13#include <selinux/label.h>
33#include "utils/fmgroids.h"
113 const char *tcontext;
122 if (security_check_context_raw(new_label) < 0)
124 (
errcode(ERRCODE_INVALID_NAME),
125 errmsg(
"SELinux: invalid security label: \"%s\"",
127 tcontext = new_label;
215 if (plabel->
subid == mySubid)
233 (*next_client_auth_hook) (
port, status);
247 (
errcode(ERRCODE_INTERNAL_ERROR),
248 errmsg(
"SELinux: unable to get peer label: %m")));
291 object.
classId = ProcedureRelationId;
292 object.objectId = functionId;
293 object.objectSubId = 0;
330 stack =
palloc(
sizeof(*stack));
331 stack->old_label = NULL;
333 stack->next_private = 0;
347 if (stack->new_label)
351 object.
classId = ProcedureRelationId;
352 object.objectId = flinfo->
fn_oid;
353 object.objectSubId = 0;
367 Assert(!stack->old_label);
368 if (stack->new_label)
374 (*next_fmgr_hook) (event, flinfo, &stack->next_private);
382 (*next_fmgr_hook) (event, flinfo, &stack->next_private);
384 if (stack->new_label)
387 stack->old_label = NULL;
392 elog(
ERROR,
"unexpected event type: %d", (
int) event);
418 (
errcode(ERRCODE_INTERNAL_ERROR),
419 errmsg(
"SELinux: failed to get server security label: %m")));
450 object.classId = classId;
451 object.objectId = objectId;
452 object.objectSubId = subId;
455 if (!
label || security_check_context_raw(
label))
459 if (security_get_initial_context_raw(
"unlabeled", &unlabeled) < 0)
461 (
errcode(ERRCODE_INTERNAL_ERROR),
462 errmsg(
"SELinux: failed to get initial security label: %m")));
489 security_check_context_raw(seclabel) < 0)
491 (
errcode(ERRCODE_INVALID_NAME),
492 errmsg(
"SELinux: invalid security label: \"%s\"", seclabel)));
499 case DatabaseRelationId:
503 case NamespaceRelationId:
507 case RelationRelationId:
517 case ProcedureRelationId:
523 (
errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
524 errmsg(
"sepgsql provider does not support labels on %s",
558 const char *new_label;
586 (
errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
587 errmsg(
"sepgsql is not enabled")));
592 (
errcode(ERRCODE_INTERNAL_ERROR),
593 errmsg(
"SELinux: could not translate security label: %m")));
624 (
errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
625 errmsg(
"sepgsql is not currently enabled")));
630 (
errcode(ERRCODE_INTERNAL_ERROR),
631 errmsg(
"SELinux: could not translate security label: %m")));
654 const char *src3,
const char *src4)
684 char *namespace_name;
714 case DatabaseRelationId:
717 objtype = SELABEL_DB_DATABASE;
722 object.classId = DatabaseRelationId;
723 object.objectId = datForm->oid;
724 object.objectSubId = 0;
727 case NamespaceRelationId:
730 objtype = SELABEL_DB_SCHEMA;
736 object.classId = NamespaceRelationId;
737 object.objectId = nspForm->oid;
738 object.objectSubId = 0;
741 case RelationRelationId:
744 if (relForm->relkind == RELKIND_RELATION ||
745 relForm->relkind == RELKIND_PARTITIONED_TABLE)
746 objtype = SELABEL_DB_TABLE;
747 else if (relForm->relkind == RELKIND_SEQUENCE)
748 objtype = SELABEL_DB_SEQUENCE;
749 else if (relForm->relkind == RELKIND_VIEW)
750 objtype = SELABEL_DB_VIEW;
759 pfree(namespace_name);
761 object.classId = RelationRelationId;
762 object.objectId = relForm->oid;
763 object.objectSubId = 0;
766 case AttributeRelationId:
773 objtype = SELABEL_DB_COLUMN;
782 pfree(namespace_name);
783 pfree(relation_name);
785 object.classId = RelationRelationId;
786 object.objectId = attForm->attrelid;
787 object.objectSubId = attForm->attnum;
790 case ProcedureRelationId:
793 objtype = SELABEL_DB_PROCEDURE;
800 pfree(namespace_name);
802 object.classId = ProcedureRelationId;
803 object.objectId = proForm->oid;
804 object.objectSubId = 0;
808 elog(
ERROR,
"unexpected catalog id: %u", catalogId);
813 if (selabel_lookup_raw(sehnd, &
context, objname, objtype) == 0)
831 else if (errno == ENOENT)
833 (
errmsg(
"SELinux: no initial label assigned for %s (type=%d), skipping",
837 (
errcode(ERRCODE_INTERNAL_ERROR),
838 errmsg(
"SELinux: could not determine initial security label for %s (type=%d): %m", objname, objtype)));
862 struct selabel_handle *sehnd;
863 struct selinux_opt seopts;
870 (
errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
871 errmsg(
"sepgsql is not currently enabled")));
879 (
errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
880 errmsg(
"SELinux: must be superuser to restore initial contexts")));
888 seopts.type = SELABEL_OPT_UNUSED;
893 seopts.type = SELABEL_OPT_PATH;
896 sehnd = selabel_open(SELABEL_CTX_DB, &seopts, 1);
899 (
errcode(ERRCODE_INTERNAL_ERROR),
900 errmsg(
"SELinux: failed to initialize labeling handle: %m")));
911 selabel_close(sehnd);
ClientAuthentication_hook_type ClientAuthentication_hook
void(* ClientAuthentication_hook_type)(Port *, int)
#define TextDatumGetCString(d)
#define Assert(condition)
void sepgsql_proc_relabel(Oid functionId, const char *seclabel)
void sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum, const char *seclabel)
void sepgsql_relation_relabel(Oid relOid, const char *seclabel)
void sepgsql_database_relabel(Oid databaseId, const char *seclabel)
char * get_database_name(Oid dbid)
int errcode(int sqlerrcode)
int errmsg(const char *fmt,...)
#define ereport(elevel,...)
PGDLLIMPORT needs_fmgr_hook_type needs_fmgr_hook
PGDLLIMPORT fmgr_hook_type fmgr_hook
#define PG_GETARG_TEXT_PP(n)
bool(* needs_fmgr_hook_type)(Oid fn_oid)
#define PG_GETARG_DATUM(n)
#define PG_RETURN_TEXT_P(x)
void(* fmgr_hook_type)(FmgrHookEventType event, FmgrInfo *flinfo, Datum *arg)
#define PG_RETURN_BOOL(x)
void systable_endscan(SysScanDesc sysscan)
HeapTuple systable_getnext(SysScanDesc sysscan)
SysScanDesc systable_beginscan(Relation heapRelation, Oid indexId, bool indexOK, Snapshot snapshot, int nkeys, ScanKey key)
bool sepgsql_get_permissive(void)
#define HeapTupleIsValid(tuple)
Datum sepgsql_getcon(PG_FUNCTION_ARGS)
static fmgr_hook_type next_fmgr_hook
static void sepgsql_fmgr_hook(FmgrHookEventType event, FmgrInfo *flinfo, Datum *private)
void sepgsql_init_client_label(void)
static char * client_label_committed
static needs_fmgr_hook_type next_needs_fmgr_hook
static char * quote_object_name(const char *src1, const char *src2, const char *src3, const char *src4)
Datum sepgsql_mcstrans_out(PG_FUNCTION_ARGS)
static void exec_object_restorecon(struct selabel_handle *sehnd, Oid catalogId)
PG_FUNCTION_INFO_V1(sepgsql_getcon)
static char * client_label_peer
static List * client_label_pending
char * sepgsql_get_label(Oid classId, Oid objectId, int32 subId)
void sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
Datum sepgsql_restorecon(PG_FUNCTION_ARGS)
static void sepgsql_subxact_callback(SubXactEvent event, SubTransactionId mySubid, SubTransactionId parentSubid, void *arg)
static void sepgsql_client_auth(Port *port, int status)
static char * client_label_func
char * sepgsql_get_client_label(void)
static void sepgsql_xact_callback(XactEvent event, void *arg)
Datum sepgsql_setcon(PG_FUNCTION_ARGS)
static ClientAuthentication_hook_type next_client_auth_hook
Datum sepgsql_mcstrans_in(PG_FUNCTION_ARGS)
static void sepgsql_set_client_label(const char *new_label)
static bool sepgsql_needs_fmgr_hook(Oid functionId)
List * lappend(List *list, void *datum)
char * get_rel_name(Oid relid)
char get_rel_relkind(Oid relid)
Oid get_rel_namespace(Oid relid)
char * get_namespace_name(Oid nspid)
char * MemoryContextStrdup(MemoryContext context, const char *string)
char * pstrdup(const char *in)
void pfree(void *pointer)
void * palloc0(Size size)
MemoryContext TopMemoryContext
MemoryContext CurTransactionContext
char * getObjectTypeDescription(const ObjectAddress *object, bool missing_ok)
char * getObjectDescription(const ObjectAddress *object, bool missing_ok)
FormData_pg_attribute * Form_pg_attribute
FormData_pg_class * Form_pg_class
FormData_pg_database * Form_pg_database
#define foreach_delete_current(lst, var_or_cell)
FormData_pg_namespace * Form_pg_namespace
FormData_pg_proc * Form_pg_proc
static Datum PointerGetDatum(const void *X)
static Pointer DatumGetPointer(Datum X)
MemoryContextSwitchTo(old_ctx)
const char * quote_identifier(const char *ident)
void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel)
void SetSecurityLabel(const ObjectAddress *object, const char *provider, const char *label)
char * GetSecurityLabel(const ObjectAddress *object, const char *provider)
int sepgsql_set_mode(int new_mode)
bool sepgsql_is_enabled(void)
char * sepgsql_avc_trusted_proc(Oid functionId)
bool sepgsql_avc_check_perms_label(const char *tcontext, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
#define SEPG_DB_PROCEDURE__EXECUTE
#define SEPG_PROCESS__SETCURRENT
#define SEPG_PROCESS__TRANSITION
#define SEPG_PROCESS__DYNTRANSITION
#define SEPG_DB_PROCEDURE__ENTRYPOINT
#define SEPG_CLASS_DB_PROCEDURE
#define SEPGSQL_AVC_NOAUDIT
#define SEPGSQL_LABEL_TAG
#define SEPGSQL_MODE_DEFAULT
#define SEPG_CLASS_PROCESS
#define SEPGSQL_MODE_PERMISSIVE
bool sepgsql_avc_check_perms(const ObjectAddress *tobject, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
void appendStringInfo(StringInfo str, const char *fmt,...)
void appendStringInfoString(StringInfo str, const char *s)
void initStringInfo(StringInfo str)
void table_close(Relation relation, LOCKMODE lockmode)
Relation table_open(Oid relationId, LOCKMODE lockmode)
text * cstring_to_text(const char *s)
char * text_to_cstring(const text *t)
SubTransactionId GetCurrentSubTransactionId(void)
void RegisterXactCallback(XactCallback callback, void *arg)
void RegisterSubXactCallback(SubXactCallback callback, void *arg)
@ SUBXACT_EVENT_ABORT_SUB