13#include <selinux/label.h>
32#include "utils/fmgroids.h"
112 const char *tcontext;
121 if (security_check_context_raw(new_label) < 0)
123 (
errcode(ERRCODE_INVALID_NAME),
124 errmsg(
"SELinux: invalid security label: \"%s\"",
126 tcontext = new_label;
214 if (plabel->
subid == mySubid)
232 (*next_client_auth_hook) (
port, status);
246 (
errcode(ERRCODE_INTERNAL_ERROR),
247 errmsg(
"SELinux: unable to get peer label: %m")));
290 object.
classId = ProcedureRelationId;
291 object.objectId = functionId;
292 object.objectSubId = 0;
329 stack =
palloc(
sizeof(*stack));
330 stack->old_label = NULL;
332 stack->next_private = 0;
346 if (stack->new_label)
350 object.
classId = ProcedureRelationId;
351 object.objectId = flinfo->
fn_oid;
352 object.objectSubId = 0;
366 Assert(!stack->old_label);
367 if (stack->new_label)
373 (*next_fmgr_hook) (event, flinfo, &stack->next_private);
381 (*next_fmgr_hook) (event, flinfo, &stack->next_private);
383 if (stack->new_label)
386 stack->old_label = NULL;
391 elog(
ERROR,
"unexpected event type: %d", (
int) event);
417 (
errcode(ERRCODE_INTERNAL_ERROR),
418 errmsg(
"SELinux: failed to get server security label: %m")));
449 object.classId = classId;
450 object.objectId = objectId;
451 object.objectSubId = subId;
454 if (!
label || security_check_context_raw(
label))
458 if (security_get_initial_context_raw(
"unlabeled", &unlabeled) < 0)
460 (
errcode(ERRCODE_INTERNAL_ERROR),
461 errmsg(
"SELinux: failed to get initial security label: %m")));
488 security_check_context_raw(seclabel) < 0)
490 (
errcode(ERRCODE_INVALID_NAME),
491 errmsg(
"SELinux: invalid security label: \"%s\"", seclabel)));
498 case DatabaseRelationId:
502 case NamespaceRelationId:
506 case RelationRelationId:
516 case ProcedureRelationId:
522 (
errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
523 errmsg(
"sepgsql provider does not support labels on %s",
557 const char *new_label;
585 (
errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
586 errmsg(
"sepgsql is not enabled")));
591 (
errcode(ERRCODE_INTERNAL_ERROR),
592 errmsg(
"SELinux: could not translate security label: %m")));
623 (
errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
624 errmsg(
"sepgsql is not currently enabled")));
629 (
errcode(ERRCODE_INTERNAL_ERROR),
630 errmsg(
"SELinux: could not translate security label: %m")));
653 const char *src3,
const char *src4)
683 char *namespace_name;
713 case DatabaseRelationId:
716 objtype = SELABEL_DB_DATABASE;
721 object.classId = DatabaseRelationId;
722 object.objectId = datForm->oid;
723 object.objectSubId = 0;
726 case NamespaceRelationId:
729 objtype = SELABEL_DB_SCHEMA;
735 object.classId = NamespaceRelationId;
736 object.objectId = nspForm->oid;
737 object.objectSubId = 0;
740 case RelationRelationId:
743 if (relForm->relkind == RELKIND_RELATION ||
744 relForm->relkind == RELKIND_PARTITIONED_TABLE)
745 objtype = SELABEL_DB_TABLE;
746 else if (relForm->relkind == RELKIND_SEQUENCE)
747 objtype = SELABEL_DB_SEQUENCE;
748 else if (relForm->relkind == RELKIND_VIEW)
749 objtype = SELABEL_DB_VIEW;
758 pfree(namespace_name);
760 object.classId = RelationRelationId;
761 object.objectId = relForm->oid;
762 object.objectSubId = 0;
765 case AttributeRelationId:
772 objtype = SELABEL_DB_COLUMN;
781 pfree(namespace_name);
782 pfree(relation_name);
784 object.classId = RelationRelationId;
785 object.objectId = attForm->attrelid;
786 object.objectSubId = attForm->attnum;
789 case ProcedureRelationId:
792 objtype = SELABEL_DB_PROCEDURE;
799 pfree(namespace_name);
801 object.classId = ProcedureRelationId;
802 object.objectId = proForm->oid;
803 object.objectSubId = 0;
807 elog(
ERROR,
"unexpected catalog id: %u", catalogId);
812 if (selabel_lookup_raw(sehnd, &context, objname, objtype) == 0)
830 else if (errno == ENOENT)
832 (
errmsg(
"SELinux: no initial label assigned for %s (type=%d), skipping",
836 (
errcode(ERRCODE_INTERNAL_ERROR),
837 errmsg(
"SELinux: could not determine initial security label for %s (type=%d): %m", objname, objtype)));
861 struct selabel_handle *sehnd;
862 struct selinux_opt seopts;
869 (
errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
870 errmsg(
"sepgsql is not currently enabled")));
878 (
errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
879 errmsg(
"SELinux: must be superuser to restore initial contexts")));
887 seopts.type = SELABEL_OPT_UNUSED;
892 seopts.type = SELABEL_OPT_PATH;
895 sehnd = selabel_open(SELABEL_CTX_DB, &seopts, 1);
898 (
errcode(ERRCODE_INTERNAL_ERROR),
899 errmsg(
"SELinux: failed to initialize labeling handle: %m")));
910 selabel_close(sehnd);
ClientAuthentication_hook_type ClientAuthentication_hook
void(* ClientAuthentication_hook_type)(Port *, int)
#define TextDatumGetCString(d)
void sepgsql_proc_relabel(Oid functionId, const char *seclabel)
void sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum, const char *seclabel)
void sepgsql_relation_relabel(Oid relOid, const char *seclabel)
void sepgsql_database_relabel(Oid databaseId, const char *seclabel)
int errcode(int sqlerrcode)
int errmsg(const char *fmt,...)
#define ereport(elevel,...)
PGDLLIMPORT needs_fmgr_hook_type needs_fmgr_hook
PGDLLIMPORT fmgr_hook_type fmgr_hook
#define PG_GETARG_TEXT_PP(n)
bool(* needs_fmgr_hook_type)(Oid fn_oid)
#define PG_GETARG_DATUM(n)
#define PG_RETURN_TEXT_P(x)
void(* fmgr_hook_type)(FmgrHookEventType event, FmgrInfo *flinfo, Datum *arg)
#define PG_RETURN_BOOL(x)
void systable_endscan(SysScanDesc sysscan)
HeapTuple systable_getnext(SysScanDesc sysscan)
SysScanDesc systable_beginscan(Relation heapRelation, Oid indexId, bool indexOK, Snapshot snapshot, int nkeys, ScanKey key)
Assert(PointerIsAligned(start, uint64))
bool sepgsql_get_permissive(void)
#define HeapTupleIsValid(tuple)
static void * GETSTRUCT(const HeapTupleData *tuple)
Datum sepgsql_getcon(PG_FUNCTION_ARGS)
static fmgr_hook_type next_fmgr_hook
static void sepgsql_fmgr_hook(FmgrHookEventType event, FmgrInfo *flinfo, Datum *private)
void sepgsql_init_client_label(void)
static char * client_label_committed
static needs_fmgr_hook_type next_needs_fmgr_hook
static char * quote_object_name(const char *src1, const char *src2, const char *src3, const char *src4)
Datum sepgsql_mcstrans_out(PG_FUNCTION_ARGS)
static void exec_object_restorecon(struct selabel_handle *sehnd, Oid catalogId)
PG_FUNCTION_INFO_V1(sepgsql_getcon)
static char * client_label_peer
static List * client_label_pending
char * sepgsql_get_label(Oid classId, Oid objectId, int32 subId)
void sepgsql_object_relabel(const ObjectAddress *object, const char *seclabel)
Datum sepgsql_restorecon(PG_FUNCTION_ARGS)
static void sepgsql_subxact_callback(SubXactEvent event, SubTransactionId mySubid, SubTransactionId parentSubid, void *arg)
static void sepgsql_client_auth(Port *port, int status)
static char * client_label_func
char * sepgsql_get_client_label(void)
static void sepgsql_xact_callback(XactEvent event, void *arg)
Datum sepgsql_setcon(PG_FUNCTION_ARGS)
static ClientAuthentication_hook_type next_client_auth_hook
Datum sepgsql_mcstrans_in(PG_FUNCTION_ARGS)
static void sepgsql_set_client_label(const char *new_label)
static bool sepgsql_needs_fmgr_hook(Oid functionId)
List * lappend(List *list, void *datum)
char * get_rel_name(Oid relid)
char * get_database_name(Oid dbid)
char get_rel_relkind(Oid relid)
Oid get_rel_namespace(Oid relid)
char * get_namespace_name(Oid nspid)
char * MemoryContextStrdup(MemoryContext context, const char *string)
char * pstrdup(const char *in)
void pfree(void *pointer)
void * palloc0(Size size)
MemoryContext TopMemoryContext
MemoryContext CurTransactionContext
char * getObjectTypeDescription(const ObjectAddress *object, bool missing_ok)
char * getObjectDescription(const ObjectAddress *object, bool missing_ok)
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
FormData_pg_attribute * Form_pg_attribute
FormData_pg_class * Form_pg_class
FormData_pg_database * Form_pg_database
#define foreach_delete_current(lst, var_or_cell)
FormData_pg_namespace * Form_pg_namespace
FormData_pg_proc * Form_pg_proc
static Datum PointerGetDatum(const void *X)
static Pointer DatumGetPointer(Datum X)
const char * quote_identifier(const char *ident)
void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel)
void SetSecurityLabel(const ObjectAddress *object, const char *provider, const char *label)
char * GetSecurityLabel(const ObjectAddress *object, const char *provider)
int sepgsql_set_mode(int new_mode)
bool sepgsql_is_enabled(void)
char * sepgsql_avc_trusted_proc(Oid functionId)
bool sepgsql_avc_check_perms_label(const char *tcontext, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
#define SEPG_DB_PROCEDURE__EXECUTE
#define SEPG_PROCESS__SETCURRENT
#define SEPG_PROCESS__TRANSITION
#define SEPG_PROCESS__DYNTRANSITION
#define SEPG_DB_PROCEDURE__ENTRYPOINT
#define SEPG_CLASS_DB_PROCEDURE
#define SEPGSQL_AVC_NOAUDIT
#define SEPGSQL_LABEL_TAG
#define SEPGSQL_MODE_DEFAULT
#define SEPG_CLASS_PROCESS
#define SEPGSQL_MODE_PERMISSIVE
bool sepgsql_avc_check_perms(const ObjectAddress *tobject, uint16 tclass, uint32 required, const char *audit_name, bool abort_on_violation)
void appendStringInfo(StringInfo str, const char *fmt,...)
void appendStringInfoString(StringInfo str, const char *s)
void initStringInfo(StringInfo str)
void table_close(Relation relation, LOCKMODE lockmode)
Relation table_open(Oid relationId, LOCKMODE lockmode)
text * cstring_to_text(const char *s)
char * text_to_cstring(const text *t)
SubTransactionId GetCurrentSubTransactionId(void)
void RegisterXactCallback(XactCallback callback, void *arg)
void RegisterSubXactCallback(SubXactCallback callback, void *arg)
@ SUBXACT_EVENT_ABORT_SUB