database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Update sepgsql to add mandatory access control for TRUNCATE

Browse Source 
Use SELinux "db_table: { truncate }" to check if permission is granted to
TRUNCATE. Update example SELinux policy to grant needed permission for
TRUNCATE. Add new regression test to demonstrate a positive and negative
cases. Test will only be run if the loaded SELinux policy has the
"db_table: { truncate }" permission. Makes use of recent commit which added
object TRUNCATE hook. Patch by Yuli Khodorkovskiy with minor
editorialization by me. Not back-patched because the object TRUNCATE hook
was not.

Author: Yuli Khodorkovskiy
Reviewed-by: Joe Conway
Discussion: https://postgr.es/m/CAFL5wJcomybj1Xdw7qWmPJRpGuFukKgNrDb6uVBaCMgYS9dkaA%40mail.gmail.com
This commit is contained in:
Joe Conway
2019-11-23 10:41:52 -05:00
parent f7a2002e82
commit 4f66c93f61
8 changed files with 152 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
contrib/sepgsql/relation.c
View File

@ -516,6 +516,46 @@ sepgsql_relation_drop(Oid relOid)
}
}
/*
* sepgsql_relation_truncate
*
* Check privileges to TRUNCATE the supplied relation.
*/
void
sepgsql_relation_truncate(Oid relOid)
{
ObjectAddress object;
char *audit_name;
uint16_t tclass = 0;
char relkind = get_rel_relkind(relOid);
switch (relkind)
{
case RELKIND_RELATION:
case RELKIND_PARTITIONED_TABLE:
tclass = SEPG_CLASS_DB_TABLE;
break;
default:
/* ignore other relkinds */
return;
}
/*
* check db_table:{truncate} permission
*/
object.classId = RelationRelationId;
object.objectId = relOid;
object.objectSubId = 0;
audit_name = getObjectIdentity(&object);
sepgsql_avc_check_perms(&object,
tclass,
SEPG_DB_TABLE__TRUNCATE,
audit_name,
true);
pfree(audit_name);
}
/*
* sepgsql_relation_relabel
*