PostgreSQL Source Code git master
All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Pages
sepgsql.h
Go to the documentation of this file.
1/* -------------------------------------------------------------------------
2 *
3 * contrib/sepgsql/sepgsql.h
4 *
5 * Definitions corresponding to SE-PostgreSQL
6 *
7 * Copyright (c) 2010-2024, PostgreSQL Global Development Group
8 *
9 * -------------------------------------------------------------------------
10 */
11#ifndef SEPGSQL_H
12#define SEPGSQL_H
13
15#include "fmgr.h"
16
17#include <selinux/selinux.h>
18#include <selinux/avc.h>
19
20/*
21 * SE-PostgreSQL Label Tag
22 */
23#define SEPGSQL_LABEL_TAG "selinux"
24
25/*
26 * SE-PostgreSQL performing mode
27 */
28#define SEPGSQL_MODE_DEFAULT 1
29#define SEPGSQL_MODE_PERMISSIVE 2
30#define SEPGSQL_MODE_INTERNAL 3
31#define SEPGSQL_MODE_DISABLED 4
32
33/*
34 * Internally used code of object classes
35 */
36#define SEPG_CLASS_PROCESS 0
37#define SEPG_CLASS_FILE 1
38#define SEPG_CLASS_DIR 2
39#define SEPG_CLASS_LNK_FILE 3
40#define SEPG_CLASS_CHR_FILE 4
41#define SEPG_CLASS_BLK_FILE 5
42#define SEPG_CLASS_SOCK_FILE 6
43#define SEPG_CLASS_FIFO_FILE 7
44#define SEPG_CLASS_DB_DATABASE 8
45#define SEPG_CLASS_DB_SCHEMA 9
46#define SEPG_CLASS_DB_TABLE 10
47#define SEPG_CLASS_DB_SEQUENCE 11
48#define SEPG_CLASS_DB_PROCEDURE 12
49#define SEPG_CLASS_DB_COLUMN 13
50#define SEPG_CLASS_DB_TUPLE 14
51#define SEPG_CLASS_DB_BLOB 15
52#define SEPG_CLASS_DB_LANGUAGE 16
53#define SEPG_CLASS_DB_VIEW 17
54#define SEPG_CLASS_MAX 18
55
56/*
57 * Internally used code of access vectors
58 */
59#define SEPG_PROCESS__TRANSITION (1<<0)
60#define SEPG_PROCESS__DYNTRANSITION (1<<1)
61#define SEPG_PROCESS__SETCURRENT (1<<2)
62
63#define SEPG_FILE__READ (1<<0)
64#define SEPG_FILE__WRITE (1<<1)
65#define SEPG_FILE__CREATE (1<<2)
66#define SEPG_FILE__GETATTR (1<<3)
67#define SEPG_FILE__UNLINK (1<<4)
68#define SEPG_FILE__RENAME (1<<5)
69#define SEPG_FILE__APPEND (1<<6)
70
71#define SEPG_DIR__READ (SEPG_FILE__READ)
72#define SEPG_DIR__WRITE (SEPG_FILE__WRITE)
73#define SEPG_DIR__CREATE (SEPG_FILE__CREATE)
74#define SEPG_DIR__GETATTR (SEPG_FILE__GETATTR)
75#define SEPG_DIR__UNLINK (SEPG_FILE__UNLINK)
76#define SEPG_DIR__RENAME (SEPG_FILE__RENAME)
77#define SEPG_DIR__SEARCH (1<<6)
78#define SEPG_DIR__ADD_NAME (1<<7)
79#define SEPG_DIR__REMOVE_NAME (1<<8)
80#define SEPG_DIR__RMDIR (1<<9)
81#define SEPG_DIR__REPARENT (1<<10)
82
83#define SEPG_LNK_FILE__READ (SEPG_FILE__READ)
84#define SEPG_LNK_FILE__WRITE (SEPG_FILE__WRITE)
85#define SEPG_LNK_FILE__CREATE (SEPG_FILE__CREATE)
86#define SEPG_LNK_FILE__GETATTR (SEPG_FILE__GETATTR)
87#define SEPG_LNK_FILE__UNLINK (SEPG_FILE__UNLINK)
88#define SEPG_LNK_FILE__RENAME (SEPG_FILE__RENAME)
89
90#define SEPG_CHR_FILE__READ (SEPG_FILE__READ)
91#define SEPG_CHR_FILE__WRITE (SEPG_FILE__WRITE)
92#define SEPG_CHR_FILE__CREATE (SEPG_FILE__CREATE)
93#define SEPG_CHR_FILE__GETATTR (SEPG_FILE__GETATTR)
94#define SEPG_CHR_FILE__UNLINK (SEPG_FILE__UNLINK)
95#define SEPG_CHR_FILE__RENAME (SEPG_FILE__RENAME)
96
97#define SEPG_BLK_FILE__READ (SEPG_FILE__READ)
98#define SEPG_BLK_FILE__WRITE (SEPG_FILE__WRITE)
99#define SEPG_BLK_FILE__CREATE (SEPG_FILE__CREATE)
100#define SEPG_BLK_FILE__GETATTR (SEPG_FILE__GETATTR)
101#define SEPG_BLK_FILE__UNLINK (SEPG_FILE__UNLINK)
102#define SEPG_BLK_FILE__RENAME (SEPG_FILE__RENAME)
103
104#define SEPG_SOCK_FILE__READ (SEPG_FILE__READ)
105#define SEPG_SOCK_FILE__WRITE (SEPG_FILE__WRITE)
106#define SEPG_SOCK_FILE__CREATE (SEPG_FILE__CREATE)
107#define SEPG_SOCK_FILE__GETATTR (SEPG_FILE__GETATTR)
108#define SEPG_SOCK_FILE__UNLINK (SEPG_FILE__UNLINK)
109#define SEPG_SOCK_FILE__RENAME (SEPG_FILE__RENAME)
110
111#define SEPG_FIFO_FILE__READ (SEPG_FILE__READ)
112#define SEPG_FIFO_FILE__WRITE (SEPG_FILE__WRITE)
113#define SEPG_FIFO_FILE__CREATE (SEPG_FILE__CREATE)
114#define SEPG_FIFO_FILE__GETATTR (SEPG_FILE__GETATTR)
115#define SEPG_FIFO_FILE__UNLINK (SEPG_FILE__UNLINK)
116#define SEPG_FIFO_FILE__RENAME (SEPG_FILE__RENAME)
117
118#define SEPG_DB_DATABASE__CREATE (1<<0)
119#define SEPG_DB_DATABASE__DROP (1<<1)
120#define SEPG_DB_DATABASE__GETATTR (1<<2)
121#define SEPG_DB_DATABASE__SETATTR (1<<3)
122#define SEPG_DB_DATABASE__RELABELFROM (1<<4)
123#define SEPG_DB_DATABASE__RELABELTO (1<<5)
124#define SEPG_DB_DATABASE__ACCESS (1<<6)
125#define SEPG_DB_DATABASE__LOAD_MODULE (1<<7)
126
127#define SEPG_DB_SCHEMA__CREATE (SEPG_DB_DATABASE__CREATE)
128#define SEPG_DB_SCHEMA__DROP (SEPG_DB_DATABASE__DROP)
129#define SEPG_DB_SCHEMA__GETATTR (SEPG_DB_DATABASE__GETATTR)
130#define SEPG_DB_SCHEMA__SETATTR (SEPG_DB_DATABASE__SETATTR)
131#define SEPG_DB_SCHEMA__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
132#define SEPG_DB_SCHEMA__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
133#define SEPG_DB_SCHEMA__SEARCH (1<<6)
134#define SEPG_DB_SCHEMA__ADD_NAME (1<<7)
135#define SEPG_DB_SCHEMA__REMOVE_NAME (1<<8)
136
137#define SEPG_DB_TABLE__CREATE (SEPG_DB_DATABASE__CREATE)
138#define SEPG_DB_TABLE__DROP (SEPG_DB_DATABASE__DROP)
139#define SEPG_DB_TABLE__GETATTR (SEPG_DB_DATABASE__GETATTR)
140#define SEPG_DB_TABLE__SETATTR (SEPG_DB_DATABASE__SETATTR)
141#define SEPG_DB_TABLE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
142#define SEPG_DB_TABLE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
143#define SEPG_DB_TABLE__SELECT (1<<6)
144#define SEPG_DB_TABLE__UPDATE (1<<7)
145#define SEPG_DB_TABLE__INSERT (1<<8)
146#define SEPG_DB_TABLE__DELETE (1<<9)
147#define SEPG_DB_TABLE__LOCK (1<<10)
148#define SEPG_DB_TABLE__TRUNCATE (1<<11)
149
150#define SEPG_DB_SEQUENCE__CREATE (SEPG_DB_DATABASE__CREATE)
151#define SEPG_DB_SEQUENCE__DROP (SEPG_DB_DATABASE__DROP)
152#define SEPG_DB_SEQUENCE__GETATTR (SEPG_DB_DATABASE__GETATTR)
153#define SEPG_DB_SEQUENCE__SETATTR (SEPG_DB_DATABASE__SETATTR)
154#define SEPG_DB_SEQUENCE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
155#define SEPG_DB_SEQUENCE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
156#define SEPG_DB_SEQUENCE__GET_VALUE (1<<6)
157#define SEPG_DB_SEQUENCE__NEXT_VALUE (1<<7)
158#define SEPG_DB_SEQUENCE__SET_VALUE (1<<8)
159
160#define SEPG_DB_PROCEDURE__CREATE (SEPG_DB_DATABASE__CREATE)
161#define SEPG_DB_PROCEDURE__DROP (SEPG_DB_DATABASE__DROP)
162#define SEPG_DB_PROCEDURE__GETATTR (SEPG_DB_DATABASE__GETATTR)
163#define SEPG_DB_PROCEDURE__SETATTR (SEPG_DB_DATABASE__SETATTR)
164#define SEPG_DB_PROCEDURE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
165#define SEPG_DB_PROCEDURE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
166#define SEPG_DB_PROCEDURE__EXECUTE (1<<6)
167#define SEPG_DB_PROCEDURE__ENTRYPOINT (1<<7)
168#define SEPG_DB_PROCEDURE__INSTALL (1<<8)
169
170#define SEPG_DB_COLUMN__CREATE (SEPG_DB_DATABASE__CREATE)
171#define SEPG_DB_COLUMN__DROP (SEPG_DB_DATABASE__DROP)
172#define SEPG_DB_COLUMN__GETATTR (SEPG_DB_DATABASE__GETATTR)
173#define SEPG_DB_COLUMN__SETATTR (SEPG_DB_DATABASE__SETATTR)
174#define SEPG_DB_COLUMN__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
175#define SEPG_DB_COLUMN__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
176#define SEPG_DB_COLUMN__SELECT (1<<6)
177#define SEPG_DB_COLUMN__UPDATE (1<<7)
178#define SEPG_DB_COLUMN__INSERT (1<<8)
179
180#define SEPG_DB_TUPLE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
181#define SEPG_DB_TUPLE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
182#define SEPG_DB_TUPLE__SELECT (SEPG_DB_DATABASE__GETATTR)
183#define SEPG_DB_TUPLE__UPDATE (SEPG_DB_DATABASE__SETATTR)
184#define SEPG_DB_TUPLE__INSERT (SEPG_DB_DATABASE__CREATE)
185#define SEPG_DB_TUPLE__DELETE (SEPG_DB_DATABASE__DROP)
186
187#define SEPG_DB_BLOB__CREATE (SEPG_DB_DATABASE__CREATE)
188#define SEPG_DB_BLOB__DROP (SEPG_DB_DATABASE__DROP)
189#define SEPG_DB_BLOB__GETATTR (SEPG_DB_DATABASE__GETATTR)
190#define SEPG_DB_BLOB__SETATTR (SEPG_DB_DATABASE__SETATTR)
191#define SEPG_DB_BLOB__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
192#define SEPG_DB_BLOB__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
193#define SEPG_DB_BLOB__READ (1<<6)
194#define SEPG_DB_BLOB__WRITE (1<<7)
195#define SEPG_DB_BLOB__IMPORT (1<<8)
196#define SEPG_DB_BLOB__EXPORT (1<<9)
197
198#define SEPG_DB_LANGUAGE__CREATE (SEPG_DB_DATABASE__CREATE)
199#define SEPG_DB_LANGUAGE__DROP (SEPG_DB_DATABASE__DROP)
200#define SEPG_DB_LANGUAGE__GETATTR (SEPG_DB_DATABASE__GETATTR)
201#define SEPG_DB_LANGUAGE__SETATTR (SEPG_DB_DATABASE__SETATTR)
202#define SEPG_DB_LANGUAGE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
203#define SEPG_DB_LANGUAGE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
204#define SEPG_DB_LANGUAGE__IMPLEMENT (1<<6)
205#define SEPG_DB_LANGUAGE__EXECUTE (1<<7)
206
207#define SEPG_DB_VIEW__CREATE (SEPG_DB_DATABASE__CREATE)
208#define SEPG_DB_VIEW__DROP (SEPG_DB_DATABASE__DROP)
209#define SEPG_DB_VIEW__GETATTR (SEPG_DB_DATABASE__GETATTR)
210#define SEPG_DB_VIEW__SETATTR (SEPG_DB_DATABASE__SETATTR)
211#define SEPG_DB_VIEW__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
212#define SEPG_DB_VIEW__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
213#define SEPG_DB_VIEW__EXPAND (1<<6)
214
215/*
216 * hooks.c
217 */
218extern bool sepgsql_get_permissive(void);
219extern bool sepgsql_get_debug_audit(void);
220
221/*
222 * selinux.c
223 */
224extern bool sepgsql_is_enabled(void);
225extern int sepgsql_get_mode(void);
226extern int sepgsql_set_mode(int new_mode);
227extern bool sepgsql_getenforce(void);
228
229extern void sepgsql_audit_log(bool denied,
230 bool enforcing,
231 const char *scontext,
232 const char *tcontext,
233 uint16 tclass,
234 uint32 audited,
235 const char *audit_name);
236
237extern void sepgsql_compute_avd(const char *scontext,
238 const char *tcontext,
239 uint16 tclass,
240 struct av_decision *avd);
241
242extern char *sepgsql_compute_create(const char *scontext,
243 const char *tcontext,
244 uint16 tclass,
245 const char *objname);
246
247/*
248 * uavc.c
249 */
250#define SEPGSQL_AVC_NOAUDIT ((void *)(-1))
251extern bool sepgsql_avc_check_perms_label(const char *tcontext,
252 uint16 tclass,
254 const char *audit_name,
255 bool abort_on_violation);
256extern bool sepgsql_avc_check_perms(const ObjectAddress *tobject,
257 uint16 tclass,
259 const char *audit_name,
260 bool abort_on_violation);
261extern char *sepgsql_avc_trusted_proc(Oid functionId);
262extern void sepgsql_avc_init(void);
263
264/*
265 * label.c
266 */
267extern char *sepgsql_get_client_label(void);
268extern void sepgsql_init_client_label(void);
269extern char *sepgsql_get_label(Oid classId, Oid objectId, int32 subId);
270
271extern void sepgsql_object_relabel(const ObjectAddress *object,
272 const char *seclabel);
273
274/*
275 * dml.c
276 */
277extern bool sepgsql_dml_privileges(List *rangeTabls, List *rteperminfos,
278 bool abort_on_violation);
279
280/*
281 * database.c
282 */
283extern void sepgsql_database_post_create(Oid databaseId,
284 const char *dtemplate);
285extern void sepgsql_database_drop(Oid databaseId);
286extern void sepgsql_database_relabel(Oid databaseId, const char *seclabel);
287extern void sepgsql_database_setattr(Oid databaseId);
288
289/*
290 * schema.c
291 */
292extern void sepgsql_schema_post_create(Oid namespaceId);
293extern void sepgsql_schema_drop(Oid namespaceId);
294extern void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel);
295extern void sepgsql_schema_setattr(Oid namespaceId);
296extern bool sepgsql_schema_search(Oid namespaceId, bool abort_on_violation);
297extern void sepgsql_schema_add_name(Oid namespaceId);
298extern void sepgsql_schema_remove_name(Oid namespaceId);
299extern void sepgsql_schema_rename(Oid namespaceId);
300
301/*
302 * relation.c
303 */
305extern void sepgsql_attribute_drop(Oid relOid, AttrNumber attnum);
307 const char *seclabel);
309extern void sepgsql_relation_post_create(Oid relOid);
310extern void sepgsql_relation_drop(Oid relOid);
311extern void sepgsql_relation_truncate(Oid relOid);
312extern void sepgsql_relation_relabel(Oid relOid, const char *seclabel);
313extern void sepgsql_relation_setattr(Oid relOid);
314
315/*
316 * proc.c
317 */
318extern void sepgsql_proc_post_create(Oid functionId);
319extern void sepgsql_proc_drop(Oid functionId);
320extern void sepgsql_proc_relabel(Oid functionId, const char *seclabel);
321extern void sepgsql_proc_setattr(Oid functionId);
322extern void sepgsql_proc_execute(Oid functionId);
323
324#endif /* SEPGSQL_H */
int16 AttrNumber
Definition: attnum.h:21
int32_t int32
Definition: c.h:481
uint16_t uint16
Definition: c.h:484
uint32_t uint32
Definition: c.h:485
int16 attnum
Definition: pg_attribute.h:74
unsigned int Oid
Definition: postgres_ext.h:31
void sepgsql_attribute_setattr(Oid relOid, AttrNumber attnum)
Definition: relation.c:209
void sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum)
Definition: relation.c:43
void sepgsql_relation_post_create(Oid relOid)
Definition: relation.c:240
void sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum, const char *seclabel)
Definition: relation.c:165
bool sepgsql_get_permissive(void)
Definition: hooks.c:63
char * sepgsql_avc_trusted_proc(Oid functionId)
Definition: uavc.c:445
void sepgsql_database_relabel(Oid databaseId, const char *seclabel)
Definition: database.c:187
bool sepgsql_avc_check_perms_label(const char *tcontext, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
Definition: uavc.c:337
void sepgsql_schema_post_create(Oid namespaceId)
Definition: schema.c:36
void sepgsql_schema_setattr(Oid namespaceId)
Definition: schema.c:202
void sepgsql_init_client_label(void)
Definition: label.c:404
void sepgsql_schema_rename(Oid namespaceId)
Definition: schema.c:229
void sepgsql_proc_post_create(Oid functionId)
Definition: proc.c:37
char * sepgsql_compute_create(const char *scontext, const char *tcontext, uint16 tclass, const char *objname)
Definition: selinux.c:842
void sepgsql_proc_relabel(Oid functionId, const char *seclabel)
Definition: proc.c:198
int sepgsql_get_mode(void)
Definition: selinux.c:625
void sepgsql_schema_remove_name(Oid namespaceId)
Definition: schema.c:223
bool sepgsql_get_debug_audit(void)
Definition: hooks.c:74
void sepgsql_database_post_create(Oid databaseId, const char *dtemplate)
Definition: database.c:33
void sepgsql_compute_avd(const char *scontext, const char *tcontext, uint16 tclass, struct av_decision *avd)
Definition: selinux.c:739
void sepgsql_database_drop(Oid databaseId)
Definition: database.c:133
void sepgsql_schema_add_name(Oid namespaceId)
Definition: schema.c:217
void sepgsql_audit_log(bool denied, bool enforcing, const char *scontext, const char *tcontext, uint16 tclass, uint32 audited, const char *audit_name)
Definition: selinux.c:678
void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel)
Definition: schema.c:142
void sepgsql_relation_truncate(Oid relOid)
Definition: relation.c:524
void sepgsql_proc_setattr(Oid functionId)
Definition: proc.c:235
void sepgsql_relation_relabel(Oid relOid, const char *seclabel)
Definition: relation.c:564
bool sepgsql_dml_privileges(List *rangeTabls, List *rteperminfos, bool abort_on_violation)
Definition: dml.c:282
char * sepgsql_get_label(Oid classId, Oid objectId, int32 subId)
Definition: label.c:445
void sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
Definition: label.c:482
void sepgsql_database_setattr(Oid databaseId)
Definition: database.c:160
int sepgsql_set_mode(int new_mode)
Definition: selinux.c:634
void sepgsql_relation_setattr(Oid relOid)
Definition: relation.c:615
char * sepgsql_get_client_label(void)
Definition: label.c:80
void sepgsql_proc_drop(Oid functionId)
Definition: proc.c:155
bool sepgsql_is_enabled(void)
Definition: selinux.c:616
void sepgsql_relation_drop(Oid relOid)
Definition: relation.c:416
bool sepgsql_schema_search(Oid namespaceId, bool abort_on_violation)
Definition: schema.c:209
bool sepgsql_getenforce(void)
Definition: selinux.c:651
void sepgsql_proc_execute(Oid functionId)
Definition: proc.c:315
void sepgsql_schema_drop(Oid namespaceId)
Definition: schema.c:114
void sepgsql_attribute_drop(Oid relOid, AttrNumber attnum)
Definition: relation.c:133
void sepgsql_avc_init(void)
Definition: uavc.c:488
bool sepgsql_avc_check_perms(const ObjectAddress *tobject, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
Definition: uavc.c:420
Definition: pg_list.h:54