selinux.c

Go to the documentation of this file.

/* -------------------------------------------------------------------------
 *
 * contrib/sepgsql/selinux.c
 *
 * Interactions between userspace and selinux in kernelspace,
 * using libselinux api.
 *
 * Copyright (c) 2010-2019, PostgreSQL Global Development Group
 *
 * -------------------------------------------------------------------------
 */
#include "postgres.h"

#include "lib/stringinfo.h"

#include "sepgsql.h"

/*
 * selinux_catalog
 *
 * This mapping table enables to translate the name of object classes and
 * access vectors to/from their own codes.
 * When we ask SELinux whether the required privileges are allowed or not,
 * we use security_compute_av(3). It needs us to represent object classes
 * and access vectors using 'external' codes defined in the security policy.
 * It is determined in the runtime, not build time. So, it needs an internal
 * service to translate object class/access vectors which we want to check
 * into the code which kernel want to be given.
 */
static struct
{
    const char *class_name;
    uint16      class_code;
    struct
    {
        const char *av_name;
        uint32      av_code;
    }           av[32];
}           selinux_catalog[] =

{
    {
        "process", SEPG_CLASS_PROCESS,
        {
            {
                "transition", SEPG_PROCESS__TRANSITION
            },
            {
                "dyntransition", SEPG_PROCESS__DYNTRANSITION
            },
            {
                "setcurrent", SEPG_PROCESS__SETCURRENT
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "file", SEPG_CLASS_FILE,
        {
            {
                "read", SEPG_FILE__READ
            },
            {
                "write", SEPG_FILE__WRITE
            },
            {
                "create", SEPG_FILE__CREATE
            },
            {
                "getattr", SEPG_FILE__GETATTR
            },
            {
                "unlink", SEPG_FILE__UNLINK
            },
            {
                "rename", SEPG_FILE__RENAME
            },
            {
                "append", SEPG_FILE__APPEND
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "dir", SEPG_CLASS_DIR,
        {
            {
                "read", SEPG_DIR__READ
            },
            {
                "write", SEPG_DIR__WRITE
            },
            {
                "create", SEPG_DIR__CREATE
            },
            {
                "getattr", SEPG_DIR__GETATTR
            },
            {
                "unlink", SEPG_DIR__UNLINK
            },
            {
                "rename", SEPG_DIR__RENAME
            },
            {
                "search", SEPG_DIR__SEARCH
            },
            {
                "add_name", SEPG_DIR__ADD_NAME
            },
            {
                "remove_name", SEPG_DIR__REMOVE_NAME
            },
            {
                "rmdir", SEPG_DIR__RMDIR
            },
            {
                "reparent", SEPG_DIR__REPARENT
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "lnk_file", SEPG_CLASS_LNK_FILE,
        {
            {
                "read", SEPG_LNK_FILE__READ
            },
            {
                "write", SEPG_LNK_FILE__WRITE
            },
            {
                "create", SEPG_LNK_FILE__CREATE
            },
            {
                "getattr", SEPG_LNK_FILE__GETATTR
            },
            {
                "unlink", SEPG_LNK_FILE__UNLINK
            },
            {
                "rename", SEPG_LNK_FILE__RENAME
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "chr_file", SEPG_CLASS_CHR_FILE,
        {
            {
                "read", SEPG_CHR_FILE__READ
            },
            {
                "write", SEPG_CHR_FILE__WRITE
            },
            {
                "create", SEPG_CHR_FILE__CREATE
            },
            {
                "getattr", SEPG_CHR_FILE__GETATTR
            },
            {
                "unlink", SEPG_CHR_FILE__UNLINK
            },
            {
                "rename", SEPG_CHR_FILE__RENAME
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "blk_file", SEPG_CLASS_BLK_FILE,
        {
            {
                "read", SEPG_BLK_FILE__READ
            },
            {
                "write", SEPG_BLK_FILE__WRITE
            },
            {
                "create", SEPG_BLK_FILE__CREATE
            },
            {
                "getattr", SEPG_BLK_FILE__GETATTR
            },
            {
                "unlink", SEPG_BLK_FILE__UNLINK
            },
            {
                "rename", SEPG_BLK_FILE__RENAME
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "sock_file", SEPG_CLASS_SOCK_FILE,
        {
            {
                "read", SEPG_SOCK_FILE__READ
            },
            {
                "write", SEPG_SOCK_FILE__WRITE
            },
            {
                "create", SEPG_SOCK_FILE__CREATE
            },
            {
                "getattr", SEPG_SOCK_FILE__GETATTR
            },
            {
                "unlink", SEPG_SOCK_FILE__UNLINK
            },
            {
                "rename", SEPG_SOCK_FILE__RENAME
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "fifo_file", SEPG_CLASS_FIFO_FILE,
        {
            {
                "read", SEPG_FIFO_FILE__READ
            },
            {
                "write", SEPG_FIFO_FILE__WRITE
            },
            {
                "create", SEPG_FIFO_FILE__CREATE
            },
            {
                "getattr", SEPG_FIFO_FILE__GETATTR
            },
            {
                "unlink", SEPG_FIFO_FILE__UNLINK
            },
            {
                "rename", SEPG_FIFO_FILE__RENAME
            },
            {
                NULL, 0UL
            }
        }
    },
    {
        "db_database", SEPG_CLASS_DB_DATABASE,
        {
            {
                "create", SEPG_DB_DATABASE__CREATE
            },
            {
                "drop", SEPG_DB_DATABASE__DROP
            },
            {
                "getattr", SEPG_DB_DATABASE__GETATTR
            },
            {
                "setattr", SEPG_DB_DATABASE__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_DATABASE__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_DATABASE__RELABELTO
            },
            {
                "access", SEPG_DB_DATABASE__ACCESS
            },
            {
                "load_module", SEPG_DB_DATABASE__LOAD_MODULE
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_schema", SEPG_CLASS_DB_SCHEMA,
        {
            {
                "create", SEPG_DB_SCHEMA__CREATE
            },
            {
                "drop", SEPG_DB_SCHEMA__DROP
            },
            {
                "getattr", SEPG_DB_SCHEMA__GETATTR
            },
            {
                "setattr", SEPG_DB_SCHEMA__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_SCHEMA__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_SCHEMA__RELABELTO
            },
            {
                "search", SEPG_DB_SCHEMA__SEARCH
            },
            {
                "add_name", SEPG_DB_SCHEMA__ADD_NAME
            },
            {
                "remove_name", SEPG_DB_SCHEMA__REMOVE_NAME
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_table", SEPG_CLASS_DB_TABLE,
        {
            {
                "create", SEPG_DB_TABLE__CREATE
            },
            {
                "drop", SEPG_DB_TABLE__DROP
            },
            {
                "getattr", SEPG_DB_TABLE__GETATTR
            },
            {
                "setattr", SEPG_DB_TABLE__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_TABLE__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_TABLE__RELABELTO
            },
            {
                "select", SEPG_DB_TABLE__SELECT
            },
            {
                "update", SEPG_DB_TABLE__UPDATE
            },
            {
                "insert", SEPG_DB_TABLE__INSERT
            },
            {
                "delete", SEPG_DB_TABLE__DELETE
            },
            {
                "lock", SEPG_DB_TABLE__LOCK
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_sequence", SEPG_CLASS_DB_SEQUENCE,
        {
            {
                "create", SEPG_DB_SEQUENCE__CREATE
            },
            {
                "drop", SEPG_DB_SEQUENCE__DROP
            },
            {
                "getattr", SEPG_DB_SEQUENCE__GETATTR
            },
            {
                "setattr", SEPG_DB_SEQUENCE__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_SEQUENCE__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_SEQUENCE__RELABELTO
            },
            {
                "get_value", SEPG_DB_SEQUENCE__GET_VALUE
            },
            {
                "next_value", SEPG_DB_SEQUENCE__NEXT_VALUE
            },
            {
                "set_value", SEPG_DB_SEQUENCE__SET_VALUE
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_procedure", SEPG_CLASS_DB_PROCEDURE,
        {
            {
                "create", SEPG_DB_PROCEDURE__CREATE
            },
            {
                "drop", SEPG_DB_PROCEDURE__DROP
            },
            {
                "getattr", SEPG_DB_PROCEDURE__GETATTR
            },
            {
                "setattr", SEPG_DB_PROCEDURE__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_PROCEDURE__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_PROCEDURE__RELABELTO
            },
            {
                "execute", SEPG_DB_PROCEDURE__EXECUTE
            },
            {
                "entrypoint", SEPG_DB_PROCEDURE__ENTRYPOINT
            },
            {
                "install", SEPG_DB_PROCEDURE__INSTALL
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_column", SEPG_CLASS_DB_COLUMN,
        {
            {
                "create", SEPG_DB_COLUMN__CREATE
            },
            {
                "drop", SEPG_DB_COLUMN__DROP
            },
            {
                "getattr", SEPG_DB_COLUMN__GETATTR
            },
            {
                "setattr", SEPG_DB_COLUMN__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_COLUMN__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_COLUMN__RELABELTO
            },
            {
                "select", SEPG_DB_COLUMN__SELECT
            },
            {
                "update", SEPG_DB_COLUMN__UPDATE
            },
            {
                "insert", SEPG_DB_COLUMN__INSERT
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_tuple", SEPG_CLASS_DB_TUPLE,
        {
            {
                "relabelfrom", SEPG_DB_TUPLE__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_TUPLE__RELABELTO
            },
            {
                "select", SEPG_DB_TUPLE__SELECT
            },
            {
                "update", SEPG_DB_TUPLE__UPDATE
            },
            {
                "insert", SEPG_DB_TUPLE__INSERT
            },
            {
                "delete", SEPG_DB_TUPLE__DELETE
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_blob", SEPG_CLASS_DB_BLOB,
        {
            {
                "create", SEPG_DB_BLOB__CREATE
            },
            {
                "drop", SEPG_DB_BLOB__DROP
            },
            {
                "getattr", SEPG_DB_BLOB__GETATTR
            },
            {
                "setattr", SEPG_DB_BLOB__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_BLOB__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_BLOB__RELABELTO
            },
            {
                "read", SEPG_DB_BLOB__READ
            },
            {
                "write", SEPG_DB_BLOB__WRITE
            },
            {
                "import", SEPG_DB_BLOB__IMPORT
            },
            {
                "export", SEPG_DB_BLOB__EXPORT
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_language", SEPG_CLASS_DB_LANGUAGE,
        {
            {
                "create", SEPG_DB_LANGUAGE__CREATE
            },
            {
                "drop", SEPG_DB_LANGUAGE__DROP
            },
            {
                "getattr", SEPG_DB_LANGUAGE__GETATTR
            },
            {
                "setattr", SEPG_DB_LANGUAGE__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_LANGUAGE__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_LANGUAGE__RELABELTO
            },
            {
                "implement", SEPG_DB_LANGUAGE__IMPLEMENT
            },
            {
                "execute", SEPG_DB_LANGUAGE__EXECUTE
            },
            {
                NULL, 0UL
            },
        }
    },
    {
        "db_view", SEPG_CLASS_DB_VIEW,
        {
            {
                "create", SEPG_DB_VIEW__CREATE
            },
            {
                "drop", SEPG_DB_VIEW__DROP
            },
            {
                "getattr", SEPG_DB_VIEW__GETATTR
            },
            {
                "setattr", SEPG_DB_VIEW__SETATTR
            },
            {
                "relabelfrom", SEPG_DB_VIEW__RELABELFROM
            },
            {
                "relabelto", SEPG_DB_VIEW__RELABELTO
            },
            {
                "expand", SEPG_DB_VIEW__EXPAND
            },
            {
                NULL, 0UL
            },
        }
    },
};

/*
 * sepgsql_mode
 *
 * SEPGSQL_MODE_DISABLED: Disabled on runtime
 * SEPGSQL_MODE_DEFAULT: Same as system settings
 * SEPGSQL_MODE_PERMISSIVE: Always permissive mode
 * SEPGSQL_MODE_INTERNAL: Same as permissive, except for no audit logs
 */
static int  sepgsql_mode = SEPGSQL_MODE_INTERNAL;

/*
 * sepgsql_is_enabled
 */
bool
sepgsql_is_enabled(void)
{
    return (sepgsql_mode != SEPGSQL_MODE_DISABLED ? true : false);
}

/*
 * sepgsql_get_mode
 */
int
sepgsql_get_mode(void)
{
    return sepgsql_mode;
}

/*
 * sepgsql_set_mode
 */
int
sepgsql_set_mode(int new_mode)
{
    int         old_mode = sepgsql_mode;

    sepgsql_mode = new_mode;

    return old_mode;
}

/*
 * sepgsql_getenforce
 *
 * It returns whether the current working mode tries to enforce access
 * control decision, or not. It shall be enforced when sepgsql_mode is
 * SEPGSQL_MODE_DEFAULT and system is running in enforcing mode.
 */
bool
sepgsql_getenforce(void)
{
    if (sepgsql_mode == SEPGSQL_MODE_DEFAULT &&
        selinux_status_getenforce() > 0)
        return true;

    return false;
}

/*
 * sepgsql_audit_log
 *
 * It generates a security audit record. It writes out audit records
 * into standard PG's logfile.
 *
 * SELinux can control what should be audited and should not using
 * "auditdeny" and "auditallow" rules in the security policy. In the
 * default, all the access violations are audited, and all the access
 * allowed are not audited. But we can set up the security policy, so
 * we can have exceptions. So, it is necessary to follow the suggestion
 * come from the security policy. (av_decision.auditallow and auditdeny)
 *
 * Security audit is an important feature, because it enables us to check
 * what was happen if we have a security incident. In fact, ISO/IEC15408
 * defines several security functionalities for audit features.
 */
void
sepgsql_audit_log(bool denied,
                  const char *scontext,
                  const char *tcontext,
                  uint16 tclass,
                  uint32 audited,
                  const char *audit_name)
{
    StringInfoData buf;
    const char *class_name;
    const char *av_name;
    int         i;

    /* lookup name of the object class */
    Assert(tclass < SEPG_CLASS_MAX);
    class_name = selinux_catalog[tclass].class_name;

    /* lookup name of the permissions */
    initStringInfo(&buf);
    appendStringInfo(&buf, "%s {",
                     (denied ? "denied" : "allowed"));
    for (i = 0; selinux_catalog[tclass].av[i].av_name; i++)
    {
        if (audited & (1UL << i))
        {
            av_name = selinux_catalog[tclass].av[i].av_name;
            appendStringInfo(&buf, " %s", av_name);
        }
    }
    appendStringInfoString(&buf, " }");

    /*
     * Call external audit module, if loaded
     */
    appendStringInfo(&buf, " scontext=%s tcontext=%s tclass=%s",
                     scontext, tcontext, class_name);
    if (audit_name)
        appendStringInfo(&buf, " name=\"%s\"", audit_name);

    ereport(LOG, (errmsg("SELinux: %s", buf.data)));
}

/*
 * sepgsql_compute_avd
 *
 * It actually asks SELinux what permissions are allowed on a pair of
 * the security contexts and object class. It also returns what permissions
 * should be audited on access violation or allowed.
 * In most cases, subject's security context (scontext) is a client, and
 * target security context (tcontext) is a database object.
 *
 * The access control decision shall be set on the given av_decision.
 * The av_decision.allowed has a bitmask of SEPG_<class>__<perms>
 * to suggest a set of allowed actions in this object class.
 */
void
sepgsql_compute_avd(const char *scontext,
                    const char *tcontext,
                    uint16 tclass,
                    struct av_decision *avd)
{
    const char *tclass_name;
    security_class_t tclass_ex;
    struct av_decision avd_ex;
    int         i,
                deny_unknown = security_deny_unknown();

    /* Get external code of the object class */
    Assert(tclass < SEPG_CLASS_MAX);
    Assert(tclass == selinux_catalog[tclass].class_code);

    tclass_name = selinux_catalog[tclass].class_name;
    tclass_ex = string_to_security_class(tclass_name);

    if (tclass_ex == 0)
    {
        /*
         * If the current security policy does not support permissions
         * corresponding to database objects, we fill up them with dummy data.
         * If security_deny_unknown() returns positive value, undefined
         * permissions should be denied. Otherwise, allowed
         */
        avd->allowed = (security_deny_unknown() > 0 ? 0 : ~0);
        avd->auditallow = 0U;
        avd->auditdeny = ~0U;
        avd->flags = 0;

        return;
    }

    /*
     * Ask SELinux what is allowed set of permissions on a pair of the
     * security contexts and the given object class.
     */
    if (security_compute_av_flags_raw((security_context_t) scontext,
                                      (security_context_t) tcontext,
                                      tclass_ex, 0, &avd_ex) < 0)
        ereport(ERROR,
                (errcode(ERRCODE_INTERNAL_ERROR),
                 errmsg("SELinux could not compute av_decision: "
                        "scontext=%s tcontext=%s tclass=%s: %m",
                        scontext, tcontext, tclass_name)));

    /*
     * SELinux returns its access control decision as a set of permissions
     * represented in external code which depends on run-time environment. So,
     * we need to translate it to the internal representation before returning
     * results for the caller.
     */
    memset(avd, 0, sizeof(struct av_decision));

    for (i = 0; selinux_catalog[tclass].av[i].av_name; i++)
    {
        access_vector_t av_code_ex;
        const char *av_name = selinux_catalog[tclass].av[i].av_name;
        uint32      av_code = selinux_catalog[tclass].av[i].av_code;

        av_code_ex = string_to_av_perm(tclass_ex, av_name);
        if (av_code_ex == 0)
        {
            /* fill up undefined permissions */
            if (!deny_unknown)
                avd->allowed |= av_code;
            avd->auditdeny |= av_code;

            continue;
        }

        if (avd_ex.allowed & av_code_ex)
            avd->allowed |= av_code;
        if (avd_ex.auditallow & av_code_ex)
            avd->auditallow |= av_code;
        if (avd_ex.auditdeny & av_code_ex)
            avd->auditdeny |= av_code;
    }

    return;
}

/*
 * sepgsql_compute_create
 *
 * It returns a default security context to be assigned on a new database
 * object. SELinux compute it based on a combination of client, upper object
 * which owns the new object and object class.
 *
 * For example, when a client (staff_u:staff_r:staff_t:s0) tries to create
 * a new table within a schema (system_u:object_r:sepgsql_schema_t:s0),
 * SELinux looks-up its security policy. If it has a special rule on the
 * combination of these security contexts and object class (db_table),
 * it returns the security context suggested by the special rule.
 * Otherwise, it returns the security context of schema, as is.
 *
 * We expect the caller already applies sanity/validation checks on the
 * given security context.
 *
 * scontext: security context of the subject (mostly, peer process).
 * tcontext: security context of the upper database object.
 * tclass: class code (SEPG_CLASS_*) of the new object in creation
 */
char *
sepgsql_compute_create(const char *scontext,
                       const char *tcontext,
                       uint16 tclass,
                       const char *objname)
{
    security_context_t ncontext;
    security_class_t tclass_ex;
    const char *tclass_name;
    char       *result;

    /* Get external code of the object class */
    Assert(tclass < SEPG_CLASS_MAX);

    tclass_name = selinux_catalog[tclass].class_name;
    tclass_ex = string_to_security_class(tclass_name);

    /*
     * Ask SELinux what is the default context for the given object class on a
     * pair of security contexts
     */
    if (security_compute_create_name_raw((security_context_t) scontext,
                                         (security_context_t) tcontext,
                                         tclass_ex,
                                         objname,
                                         &ncontext) < 0)
        ereport(ERROR,
                (errcode(ERRCODE_INTERNAL_ERROR),
                 errmsg("SELinux could not compute a new context: "
                        "scontext=%s tcontext=%s tclass=%s: %m",
                        scontext, tcontext, tclass_name)));

    /*
     * libselinux returns malloc()'ed string, so we need to copy it on the
     * palloc()'ed region.
     */
    PG_TRY();
    {
        result = pstrdup(ncontext);
    }
    PG_CATCH();
    {
        freecon(ncontext);
        PG_RE_THROW();
    }
    PG_END_TRY();
    freecon(ncontext);

    return result;
}

/*
 * sepgsql_check_perms
 *
 * It makes access control decision without userspace caching mechanism.
 * If SELinux denied the required accesses on the pair of security labels,
 * it raises an error or returns false.
 *
 * scontext: security label of the subject (mostly, peer process)
 * tcontext: security label of the object being referenced
 * tclass: class code (SEPG_CLASS_*) of the object being referenced
 * required: a mask of required permissions (SEPG_<class>__<perm>)
 * audit_name: a human readable object name for audit logs, or NULL.
 * abort_on_violation: true, if error shall be raised on access violation
 */
bool
sepgsql_check_perms(const char *scontext,
                    const char *tcontext,
                    uint16 tclass,
                    uint32 required,
                    const char *audit_name,
                    bool abort_on_violation)
{
    struct av_decision avd;
    uint32      denied;
    uint32      audited;
    bool        result = true;

    sepgsql_compute_avd(scontext, tcontext, tclass, &avd);

    denied = required & ~avd.allowed;

    if (sepgsql_get_debug_audit())
        audited = (denied ? denied : required);
    else
        audited = (denied ? (denied & avd.auditdeny)
                   : (required & avd.auditallow));

    if (denied &&
        sepgsql_getenforce() > 0 &&
        (avd.flags & SELINUX_AVD_FLAGS_PERMISSIVE) == 0)
        result = false;

    /*
     * It records a security audit for the request, if needed. But, when
     * SE-PgSQL performs 'internal' mode, it needs to keep silent.
     */
    if (audited && sepgsql_mode != SEPGSQL_MODE_INTERNAL)
    {
        sepgsql_audit_log(denied,
                          scontext,
                          tcontext,
                          tclass,
                          audited,
                          audit_name);
    }

    if (!result && abort_on_violation)
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("SELinux: security policy violation")));
    return result;
}