database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Add missing check on invocation of trusted procedures.

Browse Source 
KaiGai Kohei
This commit is contained in:
Robert Haas
2011-04-04 13:25:42 -04:00
parent a0e50e698b
commit 595a441ae9
4 changed files with 57 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
contrib/sepgsql/sepgsql-regtest.te
View File

@ -1,4 +1,8 @@
policy_module(sepgsql-regtest, 1.01)
policy_module(sepgsql-regtest, 1.02)
gen_require(`
all_userspace_class_perms
')
## <desc>
## <p>
@ -8,6 +12,12 @@ policy_module(sepgsql-regtest, 1.01)
## </desc>
gen_tunable(sepgsql_regression_test_mode, false)
#
# Type definitions for regression test
#
type sepgsql_regtest_trusted_proc_exec_t;
postgresql_procedure_object(sepgsql_regtest_trusted_proc_exec_t)
#
# Test domains for database administrators
#
@ -57,3 +67,19 @@ optional_policy(`
role unconfined_r types sepgsql_regtest_user_t;
role unconfined_r types sepgsql_trusted_proc_t;
')
#
# Rule to check
#
optional_policy(`
# These rules intends sepgsql_regtest_user_t domain to translate
# sepgsql_regtest_dba_t on execution of procedures labeled as
# sepgsql_regtest_trusted_proc_exec_t, but does not allow transition
# permission from sepgsql_regtest_user_t to sepgsql_regtest_dba_t.
#
gen_require(`
attribute sepgsql_client_type;
')
allow sepgsql_client_type sepgsql_regtest_trusted_proc_exec_t:db_procedure { getattr execute install };
type_transition sepgsql_regtest_user_t sepgsql_regtest_trusted_proc_exec_t:process sepgsql_regtest_dba_t;
')