From: cpebenito@tresys.com (Christopher J. PeBenito) Date: Fri, 4 May 2012 11:51:00 -0400 Subject: [refpolicy] [4/4] sepgsql -redefinition of use permission onto system objects In-Reply-To: References: Message-ID: <4FA3FAE4.8010803@tresys.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 05/04/12 09:33, Kohei KaiGai wrote: > The patch 3 of 4 also required the 4 of 4 being refreshed to apply correctly. > In addition, I forgot to allow sepgsql_admin_type to allow to "use" system > objects. > > Please check the newer version. Thanks, Looks like the revised patch is missing. > 2012/3/25 Kohei KaiGai : >> This patch might be arguable. It redefines the "use" permission on db_tuple >> class that has marked deprecated for a few years, to control usage of system >> objects but without individual object classes. >> >> We didn't try to port all the supported database object types in PostgreSQL >> into SELinux policy model, because its variation is too large to port and >> less priority in comparison with "major" object classes such as tables. >> >> So, we handle permissions to create, drop and alter these objects as >> permissions to insert, delete or update of system catalogs; labeled as >> sepgsql_sysobj_t, and so on. >> >> On the other hand, some of system objects requires to check permission >> when user "use" these objects, such as data types, tablespaces, >> operators and so on. >> I don't think it is reasonable approach to define individual object classes >> for each object types reflects to PostgreSQL. However, it is preferable >> to have double checks by selinux on strategic points. >> >> So, I try to redefine "use" permission on db_tuple class; that means >> permission to "use" this object when the tuple is an entry of system >> catalog corresponding to a particular database object but don't have >> a particular object class like tables. >> >> The deprecated permissions and rules are not in use for a few years, >> so, it is a time to be utilized or eliminated. >> >> Thanks, >> >> Signed-off-by: KaiGai Kohei >> -- >> policy/flask/access_vectors | 4 +--- >> policy/modules/services/postgresql.if | 16 ++++++---------- >> policy/modules/services/postgresql.te | 31 +++++++++++-------------------- >> 3 files changed, 18 insertions(+), 33 deletions(-) >> >> diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors >> index bf24160..f462e95 100644 >> --- a/policy/flask/access_vectors >> +++ b/policy/flask/access_vectors >> @@ -761,7 +761,6 @@ inherits database >> class db_table >> inherits database >> { >> - use # deprecated >> select >> update >> insert >> @@ -780,7 +779,6 @@ inherits database >> class db_column >> inherits database >> { >> - use # deprecated >> select >> update >> insert >> @@ -790,7 +788,7 @@ class db_tuple >> { >> relabelfrom >> relabelto >> - use # deprecated >> + use >> select >> update >> insert >> diff --git a/policy/modules/services/postgresql.if >> b/policy/modules/services/postgresql.if >> index 56fc5fa..71f2572 100644 >> --- a/policy/modules/services/postgresql.if >> +++ b/policy/modules/services/postgresql.if >> @@ -70,10 +70,9 @@ interface(`postgresql_role',` >> type_transition $2 sepgsql_database_type:db_schema user_sepgsql_schema_t; >> type_transition $2 sepgsql_database_type:db_schema >> sepgsql_temp_schema_t "pg_temp"; >> >> - allow $2 user_sepgsql_table_t:db_table { getattr use select update >> insert delete lock }; >> - allow $2 user_sepgsql_table_t:db_column { getattr use select update insert }; >> - allow $2 user_sepgsql_table_t:db_tuple { use select update insert delete }; >> - type_transition $2 sepgsql_database_type:db_table >> user_sepgsql_table_t; # deprecated >> + allow $2 user_sepgsql_table_t:db_table { getattr select update >> insert delete lock }; >> + allow $2 user_sepgsql_table_t:db_column { getattr select update insert }; >> + allow $2 user_sepgsql_table_t:db_tuple { select update insert delete }; >> type_transition $2 {sepgsql_schema_type - >> sepgsql_temp_schema_t}:db_table user_sepgsql_table_t; >> type_transition $2 sepgsql_temp_schema_t:db_table sepgsql_temp_table_t; >> >> @@ -89,7 +88,6 @@ interface(`postgresql_role',` >> type_transition $2 sepgsql_temp_schema_t:db_view sepgsql_temp_view_t; >> >> allow $2 user_sepgsql_proc_exec_t:db_procedure { getattr execute }; >> - type_transition $2 sepgsql_database_type:db_procedure >> user_sepgsql_proc_exec_t; # deprecated >> type_transition $2 {sepgsql_schema_type - >> sepgsql_temp_schema_t}:db_procedure user_sepgsql_proc_exec_t; >> type_transition $2 sepgsql_temp_schema_t:db_procedure >> sepgsql_temp_proc_exec_t; >> >> @@ -513,10 +511,9 @@ interface(`postgresql_unpriv_client',` >> type_transition $1 sepgsql_database_type:db_schema unpriv_sepgsql_schema_t; >> type_transition $1 sepgsql_database_type:db_schema >> unpriv_sepgsql_schema_t "pg_temp"; >> >> - allow $1 unpriv_sepgsql_table_t:db_table { getattr use select update >> insert delete lock }; >> - allow $1 unpriv_sepgsql_table_t:db_column { getattr use select >> update insert }; >> - allow $1 unpriv_sepgsql_table_t:db_tuple { use select update insert delete }; >> - type_transition $1 sepgsql_database_type:db_table >> unpriv_sepgsql_table_t; # deprecated >> + allow $1 unpriv_sepgsql_table_t:db_table { getattr select update >> insert delete lock }; >> + allow $1 unpriv_sepgsql_table_t:db_column { getattr select update insert }; >> + allow $1 unpriv_sepgsql_table_t:db_tuple { select update insert delete }; >> type_transition $1 {sepgsql_schema_type - >> sepgsql_temp_schema_t}:db_table unpriv_sepgsql_table_t; >> type_transition $1 sepgsql_temp_schema_t:db_table sepgsql_temp_table_t; >> >> @@ -532,7 +529,6 @@ interface(`postgresql_unpriv_client',` >> type_transition $1 sepgsql_sysobj_table_type:db_tuple unpriv_sepgsql_sysobj_t; >> >> allow $1 unpriv_sepgsql_proc_exec_t:db_procedure { getattr execute }; >> - type_transition $1 sepgsql_database_type:db_procedure >> unpriv_sepgsql_proc_exec_t; # deprecated >> type_transition $1 {sepgsql_schema_type - >> sepgsql_temp_schema_t}:db_procedure unpriv_sepgsql_proc_exec_t; >> type_transition $1 sepgsql_temp_schema_t:db_procedure >> sepgsql_temp_proc_exec_t; >> >> diff --git a/policy/modules/services/postgresql.te >> b/policy/modules/services/postgresql.te >> index 8a3c2bd..92d6e66 100644 >> --- a/policy/modules/services/postgresql.te >> +++ b/policy/modules/services/postgresql.te >> @@ -259,7 +259,6 @@ tunable_policy(`sepgsql_transmit_client_label',` >> ') >> >> allow postgresql_t sepgsql_database_type:db_database *; >> -type_transition postgresql_t postgresql_t:db_database >> sepgsql_db_t; # deprecated >> >> allow postgresql_t sepgsql_module_type:db_database install_module; >> # Database/Loadable module >> @@ -270,7 +269,6 @@ type_transition postgresql_t >> sepgsql_database_type:db_schema sepgsql_schema_t; >> type_transition postgresql_t sepgsql_database_type:db_schema >> sepgsql_temp_schema_t "pg_temp"; >> >> allow postgresql_t sepgsql_table_type:{ db_table db_column db_tuple } *; >> -type_transition postgresql_t sepgsql_database_type:db_table >> sepgsql_sysobj_t; # deprecated >> type_transition postgresql_t sepgsql_schema_type:db_table sepgsql_sysobj_t; >> >> allow postgresql_t sepgsql_sequence_type:db_sequence *; >> @@ -280,7 +278,6 @@ allow postgresql_t sepgsql_view_type:db_view *; >> type_transition postgresql_t sepgsql_schema_type:db_view sepgsql_view_t; >> >> allow postgresql_t sepgsql_procedure_type:db_procedure *; >> -type_transition postgresql_t sepgsql_database_type:db_procedure >> sepgsql_proc_exec_t; # deprecated >> type_transition postgresql_t sepgsql_schema_type:db_procedure >> sepgsql_proc_exec_t; >> >> allow postgresql_t sepgsql_blob_type:db_blob *; >> @@ -431,23 +428,23 @@ type_transition sepgsql_client_type >> sepgsql_client_type:db_database sepgsql_db_t >> >> allow sepgsql_client_type sepgsql_schema_t:db_schema { getattr search }; >> >> -allow sepgsql_client_type sepgsql_fixed_table_t:db_table { getattr >> use select insert lock }; >> -allow sepgsql_client_type sepgsql_fixed_table_t:db_column { getattr >> use select insert }; >> -allow sepgsql_client_type sepgsql_fixed_table_t:db_tuple { use select insert }; >> +allow sepgsql_client_type sepgsql_fixed_table_t:db_table { getattr >> select insert lock }; >> +allow sepgsql_client_type sepgsql_fixed_table_t:db_column { getattr >> select insert }; >> +allow sepgsql_client_type sepgsql_fixed_table_t:db_tuple { select insert }; >> >> -allow sepgsql_client_type sepgsql_table_t:db_table { getattr use >> select update insert delete lock }; >> -allow sepgsql_client_type sepgsql_table_t:db_column { getattr use >> select update insert }; >> -allow sepgsql_client_type sepgsql_table_t:db_tuple { use select >> update insert delete }; >> +allow sepgsql_client_type sepgsql_table_t:db_table { getattr select >> update insert delete lock }; >> +allow sepgsql_client_type sepgsql_table_t:db_column { getattr select >> update insert }; >> +allow sepgsql_client_type sepgsql_table_t:db_tuple { select update >> insert delete }; >> >> -allow sepgsql_client_type sepgsql_ro_table_t:db_table { getattr use >> select lock }; >> -allow sepgsql_client_type sepgsql_ro_table_t:db_column { getattr use select }; >> -allow sepgsql_client_type sepgsql_ro_table_t:db_tuple { use select }; >> +allow sepgsql_client_type sepgsql_ro_table_t:db_table { getattr select lock }; >> +allow sepgsql_client_type sepgsql_ro_table_t:db_column { getattr select }; >> +allow sepgsql_client_type sepgsql_ro_table_t:db_tuple { select }; >> >> allow sepgsql_client_type sepgsql_secret_table_t:db_table getattr; >> allow sepgsql_client_type sepgsql_secret_table_t:db_column getattr; >> >> -allow sepgsql_client_type sepgsql_sysobj_t:db_table { getattr use >> select lock }; >> -allow sepgsql_client_type sepgsql_sysobj_t:db_column { getattr use select }; >> +allow sepgsql_client_type sepgsql_sysobj_t:db_table { getattr select lock }; >> +allow sepgsql_client_type sepgsql_sysobj_t:db_column { getattr select }; >> allow sepgsql_client_type sepgsql_sysobj_t:db_tuple { use select }; >> >> allow sepgsql_client_type sepgsql_temp_table_t:db_table ~{ relabelto >> relabelfrom }; >> @@ -503,7 +500,6 @@ tunable_policy(`sepgsql_enable_users_ddl',` >> # >> >> allow sepgsql_admin_type sepgsql_database_type:db_database { create >> drop getattr setattr relabelfrom relabelto access }; >> -type_transition sepgsql_admin_type sepgsql_admin_type:db_database >> sepgsql_db_t; # deprecated >> >> allow sepgsql_admin_type sepgsql_schema_type:db_schema { create drop >> getattr setattr relabelfrom relabelto search add_name remove_name }; >> type_transition sepgsql_admin_type sepgsql_database_type:db_schema >> sepgsql_schema_t; >> @@ -513,7 +509,6 @@ allow sepgsql_admin_type >> sepgsql_table_type:db_table { create drop getattr setat >> allow sepgsql_admin_type sepgsql_table_type:db_column { create drop >> getattr setattr relabelfrom relabelto }; >> allow sepgsql_admin_type sepgsql_sysobj_table_type:db_tuple { >> relabelfrom relabelto select update insert delete }; >> >> -type_transition sepgsql_admin_type sepgsql_database_type:db_table >> sepgsql_table_t; # deprecated >> type_transition sepgsql_admin_type sepgsql_schema_type:db_table >> sepgsql_table_t; >> >> allow sepgsql_admin_type sepgsql_sequence_type:db_sequence { create >> drop getattr setattr relabelfrom relabelto get_value next_value >> set_value }; >> @@ -527,7 +522,6 @@ type_transition sepgsql_admin_type >> sepgsql_schema_type:db_view sepgsql_view_t; >> allow sepgsql_admin_type sepgsql_procedure_type:db_procedure { create >> drop getattr relabelfrom relabelto }; >> allow sepgsql_admin_type sepgsql_proc_exec_t:db_procedure execute; >> >> -type_transition sepgsql_admin_type sepgsql_database_type:db_procedure >> sepgsql_proc_exec_t; # deprecated >> type_transition sepgsql_admin_type sepgsql_schema_type:db_procedure >> sepgsql_proc_exec_t; >> >> allow sepgsql_admin_type sepgsql_language_type:db_language { create >> drop getattr setattr relabelfrom relabelto execute }; >> @@ -566,14 +560,11 @@ tunable_policy(`sepgsql_unconfined_dbadm',` >> # >> >> allow sepgsql_unconfined_type sepgsql_database_type:db_database *; >> -type_transition sepgsql_unconfined_type >> sepgsql_unconfined_type:db_database sepgsql_db_t; # deprecated >> >> allow sepgsql_unconfined_type sepgsql_schema_type:db_schema *; >> type_transition sepgsql_unconfined_type >> sepgsql_database_type:db_schema sepgsql_schema_t; >> type_transition sepgsql_unconfined_type >> sepgsql_database_type:db_schema sepgsql_schema_t "pg_temp"; >> >> -type_transition sepgsql_unconfined_type >> sepgsql_database_type:db_table sepgsql_table_t; # deprecated >> -type_transition sepgsql_unconfined_type >> sepgsql_database_type:db_procedure sepgsql_proc_exec_t; # deprecated >> type_transition sepgsql_unconfined_type sepgsql_schema_type:db_table >> sepgsql_table_t; >> type_transition sepgsql_unconfined_type >> sepgsql_schema_type:db_sequence sepgsql_seq_t; >> type_transition sepgsql_unconfined_type sepgsql_schema_type:db_view >> sepgsql_view_t; >> >> -- >> KaiGai Kohei > > > -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com