rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

trunk:

Browse Source 
The attached patch allows unprivileged clients to export from or import
to the largeobject owned by themselves.

The current security policy does not allow them to import/export any
largeobjects without any clear reason.

NOTE: Export of the largeobject means that it dumps whole of the
largeobject into a local file, so SE-PostgreSQL checks both of
db_blob:{read export} on the largeobject and file:{write} on the
local file. Import is a reversal behavior.

KaiGai Kohei
This commit is contained in:
Chris PeBenito 2009-05-22 13:37:32 +00:00
parent e0ea7b15ca
commit 996779dfad
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/services/postgresql.if
View File

@ -64,7 +64,7 @@ interface(`postgresql_role',`
allow $2 user_sepgsql_proc_exec_t:db_procedure { getattr execute };
type_transition $2 sepgsql_database_type:db_procedure user_sepgsql_proc_exec_t;
allow $2 user_sepgsql_blob_t:db_blob { create drop getattr setattr read write };
allow $2 user_sepgsql_blob_t:db_blob { create drop getattr setattr read write import export };
type_transition $2 sepgsql_database_type:db_blob user_sepgsql_blob_t;
allow $2 sepgsql_trusted_proc_t:process transition;
@ -362,7 +362,7 @@ interface(`postgresql_unpriv_client',`
allow $1 unpriv_sepgsql_proc_exec_t:db_procedure { getattr execute };
type_transition $1 sepgsql_database_type:db_procedure unpriv_sepgsql_proc_exec_t;
allow $1 unpriv_sepgsql_blob_t:db_blob { create drop getattr setattr read write };
allow $1 unpriv_sepgsql_blob_t:db_blob { create drop getattr setattr read write import export };
type_transition $1 sepgsql_database_type:db_blob unpriv_sepgsql_blob_t;
')

2
policy/modules/services/postgresql.te
View File

@ -1,5 +1,5 @@
policy_module(postgresql, 1.8.6)
policy_module(postgresql, 1.8.7)
gen_require(`
class db_database all_db_database_perms;