database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

sepgsql: Support for new post-ALTER access hook.

Browse Source 
KaiGai Kohei
This commit is contained in:
Robert Haas
2013-03-27 08:10:14 -04:00
parent bc5334d867
commit 1cea9bbb21
12 changed files with 693 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
contrib/sepgsql/schema.c
View File

@ -162,3 +162,54 @@ sepgsql_schema_relabel(Oid namespaceId, const char *seclabel)
true);
pfree(audit_name);
}
/*
* sepgsql_schema_check_perms
*
* utility routine to check db_schema:{xxx} permissions
*/
static void
check_schema_perms(Oid namespaceId, uint32 required)
{
ObjectAddress object;
char *audit_name;
object.classId = NamespaceRelationId;
object.objectId = namespaceId;
object.objectSubId = 0;
audit_name = getObjectDescription(&object);
sepgsql_avc_check_perms(&object,
SEPG_CLASS_DB_SCHEMA,
required,
audit_name,
true);
pfree(audit_name);
}
/* db_schema:{setattr} permission */
void
sepgsql_schema_setattr(Oid namespaceId)
{
check_schema_perms(namespaceId, SEPG_DB_SCHEMA__SETATTR);
}
void
sepgsql_schema_add_name(Oid namespaceId)
{
check_schema_perms(namespaceId, SEPG_DB_SCHEMA__ADD_NAME);
}
void
sepgsql_schema_remove_name(Oid namespaceId)
{
check_schema_perms(namespaceId, SEPG_DB_SCHEMA__REMOVE_NAME);
}
void
sepgsql_schema_rename(Oid namespaceId)
{
check_schema_perms(namespaceId,
SEPG_DB_SCHEMA__ADD_NAME |
SEPG_DB_SCHEMA__REMOVE_NAME);
}