><p class="func_signature">
462 <code class="function">sepgsql_getcon</code> ()
463 → <code class="returnvalue">text</code>
466 Returns the client domain, the current security label of the client.
467 </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">
468 <code class="function">sepgsql_setcon</code> ( <code class="type">text</code> )
469 → <code class="returnvalue">boolean</code>
472 Switches the client domain of the current session to the new domain,
473 if allowed by the security policy.
474 It also accepts <code class="literal">NULL</code> input as a request to transition
475 to the client's original domain.
476 </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">
477 <code class="function">sepgsql_mcstrans_in</code> ( <code class="type">text</code> )
478 → <code class="returnvalue">text</code>
481 Translates the given qualified MLS/MCS range into raw format if
482 the mcstrans daemon is running.
483 </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">
484 <code class="function">sepgsql_mcstrans_out</code> ( <code class="type">text</code> )
485 → <code class="returnvalue">text</code>
488 Translates the given raw MLS/MCS range into qualified format if
489 the mcstrans daemon is running.
490 </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">
491 <code class="function">sepgsql_restorecon</code> ( <code class="type">text</code> )
492 → <code class="returnvalue">boolean</code>
495 Sets up initial security labels for all objects within the
496 current database. The argument may be <code class="literal">NULL</code>, or the
497 name of a specfile to be used as alternative of the system default.
498 </p></td></tr></tbody></table></div></div><br class="table-break" /></div><div class="sect2" id="SEPGSQL-LIMITATIONS"><div class="titlepage"><div><div><h3 class="title">F.40.7. Limitations <a href="#SEPGSQL-LIMITATIONS" class="id_link">#</a></h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term">Data Definition Language (DDL) Permissions</span></dt><dd><p>
499 Due to implementation restrictions, some DDL operations do not
501 </p></dd><dt><span class="term">Data Control Language (DCL) Permissions</span></dt><dd><p>
502 Due to implementation restrictions, DCL operations do not check
504 </p></dd><dt><span class="term">Row-level access control</span></dt><dd><p>
505 <span class="productname">PostgreSQL</span> supports row-level access, but
506 <code class="filename">sepgsql</code> does not.
507 </p></dd><dt><span class="term">Covert channels</span></dt><dd><p>
508 <code class="filename">sepgsql</code> does not try to hide the existence of
509 a certain object, even if the user is not allowed to reference it.
510 For example, we can infer the existence of an invisible object as
511 a result of primary key conflicts, foreign key violations, and so on,
512 even if we cannot obtain the contents of the object. The existence
513 of a top secret table cannot be hidden; we only hope to conceal its
515 </p></dd></dl></div></div><div class="sect2" id="SEPGSQL-RESOURCES"><div class="titlepage"><div><div><h3 class="title">F.40.8. External Resources <a href="#SEPGSQL-RESOURCES" class="id_link">#</a></h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term"><a class="ulink" href="https://wiki.postgresql.org/wiki/SEPostgreSQL_Introduction" target="_top">SE-PostgreSQL Introduction</a></span></dt><dd><p>
516 This wiki page provides a brief overview, security design, architecture,
517 administration and upcoming features.
518 </p></dd><dt><span class="term"><a class="ulink" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/index" target="_top">SELinux User's and Administrator's Guide</a></span></dt><dd><p>
519 This document provides a wide spectrum of knowledge to administer
520 <span class="productname">SELinux</span> on your systems.
521 It focuses primarily on Red Hat operating systems, but is not limited to them.
522 </p></dd><dt><span class="term"><a class="ulink" href="https://fedoraproject.org/wiki/SELinux_FAQ" target="_top">Fedora SELinux FAQ</a></span></dt><dd><p>
523 This document answers frequently asked questions about
524 <span class="productname">SELinux</span>.
525 It focuses primarily on Fedora, but is not limited to Fedora.
526 </p></dd></dl></div></div><div class="sect2" id="SEPGSQL-AUTHOR"><div class="titlepage"><div><div><h3 class="title">F.40.9. Author <a href="#SEPGSQL-AUTHOR" class="id_link">#</a></h3></div></div></div><p>
527 KaiGai Kohei <code class="email"><<a class="email" href="mailto:kaigai@ak.jp.nec.com">kaigai@ak.jp.nec.com</a>></code>
528 </p></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="seg.html" title="F.39. seg — a datatype for line segments or floating point intervals">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="contrib.html" title="Appendix F. Additional Supplied Modules and Extensions">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="contrib-spi.html" title="F.41. spi — Server Programming Interface features/examples">Next</a></td></tr><tr><td width="40%" align="left" valign="top">F.39. seg — a datatype for line segments or floating point intervals </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 18.0 Documentation">Home</a></td><td width="40%" align="right" valign="top"> F.41. spi — Server Programming Interface features/examples</td></tr></table></div></body></html>
begriffs.com / projects / ai-pg / blob