diff --git a/Changelog b/Changelog index ea38d6e..13dbcb9 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- SE-Postgresql policy from KaiGai Kohei. - Patch for X.org dbus support from Martin Orr. - Patch for labeled networking controls in 2.6.25 from Paul Moore. - Module loading now requires setsched on kernel threads. diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if index 6142c2d..270a0c4 100644 --- a/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if @@ -2553,6 +2553,35 @@ interface(`kernel_dontaudit_recvfrom_unlabeled_peer',` ######################################## ## +## Relabel from unlabeled database objects. +## +## +## +## Domain allowed access. +## +## +# +interface(`kernel_relabelfrom_unlabeled_database',` + gen_require(` + type unlabeled_t; + class db_database { setattr relabelfrom }; + class db_table { setattr relabelfrom }; + class db_procedure { setattr relabelfrom }; + class db_column { setattr relabelfrom }; + class db_tuple { update relabelfrom }; + class db_blob { setattr relabelfrom }; + ') + + allow $1 unlabeled_t:db_database { setattr relabelfrom }; + allow $1 unlabeled_t:db_table { setattr relabelfrom }; + allow $1 unlabeled_t:db_procedure { setattr relabelfrom }; + allow $1 unlabeled_t:db_column { setattr relabelfrom }; + allow $1 unlabeled_t:db_tuple { update relabelfrom }; + allow $1 unlabeled_t:db_blob { setattr relabelfrom }; +') + +######################################## +## ## Unconfined access to kernel module resources. ## ## diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 8db65d2..c02fb42 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -1,5 +1,5 @@ -policy_module(kernel,1.9.4) +policy_module(kernel,1.9.5) ######################################## # diff --git a/policy/modules/services/apache.if b/policy/modules/services/apache.if index 5bc5074..085f250 100644 --- a/policy/modules/services/apache.if +++ b/policy/modules/services/apache.if @@ -226,6 +226,10 @@ template(`apache_content_template',` ') optional_policy(` + postgresql_unpriv_client(httpd_$1_script_t) + ') + + optional_policy(` nscd_socket_use(httpd_$1_script_t) ') ') diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te index b263dbb..1513b13 100644 --- a/policy/modules/services/apache.te +++ b/policy/modules/services/apache.te @@ -1,5 +1,5 @@ -policy_module(apache,1.9.1) +policy_module(apache,1.9.2) # # NOTES: @@ -475,6 +475,7 @@ optional_policy(` optional_policy(` # Allow httpd to work with postgresql postgresql_stream_connect(httpd_t) + postgresql_unpriv_client(httpd_t) tunable_policy(`httpd_can_network_connect_db',` postgresql_tcp_connect(httpd_t) diff --git a/policy/modules/services/postgresql.fc b/policy/modules/services/postgresql.fc index 0e9fed1..ea8c80f 100644 --- a/policy/modules/services/postgresql.fc +++ b/policy/modules/services/postgresql.fc @@ -6,8 +6,8 @@ # # /usr # -/usr/bin/initdb -- gen_context(system_u:object_r:postgresql_exec_t,s0) -/usr/bin/postgres -- gen_context(system_u:object_r:postgresql_exec_t,s0) +/usr/bin/initdb(\.sepgsql)? -- gen_context(system_u:object_r:postgresql_exec_t,s0) +/usr/bin/(se)?postgres -- gen_context(system_u:object_r:postgresql_exec_t,s0) /usr/lib/pgsql/test/regres(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0) /usr/lib/pgsql/test/regress/pg_regress -- gen_context(system_u:object_r:postgresql_exec_t,s0) @@ -30,8 +30,12 @@ ifdef(`distro_redhat', ` /var/lib/pgsql/data(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0) /var/lib/pgsql/pgstartup\.log gen_context(system_u:object_r:postgresql_log_t,s0) +/var/lib/sepgsql(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0) +/var/lib/sepgsql/pgstartup\.log -- gen_context(system_u:object_r:postgresql_log_t,s0) + /var/log/postgres\.log.* -- gen_context(system_u:object_r:postgresql_log_t,s0) /var/log/postgresql(/.*)? gen_context(system_u:object_r:postgresql_log_t,s0) +/var/log/sepostgresql\.log.* -- gen_context(system_u:object_r:postgresql_log_t,s0) ifdef(`distro_redhat', ` /var/log/rhdb/rhdb(/.*)? gen_context(system_u:object_r:postgresql_log_t,s0) diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if index a2caefa..7fbba93 100644 --- a/policy/modules/services/postgresql.if +++ b/policy/modules/services/postgresql.if @@ -1,5 +1,206 @@ ## PostgreSQL relational database +####################################### +## +## The userdomain template for the SE-PostgreSQL. +## +## +## This template creates a delivered types which are used +## for given userdomains. +## +## +## +## The prefix of the user domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## The type of the user domain. +## +## +## +## +## The role associated with the user domain. +## +## +# +template(`postgresql_userdom_template',` + gen_require(` + class db_database all_db_database_perms; + class db_table all_db_table_perms; + class db_procedure all_db_procedure_perms; + class db_column all_db_column_perms; + class db_tuple all_db_tuple_perms; + class db_blob all_db_blob_perms; + + attribute sepgsql_client_type, sepgsql_database_type; + attribute sepgsql_sysobj_table_type; + + type sepgsql_trusted_proc_t, sepgsql_trusted_domain_t; + ') + + ######################################## + # + # Declarations + # + + typeattribute $2 sepgsql_client_type; + + type $1_sepgsql_blob_t; + postgresql_blob_object($1_sepgsql_blob_t) + + type $1_sepgsql_proc_t; + postgresql_procedure_object($1_sepgsql_proc_t) + + type $1_sepgsql_sysobj_t; + postgresql_system_table_object($1_sepgsql_sysobj_t) + + type $1_sepgsql_table_t; + postgresql_table_object($1_sepgsql_table_t) + + role $3 types sepgsql_trusted_domain_t; + + ############################## + # + # Client local policy + # + + tunable_policy(`sepgsql_enable_users_ddl',` + allow $2 $1_sepgsql_table_t : db_table { create drop }; + type_transition $2 sepgsql_database_type:db_table $1_sepgsql_table_t; + + allow $2 $1_sepgsql_table_t : db_column { create drop }; + + allow $2 $1_sepgsql_sysobj_t : db_tuple { update insert delete }; + type_transition $2 sepgsql_sysobj_table_type:db_tuple $1_sepgsql_sysobj_t; + ') + + allow $2 $1_sepgsql_table_t : db_table { getattr setattr use select update insert delete }; + allow $2 $1_sepgsql_table_t : db_column { getattr setattr use select update insert }; + allow $2 $1_sepgsql_table_t : db_tuple { use select update insert delete }; + allow $2 $1_sepgsql_sysobj_t : db_tuple { use select }; + + allow $2 $1_sepgsql_proc_t : db_procedure { create drop getattr setattr execute }; + type_transition $2 sepgsql_database_type:db_procedure $1_sepgsql_proc_t; + + allow $2 $1_sepgsql_blob_t : db_blob { create drop getattr setattr read write }; + type_transition $2 sepgsql_database_type:db_blob $1_sepgsql_blob_t; + + allow $2 sepgsql_trusted_domain_t:process transition; + type_transition $2 sepgsql_trusted_proc_t:process sepgsql_trusted_domain_t; +') + +######################################## +## +## Marks as a SE-PostgreSQL loadable shared library module +## +## +## +## Type marked as a database object type. +## +## +# +interface(`postgresql_loadable_module',` + gen_require(` + attribute sepgsql_module_type; + ') + + typeattribute $1 sepgsql_module_type; +') + +######################################## +## +## Marks as a SE-PostgreSQL database object type +## +## +## +## Type marked as a database object type. +## +## +# +interface(`postgresql_database_object',` + gen_require(` + attribute sepgsql_database_type; + ') + + typeattribute $1 sepgsql_database_type; +') + +######################################## +## +## Marks as a SE-PostgreSQL table/column/tuple object type +## +## +## +## Type marked as a table/column/tuple object type. +## +## +# +interface(`postgresql_table_object',` + gen_require(` + attribute sepgsql_table_type; + ') + + typeattribute $1 sepgsql_table_type; +') + +######################################## +## +## Marks as a SE-PostgreSQL system table/column/tuple object type +## +## +## +## Type marked as a table/column/tuple object type. +## +## +# +interface(`postgresql_system_table_object',` + gen_require(` + attribute sepgsql_table_type; + attribute sepgsql_sysobj_table_type; + ') + + typeattribute $1 sepgsql_table_type; + typeattribute $1 sepgsql_sysobj_table_type; +') + +######################################## +## +## Marks as a SE-PostgreSQL procedure object type +## +## +## +## Type marked as a database object type. +## +## +# +interface(`postgresql_procedure_object',` + gen_require(` + attribute sepgsql_procedure_type; + ') + + typeattribute $1 sepgsql_procedure_type; +') + +######################################## +## +## Marks as a SE-PostgreSQL binary large object type +## +## +## +## Type marked as a database binary large object type. +## +## +# +interface(`postgresql_blob_object',` + gen_require(` + attribute sepgsql_blob_type; + ') + + typeattribute $1 sepgsql_blob_type; +') + ######################################## ## ## Allow the specified domain to search postgresql's database directory. @@ -120,3 +321,57 @@ interface(`postgresql_stream_connect',` # Some versions of postgresql put the sock file in /tmp allow $1 postgresql_tmp_t:sock_file write; ') + +######################################## +## +## Allow the specified domain unprivileged accesses to unifined database objects +## managed by SE-PostgreSQL, +## +## +## +## Domain allowed access. +## +## +# +interface(`postgresql_unpriv_client',` + gen_require(` + class db_table all_db_table_perms; + class db_procedure all_db_procedure_perms; + class db_blob all_db_blob_perms; + + attribute sepgsql_client_type; + attribute sepgsql_database_type; + + type sepgsql_table_t, sepgsql_proc_t, sepgsql_blob_t; + + type sepgsql_trusted_proc_t, sepgsql_trusted_domain_t; + ') + + typeattribute $1 sepgsql_client_type; + + type_transition $1 sepgsql_database_type:db_table sepgsql_table_t; + type_transition $1 sepgsql_database_type:db_procedure sepgsql_proc_t; + type_transition $1 sepgsql_database_type:db_blob sepgsql_blob_t; + + type_transition $1 sepgsql_trusted_proc_t:process sepgsql_trusted_domain_t; + allow $1 sepgsql_trusted_domain_t:process transition; +') + +######################################## +## +## Allow the specified domain unconfined accesses to any database objects +## managed by SE-PostgreSQL, +## +## +## +## Domain allowed access. +## +## +# +interface(`postgresql_unconfined',` + gen_require(` + attribute sepgsql_unconfined_type; + ') + + typeattribute $1 sepgsql_unconfined_type; +') diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te index 1c5416f..1ba4c41 100644 --- a/policy/modules/services/postgresql.te +++ b/policy/modules/services/postgresql.te @@ -1,10 +1,27 @@ -policy_module(postgresql,1.5.1) +policy_module(postgresql, 1.5.2) + +gen_require(` + class db_database all_db_database_perms; + class db_table all_db_table_perms; + class db_procedure all_db_procedure_perms; + class db_column all_db_column_perms; + class db_tuple all_db_tuple_perms; + class db_blob all_db_blob_perms; +') ################################# # # Declarations # + +## +##

+## Allow unprived users to execute DDL statement +##

+## +gen_tunable(sepgsql_enable_users_ddl, true) + type postgresql_t; type postgresql_exec_t; init_daemon_domain(postgresql_t,postgresql_exec_t) @@ -27,6 +44,58 @@ files_tmp_file(postgresql_tmp_t) type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) +# database clients attribute +attribute sepgsql_client_type; +attribute sepgsql_unconfined_type; + +# database objects attribute +attribute sepgsql_database_type; +attribute sepgsql_table_type; +attribute sepgsql_sysobj_table_type; +attribute sepgsql_procedure_type; +attribute sepgsql_blob_type; +attribute sepgsql_module_type; + +# database object types +type sepgsql_blob_t; +postgresql_blob_object(sepgsql_blob_t) + +type sepgsql_db_t; +postgresql_database_object(sepgsql_db_t) + +type sepgsql_fixed_table_t; +postgresql_table_object(sepgsql_fixed_table_t) + +type sepgsql_proc_t; +postgresql_procedure_object(sepgsql_proc_t) + +type sepgsql_ro_blob_t; +postgresql_blob_object(sepgsql_ro_blob_t) + +type sepgsql_ro_table_t; +postgresql_table_object(sepgsql_ro_table_t) + +type sepgsql_secret_blob_t; +postgresql_blob_object(sepgsql_secret_blob_t) + +type sepgsql_secret_table_t; +postgresql_table_object(sepgsql_secret_table_t) + +type sepgsql_sysobj_t; +postgresql_system_table_object(sepgsql_sysobj_t) + +type sepgsql_table_t; +postgresql_table_object(sepgsql_table_t) + +type sepgsql_trusted_proc_t; +postgresql_procedure_object(sepgsql_trusted_proc_t) + +# Trusted Procedure Domain +type sepgsql_trusted_domain_t; +domain_type(sepgsql_trusted_domain_t) +postgresql_unconfined(sepgsql_trusted_domain_t) +role system_r types sepgsql_trusted_domain_t; + ######################################## # # postgresql Local policy @@ -42,6 +111,23 @@ allow postgresql_t self:tcp_socket create_stream_socket_perms; allow postgresql_t self:udp_socket create_stream_socket_perms; allow postgresql_t self:unix_dgram_socket create_socket_perms; allow postgresql_t self:unix_stream_socket create_stream_socket_perms; +allow postgresql_t self:netlink_selinux_socket create_socket_perms; + +allow postgresql_t sepgsql_database_type:db_database *; +type_transition postgresql_t postgresql_t:db_database sepgsql_db_t; + +allow postgresql_t sepgsql_module_type:db_database install_module; +# Database/Loadable module +allow sepgsql_database_type sepgsql_module_type:db_database load_module; + +allow postgresql_t sepgsql_table_type:{ db_table db_column db_tuple } *; +type_transition postgresql_t sepgsql_database_type:db_table sepgsql_sysobj_t; + +allow postgresql_t sepgsql_procedure_type:db_procedure *; +type_transition postgresql_t sepgsql_database_type:db_procedure sepgsql_proc_t; + +allow postgresql_t sepgsql_blob_type:db_blob *; +type_transition postgresql_t sepgsql_database_type:db_blob sepgsql_blob_t; manage_dirs_pattern(postgresql_t,postgresql_db_t,postgresql_db_t) manage_files_pattern(postgresql_t,postgresql_db_t,postgresql_db_t) @@ -101,6 +187,12 @@ dev_read_urand(postgresql_t) fs_getattr_all_fs(postgresql_t) fs_search_auto_mountpoints(postgresql_t) +selinux_get_enforce_mode(postgresql_t) +selinux_validate_context(postgresql_t) +selinux_compute_access_vector(postgresql_t) +selinux_compute_create_context(postgresql_t) +selinux_compute_relabel_context(postgresql_t) + term_use_controlling_term(postgresql_t) corecmd_exec_bin(postgresql_t) @@ -126,7 +218,7 @@ logging_send_syslog_msg(postgresql_t) miscfiles_read_localization(postgresql_t) -seutil_dontaudit_search_config(postgresql_t) +seutil_libselinux_linked(postgresql_t) userdom_dontaudit_use_unpriv_user_fds(postgresql_t) @@ -167,3 +259,81 @@ optional_policy(` optional_policy(` udev_read_db(postgresql_t) ') + +######################################## +# +# Rules common to all clients +# + +allow sepgsql_client_type sepgsql_db_t:db_database { getattr access get_param set_param }; +type_transition sepgsql_client_type sepgsql_client_type:db_database sepgsql_db_t; + +allow sepgsql_client_type sepgsql_fixed_table_t:db_table { getattr use select insert }; +allow sepgsql_client_type sepgsql_fixed_table_t:db_column { getattr use select insert }; +allow sepgsql_client_type sepgsql_fixed_table_t:db_tuple { use select insert }; + +allow sepgsql_client_type sepgsql_table_t:db_table { getattr use select update insert delete }; +allow sepgsql_client_type sepgsql_table_t:db_column { getattr use select update insert }; +allow sepgsql_client_type sepgsql_table_t:db_tuple { use select update insert delete }; + +allow sepgsql_client_type sepgsql_ro_table_t:db_table { getattr use select }; +allow sepgsql_client_type sepgsql_ro_table_t:db_column { getattr use select }; +allow sepgsql_client_type sepgsql_ro_table_t:db_tuple { use select }; + +allow sepgsql_client_type sepgsql_secret_table_t:db_table getattr; +allow sepgsql_client_type sepgsql_secret_table_t:db_column getattr; + +allow sepgsql_client_type sepgsql_sysobj_t:db_table { getattr use select }; +allow sepgsql_client_type sepgsql_sysobj_t:db_column { getattr use select }; +allow sepgsql_client_type sepgsql_sysobj_t:db_tuple { use select }; + +allow sepgsql_client_type sepgsql_proc_t:db_procedure { getattr execute }; +allow sepgsql_client_type sepgsql_trusted_proc_t:db_procedure { getattr execute entrypoint }; + +allow sepgsql_client_type sepgsql_blob_t:db_blob { create drop getattr setattr read write }; +allow sepgsql_client_type sepgsql_ro_blob_t:db_blob { getattr read }; +allow sepgsql_client_type sepgsql_secret_blob_t:db_blob getattr; + +# The purpose of the dontaudit rule in row-level access control is to prevent a flood of logs. +# If a client tries to SELECT a table including violated tuples, these are filtered from +# the result set as if not exist, but its access denied longs can be recorded within log files. +# In generally, the number of tuples are much larger than the number of columns, tables and so on. +# So, it makes a flood of logs when many tuples are violated. +# +# The default policy does not prevent anything for sepgsql_client_type sepgsql_unconfined_type, +# so we don't need "dontaudit" rules in Type-Enforcement. However, MLS/MCS can prevent them +# to access classified tuples and can make a audit record. +# +# Therefore, the following rule is applied for any domains which can connect SE-PostgreSQL. +dontaudit { postgresql_t sepgsql_client_type sepgsql_unconfined_type } { sepgsql_table_type -sepgsql_sysobj_table_type }:db_tuple { use select update insert delete }; + +tunable_policy(`sepgsql_enable_users_ddl',` + allow sepgsql_client_type sepgsql_table_t:db_table { create drop setattr }; + allow sepgsql_client_type sepgsql_table_t:db_column { create drop setattr }; + allow sepgsql_client_type sepgsql_sysobj_t:db_tuple { update insert delete }; +') + +######################################## +# +# Unconfined access to this module +# + +allow sepgsql_unconfined_type sepgsql_database_type:db_database *; +type_transition sepgsql_unconfined_type sepgsql_unconfined_type:db_database sepgsql_db_t; + +type_transition sepgsql_unconfined_type sepgsql_database_type:db_table sepgsql_table_t; +type_transition sepgsql_unconfined_type sepgsql_database_type:db_procedure sepgsql_proc_t; +type_transition sepgsql_unconfined_type sepgsql_database_type:db_blob sepgsql_blob_t; + +allow sepgsql_unconfined_type sepgsql_table_type:{ db_table db_column db_tuple } *; + +# unconfined domain is not allowed to invoke user defined procedure directly. +# They have to confirm and relabel it at first. +allow sepgsql_unconfined_type { sepgsql_proc_t sepgsql_trusted_proc_t }:db_procedure *; +allow sepgsql_unconfined_type sepgsql_procedure_type:db_procedure { create drop getattr setattr relabelfrom relabelto }; + +allow sepgsql_unconfined_type sepgsql_blob_type:db_blob *; + +allow sepgsql_unconfined_type sepgsql_module_type:db_database install_module; + +kernel_relabelfrom_unlabeled_database(sepgsql_unconfined_type) diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc index fbdf8f1..b6639c1 100644 --- a/policy/modules/system/init.fc +++ b/policy/modules/system/init.fc @@ -38,6 +38,8 @@ ifdef(`distro_gentoo', ` # # /usr # +/usr/bin/sepg_ctl -- gen_context(system_u:object_r:initrc_exec_t,s0) + /usr/libexec/dcc/start-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) /usr/libexec/dcc/stop-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index bc7d821..4e66239 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1,5 +1,5 @@ -policy_module(init,1.10.1) +policy_module(init,1.10.2) gen_require(` class passwd rootok; diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te index 52a2f37..e3b80b5 100644 --- a/policy/modules/system/libraries.te +++ b/policy/modules/system/libraries.te @@ -1,5 +1,5 @@ -policy_module(libraries,2.1.0) +policy_module(libraries,2.1.1) ######################################## # @@ -39,6 +39,11 @@ files_type(lib_t) type textrel_shlib_t alias texrel_shlib_t; files_type(textrel_shlib_t) +optional_policy(` + postgresql_loadable_module(lib_t) + postgresql_loadable_module(textrel_shlib_t) +') + ######################################## # # ldconfig local policy diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if index 14b419c..e85b3d0 100644 --- a/policy/modules/system/unconfined.if +++ b/policy/modules/system/unconfined.if @@ -88,6 +88,10 @@ interface(`unconfined_domain_noaudit',` ') optional_policy(` + postgresql_unconfined($1) + ') + + optional_policy(` seutil_create_bin_policy($1) seutil_relabelto_bin_policy($1) ') diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 7dcc109..e86a816 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -1,5 +1,5 @@ -policy_module(unconfined, 2.2.1) +policy_module(unconfined, 2.2.2) ######################################## # diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index d945c3c..3dcc946 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -1197,6 +1197,10 @@ template(`userdom_unpriv_user_template', ` netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) ') + optional_policy(` + postgresql_userdom_template($1,$1_t,$1_r) + ') + # Run pppd in pppd_t by default for user optional_policy(` ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) @@ -1367,6 +1371,10 @@ template(`userdom_admin_user_template',` ') optional_policy(` + postgresql_unconfined($1_t) + ') + + optional_policy(` userhelper_exec($1_t) ') ') diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te index 276640b..206d205 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -1,5 +1,5 @@ -policy_module(userdomain, 3.0.1) +policy_module(userdomain, 3.0.2) ######################################## #