Postgresql command contexts

refpolicy Superseded Luis Ressel 2 participants 11 messages Jan 25, 2014 – Mar 14, 2014

Share & tools

Luis Ressel

author

2014-01-25 17:24 UTC #0 lore raw

I reworked the patch for the Postgresql command contexts which I already proposed here in november. The main changes are in the second patch.

Regards,
Luis Ressel

Luis Ressel

author

2014-01-25 17:24 UTC #1 lore raw

PATCH 1/3 Add two postgresql file contexts from gentoo policy

---
 policy/modules/services/postgresql.fc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

policy/modules/services/postgresql.fc +4 -1

index a26f84f..9b693c4 100644
@@ -1,8 +1,11 @@
 #
 # /etc
 #
-/etc/postgresql(/.*)?			gen_context(system_u:object_r:postgresql_etc_t,s0)
+/etc/postgresql(-.*)?(/.*)?		gen_context(system_u:object_r:postgresql_etc_t,s0)
+
+/etc/init\.d/postgresql(-.*)?	--	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/(se)?postgresql --	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
+
 /etc/sysconfig/pgsql(/.*)? 		gen_context(system_u:object_r:postgresql_etc_t,s0)
 
 #

Signature · 1 line

1.8.5.3

Christopher J. PeBenito

2014-02-08 15:07 UTC #2 lore raw

PATCH 1/3 Add two postgresql file contexts from gentoo policy

Quoted 9 lines · Luis Ressel

---
 policy/modules/services/postgresql.fc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

policy/modules/services/postgresql.fc +0 -0

index a26f84f..9b693c4 100644

policy/modules/services/postgresql.fc line 4

Quoted 5 lines

policy/modules/services/postgresql.fc +1 -1

@@ -1,8 +1,11 @@
 #
 # /etc
 #
-/etc/postgresql(/.*)?			gen_context(system_u:object_r:postgresql_etc_t,s0)
+/etc/postgresql(-.*)?(/.*)?		gen_context(system_u:object_r:postgresql_etc_t,s0)

Is this intended to handle something like /etc/postgresql-3.9.2/*?

policy/modules/services/postgresql.fc line 7

Quoted 2 lines

policy/modules/services/postgresql.fc +1 -0

+/etc/init\.d/postgresql(-.*)?	--	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/(se)?postgresql --	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)

We should remove the rc\.d from the existing line instead. The file context substitutions will take care of instances where someone has init scripts in /etc/rc.d/init.d.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Christopher J. PeBenito

2014-02-08 15:17 UTC #3 lore raw

PATCH 1/3 Add two postgresql file contexts from gentoo policy

Quoted 5 lines · Christopher J. PeBenito

Quoted 2 lines · Luis Ressel
+/etc/init\.d/postgresql(-.*)? -- gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
/etc/rc\.d/init\.d/(se)?postgresql -- gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
We should remove the rc\.d from the existing line instead. The file context substitutions will take care of instances where someone has init scripts in /etc/rc.d/init.d.

I read the path substitution backwards. The existing line should be appended to handle the extra file naming. The rc\.d should not be removed.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Luis Ressel

author

2014-02-08 17:31 UTC #4 lore raw

PATCH v2 1/1 Add two postgresql file contexts from gentoo policy

Gentoo appends version numbers to the names of the init script and the config directory.

---
 policy/modules/services/postgresql.fc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

policy/modules/services/postgresql.fc +4 -2

index a26f84f..3794099 100644
@@ -1,8 +1,10 @@
 #
 # /etc
 #
-/etc/postgresql(/.*)?			gen_context(system_u:object_r:postgresql_etc_t,s0)
-/etc/rc\.d/init\.d/(se)?postgresql --	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
+/etc/postgresql(-.*)?(/.*)?		gen_context(system_u:object_r:postgresql_etc_t,s0)
+
+/etc/rc\.d/init\.d/(se)?postgresql(-.*)?	--	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
+
 /etc/sysconfig/pgsql(/.*)? 		gen_context(system_u:object_r:postgresql_etc_t,s0)
 
 #

Signature · 1 line

1.8.5.4

Christopher J. PeBenito

2014-03-14 14:21 UTC #5 lore raw

PATCH v2 1/1 Add two postgresql file contexts from gentoo policy

Quoted 14 lines · Luis Ressel

Gentoo appends version numbers to the names of the init script and the config directory.
---
 policy/modules/services/postgresql.fc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
policy/modules/services/postgresql.fc +0 -0
index a26f84f..3794099 100644
@@ -1,8 +1,10 @@
 #
 # /etc

policy/modules/services/postgresql.fc line 10

Quoted 10 lines

policy/modules/services/postgresql.fc +4 -2

 #
-/etc/postgresql(/.*)?			gen_context(system_u:object_r:postgresql_etc_t,s0)
-/etc/rc\.d/init\.d/(se)?postgresql --	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
+/etc/postgresql(-.*)?(/.*)?		gen_context(system_u:object_r:postgresql_etc_t,s0)
+
+/etc/rc\.d/init\.d/(se)?postgresql(-.*)?	--	gen_context(system_u:object_r:postgresql_initrc_exec_t,s0)
+
 /etc/sysconfig/pgsql(/.*)? 		gen_context(system_u:object_r:postgresql_etc_t,s0)
 
 #

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Luis Ressel

author

2014-02-08 17:23 UTC #6 lore raw

PATCH 1/3 Add two postgresql file contexts from gentoo policy

In reply to Christopher J. PeBenito

Quoted 1 line · On Sat, 8 Feb 2014 10:07:13 -0500 "Christopher J. PeBenito"…

Is this intended to handle something like /etc/postgresql-3.9.2/*?

Yes, exactly. This scheme is used on gentoo to allow for parallel install of multiple postgresql versions.

--
Luis Ressel <[email protected]>
GPG fpr: F08D 2AF6 655E 25DE 52BC E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140208/e8197c17/attachment.bin

Luis Ressel

author

2014-01-25 17:24 UTC #7 lore raw

PATCH 2/3 Only label administrative postgres commands as postgresql_exec_t

In reply to Luis Ressel

Currently, all postgresql commands in are labeled as postgresql_exec_t. This means they can only be executed by db admins. However, the "normal" commands, such as createdb or psql, should also be executable by users. (The users in question still need to be granted postgresql_role(), so this is no security problem.)

---
 policy/modules/services/postgresql.fc | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

policy/modules/services/postgresql.fc +11 -1

index 9b693c4..1996f74 100644
@@ -16,7 +16,17 @@
 
 /usr/lib/pgsql/test/regress(/.*)?	gen_context(system_u:object_r:postgresql_db_t,s0)
 /usr/lib/pgsql/test/regress/pg_regress -- gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql/bin/.*	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+
+/usr/lib/postgresql(-.*)?/bin/pg_archivecleanup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_basebackup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_controldata	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_ctl		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_resetxlog	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_standby	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_upgrade	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_xlogdum	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/postgres		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/postmaster	-l	gen_context(system_u:object_r:postgresql_exec_t,s0)
 
 ifdef(`distro_debian', `
 /usr/lib/postgresql/.*/bin/.*	--	gen_context(system_u:object_r:postgresql_exec_t,s0)

Signature · 1 line

1.8.5.3

Christopher J. PeBenito

2014-02-08 15:11 UTC #8 lore raw

PATCH 2/3 Only label administrative postgres commands as postgresql_exec_t

Quoted 5 lines · Luis Ressel

Currently, all postgresql commands in are labeled as postgresql_exec_t. This means they can only be executed by db admins. However, the "normal" commands, such as createdb or psql, should also be executable by users. (The users in question still need to be granted postgresql_role(), so this is no security problem.)

KaiGai, any comment on this? I'm hoping for additional comment on this before moving forward.

Quoted 27 lines

---
 policy/modules/services/postgresql.fc | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

policy/modules/services/postgresql.fc +11 -1

index 9b693c4..1996f74 100644
@@ -16,7 +16,17 @@
 
 /usr/lib/pgsql/test/regress(/.*)?	gen_context(system_u:object_r:postgresql_db_t,s0)
 /usr/lib/pgsql/test/regress/pg_regress -- gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql/bin/.*	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+
+/usr/lib/postgresql(-.*)?/bin/pg_archivecleanup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_basebackup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_controldata	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_ctl		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_resetxlog	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_standby	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_upgrade	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/pg_xlogdum	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/postgres		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/bin/postmaster	-l	gen_context(system_u:object_r:postgresql_exec_t,s0)
 
 ifdef(`distro_debian', `
 /usr/lib/postgresql/.*/bin/.*	--	gen_context(system_u:object_r:postgresql_exec_t,s0)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Luis Ressel

author

2014-01-25 17:24 UTC #9 lore raw

PATCH 3/3 Also apply the new postgres labeling scheme on Debian

In reply to Luis Ressel

I'm sure this is the right thing to do; however, the Debian developers might want to have a say in this, so I made it a separate patch.

---
 policy/modules/services/postgresql.fc | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

policy/modules/services/postgresql.fc +10 ~~-14~~

index 1996f74..b52c25c 100644
@@ -17,20 +17,16 @@
 /usr/lib/pgsql/test/regress(/.*)?	gen_context(system_u:object_r:postgresql_db_t,s0)
 /usr/lib/pgsql/test/regress/pg_regress -- gen_context(system_u:object_r:postgresql_exec_t,s0)
 
-/usr/lib/postgresql(-.*)?/bin/pg_archivecleanup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_basebackup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_controldata	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_ctl		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_resetxlog	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_standby	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_upgrade	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/pg_xlogdum	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/postgres		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-/usr/lib/postgresql(-.*)?/bin/postmaster	-l	gen_context(system_u:object_r:postgresql_exec_t,s0)
-
-ifdef(`distro_debian', `
-/usr/lib/postgresql/.*/bin/.*	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
-')
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_archivecleanup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_basebackup	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_controldata	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_ctl		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_resetxlog	--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_standby		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_upgrade		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/pg_xlogdum		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/postgres		--	gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/lib/postgresql(-.*)?/(.*/)?bin/postmaster		-l	gen_context(system_u:object_r:postgresql_exec_t,s0)
 
 ifdef(`distro_redhat', `
 /usr/share/jonas/pgsql(/.*)?		gen_context(system_u:object_r:postgresql_db_t,s0)

Signature · 1 line

1.8.5.3

Luis Ressel

author

2014-01-25 17:33 UTC #10 lore raw

In reply to Luis Ressel

The second and third patch include a small typo which I somehow missed:
It should be "pg_xlogdump", not "pg_xlogdum". Please fix this when applying the patches.

Signature · 9 lines

Luis Ressel <[email protected]>
GPG fpr: F08D 2AF6 655E 25DE 52BC  E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140125/def64511/attachment.bin