PostgreSQL Source Code  git master
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros
sepgsql.h
Go to the documentation of this file.
1 /* -------------------------------------------------------------------------
2  *
3  * contrib/sepgsql/sepgsql.h
4  *
5  * Definitions corresponding to SE-PostgreSQL
6  *
7  * Copyright (c) 2010-2017, PostgreSQL Global Development Group
8  *
9  * -------------------------------------------------------------------------
10  */
11 #ifndef SEPGSQL_H
12 #define SEPGSQL_H
13 
14 #include "catalog/objectaddress.h"
15 #include "fmgr.h"
16 
17 #include <selinux/selinux.h>
18 #include <selinux/avc.h>
19 
20 /*
21  * SE-PostgreSQL Label Tag
22  */
23 #define SEPGSQL_LABEL_TAG "selinux"
24 
25 /*
26  * SE-PostgreSQL performing mode
27  */
28 #define SEPGSQL_MODE_DEFAULT 1
29 #define SEPGSQL_MODE_PERMISSIVE 2
30 #define SEPGSQL_MODE_INTERNAL 3
31 #define SEPGSQL_MODE_DISABLED 4
32 
33 /*
34  * Internally used code of object classes
35  */
36 #define SEPG_CLASS_PROCESS 0
37 #define SEPG_CLASS_FILE 1
38 #define SEPG_CLASS_DIR 2
39 #define SEPG_CLASS_LNK_FILE 3
40 #define SEPG_CLASS_CHR_FILE 4
41 #define SEPG_CLASS_BLK_FILE 5
42 #define SEPG_CLASS_SOCK_FILE 6
43 #define SEPG_CLASS_FIFO_FILE 7
44 #define SEPG_CLASS_DB_DATABASE 8
45 #define SEPG_CLASS_DB_SCHEMA 9
46 #define SEPG_CLASS_DB_TABLE 10
47 #define SEPG_CLASS_DB_SEQUENCE 11
48 #define SEPG_CLASS_DB_PROCEDURE 12
49 #define SEPG_CLASS_DB_COLUMN 13
50 #define SEPG_CLASS_DB_TUPLE 14
51 #define SEPG_CLASS_DB_BLOB 15
52 #define SEPG_CLASS_DB_LANGUAGE 16
53 #define SEPG_CLASS_DB_VIEW 17
54 #define SEPG_CLASS_MAX 18
55 
56 /*
57  * Internally used code of access vectors
58  */
59 #define SEPG_PROCESS__TRANSITION (1<<0)
60 #define SEPG_PROCESS__DYNTRANSITION (1<<1)
61 #define SEPG_PROCESS__SETCURRENT (1<<2)
62 
63 #define SEPG_FILE__READ (1<<0)
64 #define SEPG_FILE__WRITE (1<<1)
65 #define SEPG_FILE__CREATE (1<<2)
66 #define SEPG_FILE__GETATTR (1<<3)
67 #define SEPG_FILE__UNLINK (1<<4)
68 #define SEPG_FILE__RENAME (1<<5)
69 #define SEPG_FILE__APPEND (1<<6)
70 
71 #define SEPG_DIR__READ (SEPG_FILE__READ)
72 #define SEPG_DIR__WRITE (SEPG_FILE__WRITE)
73 #define SEPG_DIR__CREATE (SEPG_FILE__CREATE)
74 #define SEPG_DIR__GETATTR (SEPG_FILE__GETATTR)
75 #define SEPG_DIR__UNLINK (SEPG_FILE__UNLINK)
76 #define SEPG_DIR__RENAME (SEPG_FILE__RENAME)
77 #define SEPG_DIR__SEARCH (1<<6)
78 #define SEPG_DIR__ADD_NAME (1<<7)
79 #define SEPG_DIR__REMOVE_NAME (1<<8)
80 #define SEPG_DIR__RMDIR (1<<9)
81 #define SEPG_DIR__REPARENT (1<<10)
82 
83 #define SEPG_LNK_FILE__READ (SEPG_FILE__READ)
84 #define SEPG_LNK_FILE__WRITE (SEPG_FILE__WRITE)
85 #define SEPG_LNK_FILE__CREATE (SEPG_FILE__CREATE)
86 #define SEPG_LNK_FILE__GETATTR (SEPG_FILE__GETATTR)
87 #define SEPG_LNK_FILE__UNLINK (SEPG_FILE__UNLINK)
88 #define SEPG_LNK_FILE__RENAME (SEPG_FILE__RENAME)
89 
90 #define SEPG_CHR_FILE__READ (SEPG_FILE__READ)
91 #define SEPG_CHR_FILE__WRITE (SEPG_FILE__WRITE)
92 #define SEPG_CHR_FILE__CREATE (SEPG_FILE__CREATE)
93 #define SEPG_CHR_FILE__GETATTR (SEPG_FILE__GETATTR)
94 #define SEPG_CHR_FILE__UNLINK (SEPG_FILE__UNLINK)
95 #define SEPG_CHR_FILE__RENAME (SEPG_FILE__RENAME)
96 
97 #define SEPG_BLK_FILE__READ (SEPG_FILE__READ)
98 #define SEPG_BLK_FILE__WRITE (SEPG_FILE__WRITE)
99 #define SEPG_BLK_FILE__CREATE (SEPG_FILE__CREATE)
100 #define SEPG_BLK_FILE__GETATTR (SEPG_FILE__GETATTR)
101 #define SEPG_BLK_FILE__UNLINK (SEPG_FILE__UNLINK)
102 #define SEPG_BLK_FILE__RENAME (SEPG_FILE__RENAME)
103 
104 #define SEPG_SOCK_FILE__READ (SEPG_FILE__READ)
105 #define SEPG_SOCK_FILE__WRITE (SEPG_FILE__WRITE)
106 #define SEPG_SOCK_FILE__CREATE (SEPG_FILE__CREATE)
107 #define SEPG_SOCK_FILE__GETATTR (SEPG_FILE__GETATTR)
108 #define SEPG_SOCK_FILE__UNLINK (SEPG_FILE__UNLINK)
109 #define SEPG_SOCK_FILE__RENAME (SEPG_FILE__RENAME)
110 
111 #define SEPG_FIFO_FILE__READ (SEPG_FILE__READ)
112 #define SEPG_FIFO_FILE__WRITE (SEPG_FILE__WRITE)
113 #define SEPG_FIFO_FILE__CREATE (SEPG_FILE__CREATE)
114 #define SEPG_FIFO_FILE__GETATTR (SEPG_FILE__GETATTR)
115 #define SEPG_FIFO_FILE__UNLINK (SEPG_FILE__UNLINK)
116 #define SEPG_FIFO_FILE__RENAME (SEPG_FILE__RENAME)
117 
118 #define SEPG_DB_DATABASE__CREATE (1<<0)
119 #define SEPG_DB_DATABASE__DROP (1<<1)
120 #define SEPG_DB_DATABASE__GETATTR (1<<2)
121 #define SEPG_DB_DATABASE__SETATTR (1<<3)
122 #define SEPG_DB_DATABASE__RELABELFROM (1<<4)
123 #define SEPG_DB_DATABASE__RELABELTO (1<<5)
124 #define SEPG_DB_DATABASE__ACCESS (1<<6)
125 #define SEPG_DB_DATABASE__LOAD_MODULE (1<<7)
126 
127 #define SEPG_DB_SCHEMA__CREATE (SEPG_DB_DATABASE__CREATE)
128 #define SEPG_DB_SCHEMA__DROP (SEPG_DB_DATABASE__DROP)
129 #define SEPG_DB_SCHEMA__GETATTR (SEPG_DB_DATABASE__GETATTR)
130 #define SEPG_DB_SCHEMA__SETATTR (SEPG_DB_DATABASE__SETATTR)
131 #define SEPG_DB_SCHEMA__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
132 #define SEPG_DB_SCHEMA__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
133 #define SEPG_DB_SCHEMA__SEARCH (1<<6)
134 #define SEPG_DB_SCHEMA__ADD_NAME (1<<7)
135 #define SEPG_DB_SCHEMA__REMOVE_NAME (1<<8)
136 
137 #define SEPG_DB_TABLE__CREATE (SEPG_DB_DATABASE__CREATE)
138 #define SEPG_DB_TABLE__DROP (SEPG_DB_DATABASE__DROP)
139 #define SEPG_DB_TABLE__GETATTR (SEPG_DB_DATABASE__GETATTR)
140 #define SEPG_DB_TABLE__SETATTR (SEPG_DB_DATABASE__SETATTR)
141 #define SEPG_DB_TABLE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
142 #define SEPG_DB_TABLE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
143 #define SEPG_DB_TABLE__SELECT (1<<6)
144 #define SEPG_DB_TABLE__UPDATE (1<<7)
145 #define SEPG_DB_TABLE__INSERT (1<<8)
146 #define SEPG_DB_TABLE__DELETE (1<<9)
147 #define SEPG_DB_TABLE__LOCK (1<<10)
148 
149 #define SEPG_DB_SEQUENCE__CREATE (SEPG_DB_DATABASE__CREATE)
150 #define SEPG_DB_SEQUENCE__DROP (SEPG_DB_DATABASE__DROP)
151 #define SEPG_DB_SEQUENCE__GETATTR (SEPG_DB_DATABASE__GETATTR)
152 #define SEPG_DB_SEQUENCE__SETATTR (SEPG_DB_DATABASE__SETATTR)
153 #define SEPG_DB_SEQUENCE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
154 #define SEPG_DB_SEQUENCE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
155 #define SEPG_DB_SEQUENCE__GET_VALUE (1<<6)
156 #define SEPG_DB_SEQUENCE__NEXT_VALUE (1<<7)
157 #define SEPG_DB_SEQUENCE__SET_VALUE (1<<8)
158 
159 #define SEPG_DB_PROCEDURE__CREATE (SEPG_DB_DATABASE__CREATE)
160 #define SEPG_DB_PROCEDURE__DROP (SEPG_DB_DATABASE__DROP)
161 #define SEPG_DB_PROCEDURE__GETATTR (SEPG_DB_DATABASE__GETATTR)
162 #define SEPG_DB_PROCEDURE__SETATTR (SEPG_DB_DATABASE__SETATTR)
163 #define SEPG_DB_PROCEDURE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
164 #define SEPG_DB_PROCEDURE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
165 #define SEPG_DB_PROCEDURE__EXECUTE (1<<6)
166 #define SEPG_DB_PROCEDURE__ENTRYPOINT (1<<7)
167 #define SEPG_DB_PROCEDURE__INSTALL (1<<8)
168 
169 #define SEPG_DB_COLUMN__CREATE (SEPG_DB_DATABASE__CREATE)
170 #define SEPG_DB_COLUMN__DROP (SEPG_DB_DATABASE__DROP)
171 #define SEPG_DB_COLUMN__GETATTR (SEPG_DB_DATABASE__GETATTR)
172 #define SEPG_DB_COLUMN__SETATTR (SEPG_DB_DATABASE__SETATTR)
173 #define SEPG_DB_COLUMN__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
174 #define SEPG_DB_COLUMN__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
175 #define SEPG_DB_COLUMN__SELECT (1<<6)
176 #define SEPG_DB_COLUMN__UPDATE (1<<7)
177 #define SEPG_DB_COLUMN__INSERT (1<<8)
178 
179 #define SEPG_DB_TUPLE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
180 #define SEPG_DB_TUPLE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
181 #define SEPG_DB_TUPLE__SELECT (SEPG_DB_DATABASE__GETATTR)
182 #define SEPG_DB_TUPLE__UPDATE (SEPG_DB_DATABASE__SETATTR)
183 #define SEPG_DB_TUPLE__INSERT (SEPG_DB_DATABASE__CREATE)
184 #define SEPG_DB_TUPLE__DELETE (SEPG_DB_DATABASE__DROP)
185 
186 #define SEPG_DB_BLOB__CREATE (SEPG_DB_DATABASE__CREATE)
187 #define SEPG_DB_BLOB__DROP (SEPG_DB_DATABASE__DROP)
188 #define SEPG_DB_BLOB__GETATTR (SEPG_DB_DATABASE__GETATTR)
189 #define SEPG_DB_BLOB__SETATTR (SEPG_DB_DATABASE__SETATTR)
190 #define SEPG_DB_BLOB__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
191 #define SEPG_DB_BLOB__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
192 #define SEPG_DB_BLOB__READ (1<<6)
193 #define SEPG_DB_BLOB__WRITE (1<<7)
194 #define SEPG_DB_BLOB__IMPORT (1<<8)
195 #define SEPG_DB_BLOB__EXPORT (1<<9)
196 
197 #define SEPG_DB_LANGUAGE__CREATE (SEPG_DB_DATABASE__CREATE)
198 #define SEPG_DB_LANGUAGE__DROP (SEPG_DB_DATABASE__DROP)
199 #define SEPG_DB_LANGUAGE__GETATTR (SEPG_DB_DATABASE__GETATTR)
200 #define SEPG_DB_LANGUAGE__SETATTR (SEPG_DB_DATABASE__SETATTR)
201 #define SEPG_DB_LANGUAGE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
202 #define SEPG_DB_LANGUAGE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
203 #define SEPG_DB_LANGUAGE__IMPLEMENT (1<<6)
204 #define SEPG_DB_LANGUAGE__EXECUTE (1<<7)
205 
206 #define SEPG_DB_VIEW__CREATE (SEPG_DB_DATABASE__CREATE)
207 #define SEPG_DB_VIEW__DROP (SEPG_DB_DATABASE__DROP)
208 #define SEPG_DB_VIEW__GETATTR (SEPG_DB_DATABASE__GETATTR)
209 #define SEPG_DB_VIEW__SETATTR (SEPG_DB_DATABASE__SETATTR)
210 #define SEPG_DB_VIEW__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
211 #define SEPG_DB_VIEW__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
212 #define SEPG_DB_VIEW__EXPAND (1<<6)
213 
214 /*
215  * hooks.c
216  */
217 extern bool sepgsql_get_permissive(void);
218 extern bool sepgsql_get_debug_audit(void);
219 
220 /*
221  * selinux.c
222  */
223 extern bool sepgsql_is_enabled(void);
224 extern int sepgsql_get_mode(void);
225 extern int sepgsql_set_mode(int new_mode);
226 extern bool sepgsql_getenforce(void);
227 
228 extern void sepgsql_audit_log(bool denied,
229  const char *scontext,
230  const char *tcontext,
231  uint16 tclass,
232  uint32 audited,
233  const char *audit_name);
234 
235 extern void sepgsql_compute_avd(const char *scontext,
236  const char *tcontext,
237  uint16 tclass,
238  struct av_decision *avd);
239 
240 extern char *sepgsql_compute_create(const char *scontext,
241  const char *tcontext,
242  uint16 tclass,
243  const char *objname);
244 
245 extern bool sepgsql_check_perms(const char *scontext,
246  const char *tcontext,
247  uint16 tclass,
248  uint32 required,
249  const char *audit_name,
250  bool abort_on_violation);
251 
252 /*
253  * uavc.c
254  */
255 #define SEPGSQL_AVC_NOAUDIT ((void *)(-1))
256 extern bool sepgsql_avc_check_perms_label(const char *tcontext,
257  uint16 tclass,
258  uint32 required,
259  const char *audit_name,
260  bool abort_on_violation);
261 extern bool sepgsql_avc_check_perms(const ObjectAddress *tobject,
262  uint16 tclass,
263  uint32 required,
264  const char *audit_name,
265  bool abort_on_violation);
266 extern char *sepgsql_avc_trusted_proc(Oid functionId);
267 extern void sepgsql_avc_init(void);
268 
269 /*
270  * label.c
271  */
272 extern char *sepgsql_get_client_label(void);
273 extern void sepgsql_init_client_label(void);
274 extern char *sepgsql_get_label(Oid relOid, Oid objOid, int32 subId);
275 
276 extern void sepgsql_object_relabel(const ObjectAddress *object,
277  const char *seclabel);
278 
279 /*
280  * dml.c
281  */
282 extern bool sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation);
283 
284 /*
285  * database.c
286  */
287 extern void sepgsql_database_post_create(Oid databaseId,
288  const char *dtemplate);
289 extern void sepgsql_database_drop(Oid databaseId);
290 extern void sepgsql_database_relabel(Oid databaseId, const char *seclabel);
291 extern void sepgsql_database_setattr(Oid databaseId);
292 
293 /*
294  * schema.c
295  */
296 extern void sepgsql_schema_post_create(Oid namespaceId);
297 extern void sepgsql_schema_drop(Oid namespaceId);
298 extern void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel);
299 extern void sepgsql_schema_setattr(Oid namespaceId);
300 extern bool sepgsql_schema_search(Oid namespaceId, bool abort_on_violation);
301 extern void sepgsql_schema_add_name(Oid namespaceId);
302 extern void sepgsql_schema_remove_name(Oid namespaceId);
303 extern void sepgsql_schema_rename(Oid namespaceId);
304 
305 /*
306  * relation.c
307  */
308 extern void sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum);
309 extern void sepgsql_attribute_drop(Oid relOid, AttrNumber attnum);
310 extern void sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum,
311  const char *seclabel);
312 extern void sepgsql_attribute_setattr(Oid relOid, AttrNumber attnum);
313 extern void sepgsql_relation_post_create(Oid relOid);
314 extern void sepgsql_relation_drop(Oid relOid);
315 extern void sepgsql_relation_relabel(Oid relOid, const char *seclabel);
316 extern void sepgsql_relation_setattr(Oid relOid);
317 
318 /*
319  * proc.c
320  */
321 extern void sepgsql_proc_post_create(Oid functionId);
322 extern void sepgsql_proc_drop(Oid functionId);
323 extern void sepgsql_proc_relabel(Oid functionId, const char *seclabel);
324 extern void sepgsql_proc_setattr(Oid functionId);
325 extern void sepgsql_proc_execute(Oid functionId);
326 
327 #endif /* SEPGSQL_H */
bool sepgsql_getenforce(void)
Definition: selinux.c:648
bool sepgsql_avc_check_perms_label(const char *tcontext, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
Definition: uavc.c:346
void sepgsql_proc_drop(Oid functionId)
Definition: proc.c:157
void sepgsql_attribute_drop(Oid relOid, AttrNumber attnum)
Definition: relation.c:135
int sepgsql_set_mode(int new_mode)
Definition: selinux.c:631
void sepgsql_schema_rename(Oid namespaceId)
Definition: schema.c:231
void sepgsql_schema_drop(Oid namespaceId)
Definition: schema.c:116
bool sepgsql_avc_check_perms(const ObjectAddress *tobject, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
Definition: uavc.c:428
void sepgsql_init_client_label(void)
Definition: label.c:422
char * sepgsql_get_client_label(void)
Definition: label.c:91
void sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum, const char *seclabel)
Definition: relation.c:167
unsigned int Oid
Definition: postgres_ext.h:31
signed int int32
Definition: c.h:246
bool sepgsql_schema_search(Oid namespaceId, bool abort_on_violation)
Definition: schema.c:211
void sepgsql_proc_setattr(Oid functionId)
Definition: proc.c:237
void sepgsql_avc_init(void)
Definition: uavc.c:496
void sepgsql_attribute_setattr(Oid relOid, AttrNumber attnum)
Definition: relation.c:211
unsigned short uint16
Definition: c.h:257
char * sepgsql_avc_trusted_proc(Oid functionId)
Definition: uavc.c:453
int sepgsql_get_mode(void)
Definition: selinux.c:622
void sepgsql_schema_remove_name(Oid namespaceId)
Definition: schema.c:225
void sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum)
Definition: relation.c:45
unsigned int uint32
Definition: c.h:258
char * sepgsql_get_label(Oid relOid, Oid objOid, int32 subId)
Definition: label.c:463
bool sepgsql_get_debug_audit(void)
Definition: hooks.c:76
void sepgsql_proc_relabel(Oid functionId, const char *seclabel)
Definition: proc.c:200
void sepgsql_database_post_create(Oid databaseId, const char *dtemplate)
Definition: database.c:34
void sepgsql_database_drop(Oid databaseId)
Definition: database.c:134
void sepgsql_relation_setattr(Oid relOid)
Definition: relation.c:577
void sepgsql_schema_add_name(Oid namespaceId)
Definition: schema.c:219
void sepgsql_relation_drop(Oid relOid)
Definition: relation.c:418
bool sepgsql_get_permissive(void)
Definition: hooks.c:65
bool sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation)
Definition: dml.c:287
void sepgsql_relation_post_create(Oid relOid)
Definition: relation.c:242
void sepgsql_proc_execute(Oid functionId)
Definition: proc.c:317
bool sepgsql_is_enabled(void)
Definition: selinux.c:613
void sepgsql_schema_post_create(Oid namespaceId)
Definition: schema.c:38
void sepgsql_compute_avd(const char *scontext, const char *tcontext, uint16 tclass, struct av_decision *avd)
Definition: selinux.c:732
void sepgsql_relation_relabel(Oid relOid, const char *seclabel)
Definition: relation.c:526
void sepgsql_audit_log(bool denied, const char *scontext, const char *tcontext, uint16 tclass, uint32 audited, const char *audit_name)
Definition: selinux.c:677
bool sepgsql_check_perms(const char *scontext, const char *tcontext, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
Definition: selinux.c:902
void sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
Definition: label.c:503
Definition: pg_list.h:45
int16 AttrNumber
Definition: attnum.h:21
char * sepgsql_compute_create(const char *scontext, const char *tcontext, uint16 tclass, const char *objname)
Definition: selinux.c:837
void sepgsql_proc_post_create(Oid functionId)
Definition: proc.c:39
void sepgsql_database_setattr(Oid databaseId)
Definition: database.c:161
void sepgsql_database_relabel(Oid databaseId, const char *seclabel)
Definition: database.c:188
void sepgsql_schema_setattr(Oid namespaceId)
Definition: schema.c:204
void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel)
Definition: schema.c:144