Team Ai
Datasetpublic

codekingpro/portable-devtools

sourceHugging Faceupdated 5mo agoView on Hugging Face
1likes15kdownloads
sepgsql.html522 linesDownload Raw Back to html
1<?xml version="1.0" encoding="UTF-8" standalone="no"?>2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>F.40. sepgsql — SELinux-, label-based mandatory access control (MAC) security module</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="seg.html" title="F.39. seg — a datatype for line segments or floating point intervals" /><link rel="next" href="contrib-spi.html" title="F.41. spi — Server Programming Interface features/examples" /></head><body id="docContent" class="container-fluid col-10"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">F.40. sepgsql —3   SELinux-, label-based mandatory access control (MAC) security module</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="seg.html" title="F.39. seg — a datatype for line segments or floating point intervals">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="contrib.html" title="Appendix F. Additional Supplied Modules and Extensions">Up</a></td><th width="60%" align="center">Appendix F. Additional Supplied Modules and Extensions</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="contrib-spi.html" title="F.41. spi — Server Programming Interface features/examples">Next</a></td></tr></table><hr /></div><div class="sect1" id="SEPGSQL"><div class="titlepage"><div><div><h2 class="title" style="clear: both">F.40. sepgsql —4   SELinux-, label-based mandatory access control (MAC) security module <a href="#SEPGSQL" class="id_link">#</a></h2></div></div></div><div class="toc"><dl class="toc"><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-OVERVIEW">F.40.1. Overview</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-INSTALLATION">F.40.2. Installation</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-REGRESSION">F.40.3. Regression Tests</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-PARAMETERS">F.40.4. GUC Parameters</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-FEATURES">F.40.5. Features</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-FUNCTIONS">F.40.6. Sepgsql Functions</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-LIMITATIONS">F.40.7. Limitations</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-RESOURCES">F.40.8. External Resources</a></span></dt><dt><span class="sect2"><a href="sepgsql.html#SEPGSQL-AUTHOR">F.40.9. Author</a></span></dt></dl></div><a id="id-1.11.7.50.2" class="indexterm"></a><p>5  <code class="filename">sepgsql</code> is a loadable module that supports label-based6  mandatory access control (MAC) based on <span class="productname">SELinux</span> security7  policy.8 </p><div class="warning"><h3 class="title">Warning</h3><p>9     The current implementation has significant limitations, and does not10     enforce mandatory access control for all actions.  See11     <a class="xref" href="sepgsql.html#SEPGSQL-LIMITATIONS" title="F.40.7. Limitations">Section F.40.7</a>.12   </p></div><div class="sect2" id="SEPGSQL-OVERVIEW"><div class="titlepage"><div><div><h3 class="title">F.40.1. Overview <a href="#SEPGSQL-OVERVIEW" class="id_link">#</a></h3></div></div></div><p>13   This module integrates with <span class="productname">SELinux</span> to provide an14   additional layer of security checking above and beyond what is normally15   provided by <span class="productname">PostgreSQL</span>.  From the perspective of16   <span class="productname">SELinux</span>, this module allows17   <span class="productname">PostgreSQL</span> to function as a user-space object18   manager.  Each table or function access initiated by a DML query will be19   checked against the system security policy.  This check is in addition to20   the usual SQL permissions checking performed by21   <span class="productname">PostgreSQL</span>.22  </p><p>23   <span class="productname">SELinux</span> access control decisions are made using24   security labels, which are represented by strings such as25   <code class="literal">system_u:object_r:sepgsql_table_t:s0</code>.  Each access control26   decision involves two labels: the label of the subject attempting to27   perform the action, and the label of the object on which the operation is28   to be performed.  Since these labels can be applied to any sort of object,29   access control decisions for objects stored within the database can be30   (and, with this module, are) subjected to the same general criteria used31   for objects of any other type, such as files.  This design is intended to32   allow a centralized security policy to protect information assets33   independent of the particulars of how those assets are stored.34  </p><p>35   The <a class="link" href="sql-security-label.html" title="SECURITY LABEL"><code class="command">SECURITY LABEL</code></a> statement allows assignment of36   a security label to a database object.37  </p></div><div class="sect2" id="SEPGSQL-INSTALLATION"><div class="titlepage"><div><div><h3 class="title">F.40.2. Installation <a href="#SEPGSQL-INSTALLATION" class="id_link">#</a></h3></div></div></div><p>38    <code class="filename">sepgsql</code> can only be used on <span class="productname">Linux</span>39    2.6.28 or higher with <span class="productname">SELinux</span> enabled.40    It is not available on any other platform.  You will also need41    <span class="productname">libselinux</span> 2.1.10 or higher and42    <span class="productname">selinux-policy</span> 3.9.13 or higher (although some43    distributions may backport the necessary rules into older policy44    versions).45  </p><p>46   The <code class="command">sestatus</code> command allows you to check the status of47   <span class="productname">SELinux</span>.  A typical display is:48</p><pre class="screen">49$ sestatus50SELinux status:                 enabled51SELinuxfs mount:                /selinux52Current mode:                   enforcing53Mode from config file:          enforcing54Policy version:                 2455Policy from config file:        targeted56</pre><p>57   If <span class="productname">SELinux</span> is disabled or not installed, you must set58   that product up first before installing this module.59  </p><p>60   To build this module, include the option <code class="literal">--with-selinux</code> in61   your PostgreSQL <code class="literal">configure</code> command.  Be sure that the62   <code class="filename">libselinux-devel</code> RPM is installed at build time.63  </p><p>64   To use this module, you must include <code class="literal">sepgsql</code>65   in the <a class="xref" href="runtime-config-client.html#GUC-SHARED-PRELOAD-LIBRARIES">shared_preload_libraries</a> parameter in66   <code class="filename">postgresql.conf</code>.  The module will not function correctly67   if loaded in any other manner.  Once the module is loaded, you68   should execute <code class="filename">sepgsql.sql</code> in each database.69   This will install functions needed for security label management, and70   assign initial security labels.71  </p><p>72   Here is an example showing how to initialize a fresh database cluster73   with <code class="filename">sepgsql</code> functions and security labels installed.74   Adjust the paths shown as appropriate for your installation:75  </p><pre class="screen">76$ export PGDATA=/path/to/data/directory77$ initdb78$ vi $PGDATA/postgresql.conf79  change80    #shared_preload_libraries = ''                # (change requires restart)81  to82    shared_preload_libraries = 'sepgsql'          # (change requires restart)83$ for DBNAME in template0 template1 postgres; do84    postgres --single -F -c exit_on_error=true $DBNAME \85      &lt;/usr/local/pgsql/share/contrib/sepgsql.sql &gt;/dev/null86  done87</pre><p>88   Please note that you may see some or all of the following notifications89   depending on the particular versions you have of90   <span class="productname">libselinux</span> and <span class="productname">selinux-policy</span>:91</p><pre class="screen">92/etc/selinux/targeted/contexts/sepgsql_contexts:  line 33 has invalid object type db_blobs93/etc/selinux/targeted/contexts/sepgsql_contexts:  line 36 has invalid object type db_language94/etc/selinux/targeted/contexts/sepgsql_contexts:  line 37 has invalid object type db_language95/etc/selinux/targeted/contexts/sepgsql_contexts:  line 38 has invalid object type db_language96/etc/selinux/targeted/contexts/sepgsql_contexts:  line 39 has invalid object type db_language97/etc/selinux/targeted/contexts/sepgsql_contexts:  line 40 has invalid object type db_language98</pre><p>99   These messages are harmless and should be ignored.100  </p><p>101   If the installation process completes without error, you can now start the102   server normally.103  </p></div><div class="sect2" id="SEPGSQL-REGRESSION"><div class="titlepage"><div><div><h3 class="title">F.40.3. Regression Tests <a href="#SEPGSQL-REGRESSION" class="id_link">#</a></h3></div></div></div><p>104   Due to the nature of <span class="productname">SELinux</span>, running the105   regression tests for <code class="filename">sepgsql</code> requires several extra106   configuration steps, some of which must be done as root.107   The regression tests will not be run by an ordinary108   <code class="literal">make check</code> or <code class="literal">make installcheck</code> command; you must109   set up the configuration and then invoke the test script manually.110   The tests must be run in the <code class="filename">contrib/sepgsql</code> directory111   of a configured PostgreSQL build tree.  Although they require a build tree,112   the tests are designed to be executed against an installed server,113   that is they are comparable to <code class="literal">make installcheck</code> not114   <code class="literal">make check</code>.115  </p><p>116   First, set up <code class="filename">sepgsql</code> in a working database117   according to the instructions in <a class="xref" href="sepgsql.html#SEPGSQL-INSTALLATION" title="F.40.2. Installation">Section F.40.2</a>.118   Note that the current operating system user must be able to connect to the119   database as superuser without password authentication.120  </p><p>121   Second, build and install the policy package for the regression test.122   The <code class="filename">sepgsql-regtest</code> policy is a special purpose policy package123   which provides a set of rules to be allowed during the regression tests.124   It should be built from the policy source file125   <code class="filename">sepgsql-regtest.te</code>, which is done using126   <code class="command">make</code> with a Makefile supplied by SELinux.127   You will need to locate the appropriate128   Makefile on your system; the path shown below is only an example.129   (This Makefile is usually supplied by the130   <code class="filename">selinux-policy-devel</code> or131   <code class="filename">selinux-policy</code> RPM.)132   Once built, install this policy package using the133   <code class="command">semodule</code> command, which loads supplied policy packages134   into the kernel.  If the package is correctly installed,135   <code class="literal"><code class="command">semodule</code> -l</code> should list <code class="literal">sepgsql-regtest</code> as an136   available policy package:137  </p><pre class="screen">138$ cd .../contrib/sepgsql139$ make -f /usr/share/selinux/devel/Makefile140$ sudo semodule -u sepgsql-regtest.pp141$ sudo semodule -l | grep sepgsql142sepgsql-regtest 1.07143</pre><p>144   Third, turn on <code class="literal">sepgsql_regression_test_mode</code>.145   For security reasons, the rules in <code class="filename">sepgsql-regtest</code>146   are not enabled by default;147   the <code class="literal">sepgsql_regression_test_mode</code> parameter enables148   the rules needed to launch the regression tests.149   It can be turned on using the <code class="command">setsebool</code> command:150  </p><pre class="screen">151$ sudo setsebool sepgsql_regression_test_mode on152$ getsebool sepgsql_regression_test_mode153sepgsql_regression_test_mode --&gt; on154</pre><p>155   Fourth, verify your shell is operating in the <code class="literal">unconfined_t</code>156   domain:157  </p><pre class="screen">158$ id -Z159unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023160</pre><p>161   See <a class="xref" href="sepgsql.html#SEPGSQL-RESOURCES" title="F.40.8. External Resources">Section F.40.8</a> for details on adjusting your162   working domain, if necessary.163  </p><p>164   Finally, run the regression test script:165  </p><pre class="screen">166$ ./test_sepgsql167</pre><p>168   This script will attempt to verify that you have done all the configuration169   steps correctly, and then it will run the regression tests for the170   <code class="filename">sepgsql</code> module.171  </p><p>172   After completing the tests, it's recommended you disable173   the <code class="literal">sepgsql_regression_test_mode</code> parameter:174  </p><pre class="screen">175$ sudo setsebool sepgsql_regression_test_mode off176</pre><p>177   You might prefer to remove the <code class="filename">sepgsql-regtest</code> policy178   entirely:179  </p><pre class="screen">180$ sudo semodule -r sepgsql-regtest181</pre></div><div class="sect2" id="SEPGSQL-PARAMETERS"><div class="titlepage"><div><div><h3 class="title">F.40.4. GUC Parameters <a href="#SEPGSQL-PARAMETERS" class="id_link">#</a></h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt id="GUC-SEPGSQL-PERMISSIVE"><span class="term">182     <code class="varname">sepgsql.permissive</code> (<code class="type">boolean</code>)183     <a id="id-1.11.7.50.8.2.1.1.3" class="indexterm"></a>184    </span> <a href="#GUC-SEPGSQL-PERMISSIVE" class="id_link">#</a></dt><dd><p>185      This parameter enables <code class="filename">sepgsql</code> to function186      in permissive mode, regardless of the system setting.187      The default is off.188      This parameter can only be set in the <code class="filename">postgresql.conf</code>189      file or on the server command line.190     </p><p>191      When this parameter is on, <code class="filename">sepgsql</code> functions192      in permissive mode, even if SELinux in general is working in enforcing193      mode.  This parameter is primarily useful for testing purposes.194     </p></dd><dt id="GUC-SEPGSQL-DEBUG-AUDIT"><span class="term">195     <code class="varname">sepgsql.debug_audit</code> (<code class="type">boolean</code>)196     <a id="id-1.11.7.50.8.2.2.1.3" class="indexterm"></a>197    </span> <a href="#GUC-SEPGSQL-DEBUG-AUDIT" class="id_link">#</a></dt><dd><p>198      This parameter enables the printing of audit messages regardless of199      the system policy settings.200      The default is off, which means that messages will be printed according201      to the system settings.202     </p><p>203      The security policy of <span class="productname">SELinux</span> also has rules to204      control whether or not particular accesses are logged.205      By default, access violations are logged, but allowed206      accesses are not.207     </p><p>208      This parameter forces all possible logging to be turned on, regardless209      of the system policy.210     </p></dd></dl></div></div><div class="sect2" id="SEPGSQL-FEATURES"><div class="titlepage"><div><div><h3 class="title">F.40.5. Features <a href="#SEPGSQL-FEATURES" class="id_link">#</a></h3></div></div></div><div class="sect3" id="SEPGSQL-FEATURES-CONTROLLED-OBJ-CLASSES"><div class="titlepage"><div><div><h4 class="title">F.40.5.1. Controlled Object Classes <a href="#SEPGSQL-FEATURES-CONTROLLED-OBJ-CLASSES" class="id_link">#</a></h4></div></div></div><p>211    The security model of <span class="productname">SELinux</span> describes all the access212    control rules as relationships between a subject entity (typically,213    a client of the database) and an object entity (such as a database214    object), each of which is215    identified by a security label.  If access to an unlabeled object is216    attempted, the object is treated as if it were assigned the label217    <code class="literal">unlabeled_t</code>.218   </p><p>219    Currently, <code class="filename">sepgsql</code> allows security labels to be220    assigned to schemas, tables, columns, sequences, views, and functions.221    When <code class="filename">sepgsql</code> is in use, security labels are222    automatically assigned to supported database objects at creation time.223    This label is called a default security label, and is decided according224    to the system security policy, which takes as input the creator's label,225    the label assigned to the new object's parent object and optionally name226    of the constructed object.227   </p><p>228    A new database object basically inherits the security label of the parent229    object, except when the security policy has special rules known as230    type-transition rules, in which case a different label may be applied.231    For schemas, the parent object is the current database; for tables,232    sequences, views, and functions, it is the containing schema; for columns,233    it is the containing table.234   </p></div><div class="sect3" id="SEPGSQL-FEATURES-DML-PERMISSIONS"><div class="titlepage"><div><div><h4 class="title">F.40.5.2. DML Permissions <a href="#SEPGSQL-FEATURES-DML-PERMISSIONS" class="id_link">#</a></h4></div></div></div><p>235    For tables, <code class="literal">db_table:select</code>, <code class="literal">db_table:insert</code>,236    <code class="literal">db_table:update</code> or <code class="literal">db_table:delete</code> are237    checked for all the referenced target tables depending on the kind of238    statement; in addition, <code class="literal">db_table:select</code> is also checked for239    all the tables that contain columns referenced in the240    <code class="literal">WHERE</code> or <code class="literal">RETURNING</code> clause, as a data source241    for <code class="literal">UPDATE</code>, and so on.242   </p><p>243    Column-level permissions will also be checked for each referenced column.244    <code class="literal">db_column:select</code> is checked on not only the columns being245    read using <code class="literal">SELECT</code>, but those being referenced in other DML246    statements; <code class="literal">db_column:update</code> or <code class="literal">db_column:insert</code>247    will also be checked for columns being modified by <code class="literal">UPDATE</code> or248    <code class="literal">INSERT</code>.249   </p><p>250   For example, consider:251</p><pre class="synopsis">252UPDATE t1 SET x = 2, y = func1(y) WHERE z = 100;253</pre><p>254 255    Here, <code class="literal">db_column:update</code> will be checked for256    <code class="literal">t1.x</code>, since it is being updated,257    <code class="literal">db_column:{select update}</code> will be checked for258    <code class="literal">t1.y</code>, since it is both updated and referenced, and259    <code class="literal">db_column:select</code> will be checked for <code class="literal">t1.z</code>, since260    it is only referenced.261    <code class="literal">db_table:{select update}</code> will also be checked262    at the table level.263   </p><p>264    For sequences, <code class="literal">db_sequence:get_value</code> is checked when we265    reference a sequence object using <code class="literal">SELECT</code>; however, note that we266    do not currently check permissions on execution of corresponding functions267    such as <code class="literal">lastval()</code>.268   </p><p>269    For views, <code class="literal">db_view:expand</code> will be checked, then any other270    required permissions will be checked on the objects being271    expanded from the view, individually.272   </p><p>273    For functions, <code class="literal">db_procedure:{execute}</code> will be checked when274    user tries to execute a function as a part of query, or using fast-path275    invocation. If this function is a trusted procedure, it also checks276    <code class="literal">db_procedure:{entrypoint}</code> permission to check whether it277    can perform as entry point of trusted procedure.278   </p><p>279    In order to access any schema object, <code class="literal">db_schema:search</code>280    permission is required on the containing schema.  When an object is281    referenced without schema qualification, schemas on which this282    permission is not present will not be searched (just as if the user did283    not have <code class="literal">USAGE</code> privilege on the schema).  If an explicit schema284    qualification is present, an error will occur if the user does not have285    the requisite permission on the named schema.286   </p><p>287    The client must be allowed to access all referenced tables and288    columns, even if they originated from views which were then expanded,289    so that we apply consistent access control rules independent of the manner290    in which the table contents are referenced.291   </p><p>292    The default database privilege system allows database superusers to293    modify system catalogs using DML commands, and reference or modify294    toast tables.  These operations are prohibited when295    <code class="filename">sepgsql</code> is enabled.296   </p></div><div class="sect3" id="SEPGSQL-FEATURES-DDL-PERMISSIONS"><div class="titlepage"><div><div><h4 class="title">F.40.5.3. DDL Permissions <a href="#SEPGSQL-FEATURES-DDL-PERMISSIONS" class="id_link">#</a></h4></div></div></div><p>297    <span class="productname">SELinux</span> defines several permissions to control common298    operations for each object type; such as creation, alter, drop and299    relabel of security label. In addition, several object types have300    special permissions to control their characteristic operations; such as301    addition or deletion of name entries within a particular schema.302   </p><p>303    Creating a new database object requires <code class="literal">create</code> permission.304    <span class="productname">SELinux</span> will grant or deny this permission based on the305    client's security label and the proposed security label for the new306    object.  In some cases, additional privileges are required:307   </p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>308      <a class="link" href="sql-createdatabase.html" title="CREATE DATABASE"><code class="command">CREATE DATABASE</code></a> additionally requires309      <code class="literal">getattr</code> permission for the source or template database.310     </p></li><li class="listitem"><p>311      Creating a schema object additionally requires <code class="literal">add_name</code>312      permission on the parent schema.313     </p></li><li class="listitem"><p>314      Creating a table additionally requires permission to create each315      individual table column, just as if each table column were a316      separate top-level object.317     </p></li><li class="listitem"><p>318      Creating a function marked as <code class="literal">LEAKPROOF</code> additionally319      requires <code class="literal">install</code> permission.  (This permission is also320      checked when <code class="literal">LEAKPROOF</code> is set for an existing function.)321     </p></li></ul></div><p>322    When <code class="literal">DROP</code> command is executed, <code class="literal">drop</code> will be323    checked on the object being removed.  Permissions will be also checked for324    objects dropped indirectly via <code class="literal">CASCADE</code>.  Deletion of objects325    contained within a particular schema (tables, views, sequences and326    procedures) additionally requires <code class="literal">remove_name</code> on the schema.327   </p><p>328    When <code class="literal">ALTER</code> command is executed, <code class="literal">setattr</code> will be329    checked on the object being modified for each object types, except for330    subsidiary objects such as the indexes or triggers of a table, where331    permissions are instead checked on the parent object.  In some cases,332    additional permissions are required:333   </p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>334      Moving an object to a new schema additionally requires335      <code class="literal">remove_name</code> permission on the old schema and336      <code class="literal">add_name</code> permission on the new one.337     </p></li><li class="listitem"><p>338      Setting the <code class="literal">LEAKPROOF</code> attribute on a function requires339      <code class="literal">install</code> permission.340     </p></li><li class="listitem"><p>341      Using <a class="link" href="sql-security-label.html" title="SECURITY LABEL"><code class="command">SECURITY LABEL</code></a> on an object additionally342      requires <code class="literal">relabelfrom</code> permission for the object in343      conjunction with its old security label and <code class="literal">relabelto</code>344      permission for the object in conjunction with its new security label.345      (In cases where multiple label providers are installed and the user346      tries to set a security label, but it is not managed by347      <span class="productname">SELinux</span>, only <code class="literal">setattr</code> should be checked here.348      This is currently not done due to implementation restrictions.)349     </p></li></ul></div></div><div class="sect3" id="SEPGSQL-FEATURES-TRUSTED-PROCEDURES"><div class="titlepage"><div><div><h4 class="title">F.40.5.4. Trusted Procedures <a href="#SEPGSQL-FEATURES-TRUSTED-PROCEDURES" class="id_link">#</a></h4></div></div></div><p>350    Trusted procedures are similar to security definer functions or setuid351    commands. <span class="productname">SELinux</span> provides a feature to allow trusted352    code to run using a security label different from that of the client,353    generally for the purpose of providing highly controlled access to354    sensitive data (e.g., rows might be omitted, or the precision of stored355    values might be reduced).  Whether or not a function acts as a trusted356    procedure is controlled by its security label and the operating system357    security policy.  For example:358   </p><pre class="screen">359postgres=# CREATE TABLE customer (360               cid     int primary key,361               cname   text,362               credit  text363           );364CREATE TABLE365postgres=# SECURITY LABEL ON COLUMN customer.credit366               IS 'system_u:object_r:sepgsql_secret_table_t:s0';367SECURITY LABEL368postgres=# CREATE FUNCTION show_credit(int) RETURNS text369             AS 'SELECT regexp_replace(credit, ''-[0-9]+$'', ''-xxxx'', ''g'')370                        FROM customer WHERE cid = $1'371           LANGUAGE sql;372CREATE FUNCTION373postgres=# SECURITY LABEL ON FUNCTION show_credit(int)374               IS 'system_u:object_r:sepgsql_trusted_proc_exec_t:s0';375SECURITY LABEL376</pre><p>377    The above operations should be performed by an administrative user.378   </p><pre class="screen">379postgres=# SELECT * FROM customer;380ERROR:  SELinux: security policy violation381postgres=# SELECT cid, cname, show_credit(cid) FROM customer;382 cid | cname  |     show_credit383-----+--------+---------------------384   1 | taro   | 1111-2222-3333-xxxx385   2 | hanako | 5555-6666-7777-xxxx386(2 rows)387</pre><p>388    In this case, a regular user cannot reference <code class="literal">customer.credit</code>389    directly, but a trusted procedure <code class="literal">show_credit</code> allows the user390    to print the credit card numbers of customers with some of the digits391    masked out.392   </p></div><div class="sect3" id="SEPGSQL-FEATURES-DYNAMIC-DOMAIN-TRANSITIONS"><div class="titlepage"><div><div><h4 class="title">F.40.5.5. Dynamic Domain Transitions <a href="#SEPGSQL-FEATURES-DYNAMIC-DOMAIN-TRANSITIONS" class="id_link">#</a></h4></div></div></div><p>393    It is possible to use SELinux's dynamic domain transition feature394    to switch the security label of the client process, the client domain,395    to a new context, if that is allowed by the security policy.396    The client domain needs the <code class="literal">setcurrent</code> permission and also397    <code class="literal">dyntransition</code> from the old to the new domain.398   </p><p>399    Dynamic domain transitions should be considered carefully, because they400    allow users to switch their label, and therefore their privileges,401    at their option, rather than (as in the case of a trusted procedure)402    as mandated by the system.403    Thus, the <code class="literal">dyntransition</code> permission is only considered404    safe when used to switch to a domain with a smaller set of privileges than405    the original one. For example:406   </p><pre class="screen">407regression=# select sepgsql_getcon();408                    sepgsql_getcon409-------------------------------------------------------410 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023411(1 row)412 413regression=# SELECT sepgsql_setcon('unconfined_u:unconfined_r:unconfined_t:s0-s0:c1.c4');414 sepgsql_setcon415----------------416 t417(1 row)418 419regression=# SELECT sepgsql_setcon('unconfined_u:unconfined_r:unconfined_t:s0-s0:c1.c1023');420ERROR:  SELinux: security policy violation421</pre><p>422    In this example above we were allowed to switch from the larger MCS423    range <code class="literal">c1.c1023</code> to the smaller range <code class="literal">c1.c4</code>, but424    switching back was denied.425   </p><p>426    A combination of dynamic domain transition and trusted procedure427    enables an interesting use case that fits the typical process life-cycle428    of connection pooling software.429    Even if your connection pooling software is not allowed to run most430    of SQL commands, you can allow it to switch the security label431    of the client using the <code class="literal">sepgsql_setcon()</code> function432    from within a trusted procedure; that should take some433    credential to authorize the request to switch the client label.434    After that, this session will have the privileges of the target user,435    rather than the connection pooler.436    The connection pooler can later revert the security label change by437    again using <code class="literal">sepgsql_setcon()</code> with438    <code class="literal">NULL</code> argument, again invoked from within a trusted439    procedure with appropriate permissions checks.440    The point here is that only the trusted procedure actually has permission441    to change the effective security label, and only does so when given proper442    credentials.  Of course, for secure operation, the credential store443    (table, procedure definition, or whatever) must be protected from444    unauthorized access.445   </p></div><div class="sect3" id="SEPGSQL-FEATURES-MISC"><div class="titlepage"><div><div><h4 class="title">F.40.5.6. Miscellaneous <a href="#SEPGSQL-FEATURES-MISC" class="id_link">#</a></h4></div></div></div><p>446    We reject the <a class="link" href="sql-load.html" title="LOAD"><code class="command">LOAD</code></a> command across the board, because447    any module loaded could easily circumvent security policy enforcement.448   </p></div></div><div class="sect2" id="SEPGSQL-FUNCTIONS"><div class="titlepage"><div><div><h3 class="title">F.40.6. Sepgsql Functions <a href="#SEPGSQL-FUNCTIONS" class="id_link">#</a></h3></div></div></div><p>449   <a class="xref" href="sepgsql.html#SEPGSQL-FUNCTIONS-TABLE" title="Table F.31. Sepgsql Functions">Table F.31</a> shows the available functions.450  </p><div class="table" id="SEPGSQL-FUNCTIONS-TABLE"><p class="title"><strong>Table F.31. Sepgsql Functions</strong></p><div class="table-contents"><table class="table" summary="Sepgsql Functions" border="1"><colgroup><col /></colgroup><thead><tr><th class="func_table_entry"><p class="func_signature">451        Function452       </p>453       <p>454        Description455       </p></th></tr></thead><tbody><tr><td class="func_table_entry"><p class="func_signature">456        <code class="function">sepgsql_getcon</code> ()457        → <code class="returnvalue">text</code>458       </p>459       <p>460        Returns the client domain, the current security label of the client.461       </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">462        <code class="function">sepgsql_setcon</code> ( <code class="type">text</code> )463        → <code class="returnvalue">boolean</code>464       </p>465       <p>466        Switches the client domain of the current session to the new domain,467        if allowed by the security policy.468        It also accepts <code class="literal">NULL</code> input as a request to transition469        to the client's original domain.470       </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">471        <code class="function">sepgsql_mcstrans_in</code> ( <code class="type">text</code> )472        → <code class="returnvalue">text</code>473       </p>474       <p>475        Translates the given qualified MLS/MCS range into raw format if476        the mcstrans daemon is running.477       </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">478        <code class="function">sepgsql_mcstrans_out</code> ( <code class="type">text</code> )479        → <code class="returnvalue">text</code>480       </p>481       <p>482        Translates the given raw MLS/MCS range into qualified format if483        the mcstrans daemon is running.484       </p></td></tr><tr><td class="func_table_entry"><p class="func_signature">485        <code class="function">sepgsql_restorecon</code> ( <code class="type">text</code> )486        → <code class="returnvalue">boolean</code>487       </p>488       <p>489        Sets up initial security labels for all objects within the490        current database. The argument may be <code class="literal">NULL</code>, or the491        name of a specfile to be used as alternative of the system default.492       </p></td></tr></tbody></table></div></div><br class="table-break" /></div><div class="sect2" id="SEPGSQL-LIMITATIONS"><div class="titlepage"><div><div><h3 class="title">F.40.7. Limitations <a href="#SEPGSQL-LIMITATIONS" class="id_link">#</a></h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term">Data Definition Language (DDL) Permissions</span></dt><dd><p>493      Due to implementation restrictions, some DDL operations do not494      check permissions.495     </p></dd><dt><span class="term">Data Control Language (DCL) Permissions</span></dt><dd><p>496      Due to implementation restrictions, DCL operations do not check497      permissions.498     </p></dd><dt><span class="term">Row-level access control</span></dt><dd><p>499      <span class="productname">PostgreSQL</span> supports row-level access, but500      <code class="filename">sepgsql</code> does not.501     </p></dd><dt><span class="term">Covert channels</span></dt><dd><p>502      <code class="filename">sepgsql</code> does not try to hide the existence of503      a certain object, even if the user is not allowed to reference it.504      For example, we can infer the existence of an invisible object as505      a result of primary key conflicts, foreign key violations, and so on,506      even if we cannot obtain the contents of the object.  The existence507      of a top secret table cannot be hidden; we only hope to conceal its508      contents.509     </p></dd></dl></div></div><div class="sect2" id="SEPGSQL-RESOURCES"><div class="titlepage"><div><div><h3 class="title">F.40.8. External Resources <a href="#SEPGSQL-RESOURCES" class="id_link">#</a></h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term"><a class="ulink" href="https://wiki.postgresql.org/wiki/SEPostgreSQL" target="_top">SE-PostgreSQL Introduction</a></span></dt><dd><p>510      This wiki page provides a brief overview, security design, architecture,511      administration and upcoming features.512     </p></dd><dt><span class="term"><a class="ulink" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/index" target="_top">SELinux User's and Administrator's Guide</a></span></dt><dd><p>513      This document provides a wide spectrum of knowledge to administer514      <span class="productname">SELinux</span> on your systems.515      It focuses primarily on Red Hat operating systems, but is not limited to them.516     </p></dd><dt><span class="term"><a class="ulink" href="https://fedoraproject.org/wiki/SELinux_FAQ" target="_top">Fedora SELinux FAQ</a></span></dt><dd><p>517      This document answers frequently asked questions about518      <span class="productname">SELinux</span>.519      It focuses primarily on Fedora, but is not limited to Fedora.520     </p></dd></dl></div></div><div class="sect2" id="SEPGSQL-AUTHOR"><div class="titlepage"><div><div><h3 class="title">F.40.9. Author <a href="#SEPGSQL-AUTHOR" class="id_link">#</a></h3></div></div></div><p>521   KaiGai Kohei <code class="email">&lt;<a class="email" href="mailto:kaigai@ak.jp.nec.com">kaigai@ak.jp.nec.com</a>&gt;</code>522  </p></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="seg.html" title="F.39. seg — a datatype for line segments or floating point intervals">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="contrib.html" title="Appendix F. Additional Supplied Modules and Extensions">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="contrib-spi.html" title="F.41. spi — Server Programming Interface features/examples">Next</a></td></tr><tr><td width="40%" align="left" valign="top">F.39. seg — a datatype for line segments or floating point intervals </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="40%" align="right" valign="top"> F.41. spi — Server Programming Interface features/examples</td></tr></table></div></body></html>
codekingpro/portable-devtools · Team Ai