mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-12-15 08:20:16 +08:00
Code Issues Packages Projects Releases Wiki Activity
72dd233d3e
postgresql/contrib/sepgsql/sepgsql.h

334 lines
12 KiB
C
Raw Normal View History

sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
/* -------------------------------------------------------------------------
*
* contrib/sepgsql/sepgsql.h
*
* Definitions corresponding to SE-PostgreSQL
*
Update copyright for 2014 Update all files in head, and files COPYRIGHT and legal.sgml in all back branches.
2014-01-08 05:05:30 +08:00
* Copyright (c) 2010-2014, PostgreSQL Global Development Group
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
*
* -------------------------------------------------------------------------
*/
#ifndef SEPGSQL_H
#define SEPGSQL_H
#include "catalog/objectaddress.h"
Add missing #include
2011-03-26 11:09:17 +08:00
#include "fmgr.h"
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
#include <selinux/selinux.h>
Userspace access vector cache for contrib/sepgsql. KaiGai Kohei
2011-09-01 20:37:33 +08:00
#include <selinux/avc.h>
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
/*
* SE-PostgreSQL Label Tag
*/
#define SEPGSQL_LABEL_TAG "selinux"
/*
* SE-PostgreSQL performing mode
*/
#define SEPGSQL_MODE_DEFAULT 1
#define SEPGSQL_MODE_PERMISSIVE 2
#define SEPGSQL_MODE_INTERNAL 3
#define SEPGSQL_MODE_DISABLED 4
/*
* Internally used code of object classes
*/
#define SEPG_CLASS_PROCESS 0
#define SEPG_CLASS_FILE 1
#define SEPG_CLASS_DIR 2
#define SEPG_CLASS_LNK_FILE 3
#define SEPG_CLASS_CHR_FILE 4
#define SEPG_CLASS_BLK_FILE 5
#define SEPG_CLASS_SOCK_FILE 6
#define SEPG_CLASS_FIFO_FILE 7
#define SEPG_CLASS_DB_DATABASE 8
#define SEPG_CLASS_DB_SCHEMA 9
#define SEPG_CLASS_DB_TABLE 10
#define SEPG_CLASS_DB_SEQUENCE 11
#define SEPG_CLASS_DB_PROCEDURE 12
#define SEPG_CLASS_DB_COLUMN 13
#define SEPG_CLASS_DB_TUPLE 14
#define SEPG_CLASS_DB_BLOB 15
#define SEPG_CLASS_DB_LANGUAGE 16
#define SEPG_CLASS_DB_VIEW 17
#define SEPG_CLASS_MAX 18
/*
* Internally used code of access vectors
*/
#define SEPG_PROCESS__TRANSITION (1<<0)
sepgsql_setcon(). This is intended as infrastructure to allow sepgsql to cooperate with connection pooling software, by allowing the effective security label to be set for each new connection. KaiGai Kohei, reviewed by Yeb Havinga.
2012-03-16 04:08:40 +08:00
#define SEPG_PROCESS__DYNTRANSITION (1<<1)
#define SEPG_PROCESS__SETCURRENT (1<<2)
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
#define SEPG_FILE__READ (1<<0)
#define SEPG_FILE__WRITE (1<<1)
#define SEPG_FILE__CREATE (1<<2)
#define SEPG_FILE__GETATTR (1<<3)
#define SEPG_FILE__UNLINK (1<<4)
#define SEPG_FILE__RENAME (1<<5)
#define SEPG_FILE__APPEND (1<<6)
#define SEPG_DIR__READ (SEPG_FILE__READ)
#define SEPG_DIR__WRITE (SEPG_FILE__WRITE)
#define SEPG_DIR__CREATE (SEPG_FILE__CREATE)
#define SEPG_DIR__GETATTR (SEPG_FILE__GETATTR)
#define SEPG_DIR__UNLINK (SEPG_FILE__UNLINK)
#define SEPG_DIR__RENAME (SEPG_FILE__RENAME)
#define SEPG_DIR__SEARCH (1<<6)
#define SEPG_DIR__ADD_NAME (1<<7)
#define SEPG_DIR__REMOVE_NAME (1<<8)
#define SEPG_DIR__RMDIR (1<<9)
#define SEPG_DIR__REPARENT (1<<10)
#define SEPG_LNK_FILE__READ (SEPG_FILE__READ)
#define SEPG_LNK_FILE__WRITE (SEPG_FILE__WRITE)
#define SEPG_LNK_FILE__CREATE (SEPG_FILE__CREATE)
#define SEPG_LNK_FILE__GETATTR (SEPG_FILE__GETATTR)
#define SEPG_LNK_FILE__UNLINK (SEPG_FILE__UNLINK)
#define SEPG_LNK_FILE__RENAME (SEPG_FILE__RENAME)
#define SEPG_CHR_FILE__READ (SEPG_FILE__READ)
#define SEPG_CHR_FILE__WRITE (SEPG_FILE__WRITE)
#define SEPG_CHR_FILE__CREATE (SEPG_FILE__CREATE)
#define SEPG_CHR_FILE__GETATTR (SEPG_FILE__GETATTR)
#define SEPG_CHR_FILE__UNLINK (SEPG_FILE__UNLINK)
#define SEPG_CHR_FILE__RENAME (SEPG_FILE__RENAME)
#define SEPG_BLK_FILE__READ (SEPG_FILE__READ)
#define SEPG_BLK_FILE__WRITE (SEPG_FILE__WRITE)
#define SEPG_BLK_FILE__CREATE (SEPG_FILE__CREATE)
#define SEPG_BLK_FILE__GETATTR (SEPG_FILE__GETATTR)
#define SEPG_BLK_FILE__UNLINK (SEPG_FILE__UNLINK)
#define SEPG_BLK_FILE__RENAME (SEPG_FILE__RENAME)
#define SEPG_SOCK_FILE__READ (SEPG_FILE__READ)
#define SEPG_SOCK_FILE__WRITE (SEPG_FILE__WRITE)
#define SEPG_SOCK_FILE__CREATE (SEPG_FILE__CREATE)
#define SEPG_SOCK_FILE__GETATTR (SEPG_FILE__GETATTR)
#define SEPG_SOCK_FILE__UNLINK (SEPG_FILE__UNLINK)
#define SEPG_SOCK_FILE__RENAME (SEPG_FILE__RENAME)
#define SEPG_FIFO_FILE__READ (SEPG_FILE__READ)
#define SEPG_FIFO_FILE__WRITE (SEPG_FILE__WRITE)
#define SEPG_FIFO_FILE__CREATE (SEPG_FILE__CREATE)
#define SEPG_FIFO_FILE__GETATTR (SEPG_FILE__GETATTR)
#define SEPG_FIFO_FILE__UNLINK (SEPG_FILE__UNLINK)
#define SEPG_FIFO_FILE__RENAME (SEPG_FILE__RENAME)
#define SEPG_DB_DATABASE__CREATE (1<<0)
#define SEPG_DB_DATABASE__DROP (1<<1)
#define SEPG_DB_DATABASE__GETATTR (1<<2)
#define SEPG_DB_DATABASE__SETATTR (1<<3)
#define SEPG_DB_DATABASE__RELABELFROM (1<<4)
#define SEPG_DB_DATABASE__RELABELTO (1<<5)
#define SEPG_DB_DATABASE__ACCESS (1<<6)
#define SEPG_DB_DATABASE__LOAD_MODULE (1<<7)
#define SEPG_DB_SCHEMA__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_SCHEMA__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_SCHEMA__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_SCHEMA__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_SCHEMA__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_SCHEMA__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_SCHEMA__SEARCH (1<<6)
#define SEPG_DB_SCHEMA__ADD_NAME (1<<7)
#define SEPG_DB_SCHEMA__REMOVE_NAME (1<<8)
#define SEPG_DB_TABLE__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_TABLE__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_TABLE__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_TABLE__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_TABLE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_TABLE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_TABLE__SELECT (1<<6)
#define SEPG_DB_TABLE__UPDATE (1<<7)
#define SEPG_DB_TABLE__INSERT (1<<8)
#define SEPG_DB_TABLE__DELETE (1<<9)
#define SEPG_DB_TABLE__LOCK (1<<10)
#define SEPG_DB_SEQUENCE__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_SEQUENCE__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_SEQUENCE__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_SEQUENCE__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_SEQUENCE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_SEQUENCE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_SEQUENCE__GET_VALUE (1<<6)
#define SEPG_DB_SEQUENCE__NEXT_VALUE (1<<7)
#define SEPG_DB_SEQUENCE__SET_VALUE (1<<8)
#define SEPG_DB_PROCEDURE__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_PROCEDURE__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_PROCEDURE__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_PROCEDURE__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_PROCEDURE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_PROCEDURE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_PROCEDURE__EXECUTE (1<<6)
#define SEPG_DB_PROCEDURE__ENTRYPOINT (1<<7)
#define SEPG_DB_PROCEDURE__INSTALL (1<<8)
#define SEPG_DB_COLUMN__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_COLUMN__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_COLUMN__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_COLUMN__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_COLUMN__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_COLUMN__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_COLUMN__SELECT (1<<6)
#define SEPG_DB_COLUMN__UPDATE (1<<7)
#define SEPG_DB_COLUMN__INSERT (1<<8)
#define SEPG_DB_TUPLE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_TUPLE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_TUPLE__SELECT (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_TUPLE__UPDATE (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_TUPLE__INSERT (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_TUPLE__DELETE (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_BLOB__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_BLOB__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_BLOB__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_BLOB__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_BLOB__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_BLOB__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_BLOB__READ (1<<6)
#define SEPG_DB_BLOB__WRITE (1<<7)
#define SEPG_DB_BLOB__IMPORT (1<<8)
#define SEPG_DB_BLOB__EXPORT (1<<9)
#define SEPG_DB_LANGUAGE__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_LANGUAGE__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_LANGUAGE__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_LANGUAGE__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_LANGUAGE__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_LANGUAGE__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_LANGUAGE__IMPLEMENT (1<<6)
#define SEPG_DB_LANGUAGE__EXECUTE (1<<7)
#define SEPG_DB_VIEW__CREATE (SEPG_DB_DATABASE__CREATE)
#define SEPG_DB_VIEW__DROP (SEPG_DB_DATABASE__DROP)
#define SEPG_DB_VIEW__GETATTR (SEPG_DB_DATABASE__GETATTR)
#define SEPG_DB_VIEW__SETATTR (SEPG_DB_DATABASE__SETATTR)
#define SEPG_DB_VIEW__RELABELFROM (SEPG_DB_DATABASE__RELABELFROM)
#define SEPG_DB_VIEW__RELABELTO (SEPG_DB_DATABASE__RELABELTO)
#define SEPG_DB_VIEW__EXPAND (1<<6)
/*
* hooks.c
*/
extern bool sepgsql_get_permissive(void);
extern bool sepgsql_get_debug_audit(void);
/*
* selinux.c
*/
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
extern bool sepgsql_is_enabled(void);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern int sepgsql_get_mode(void);
extern int sepgsql_set_mode(int new_mode);
extern bool sepgsql_getenforce(void);
extern void sepgsql_audit_log(bool denied,
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
const char *scontext,
const char *tcontext,
uint16 tclass,
uint32 audited,
const char *audit_name);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern void sepgsql_compute_avd(const char *scontext,
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
const char *tcontext,
uint16 tclass,
struct av_decision * avd);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern char *sepgsql_compute_create(const char *scontext,
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
const char *tcontext,
Allow sepgsql labels to depend on object name. The main change here is to call security_compute_create_name_raw() rather than security_compute_create_raw(). This ups the minimum requirement for libselinux from 2.0.99 to 2.1.10, but it looks like most distributions will have picked that up before 9.3 is out. KaiGai Kohei
2013-03-29 03:38:35 +08:00
uint16 tclass,
const char *objname);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern bool sepgsql_check_perms(const char *scontext,
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
const char *tcontext,
uint16 tclass,
uint32 required,
const char *audit_name,
sepgsql cleanups. This is needed to match recent changes elsewhere. Along the way, some renaming for clarity. KaiGai Kohei
2012-09-06 02:01:15 +08:00
bool abort_on_violation);
Run pgindent on 9.2 source tree in preparation for first 9.3 commit-fest.
2012-06-11 03:20:04 +08:00
Userspace access vector cache for contrib/sepgsql. KaiGai Kohei
2011-09-01 20:37:33 +08:00
/*
* uavc.c
*/
#define SEPGSQL_AVC_NOAUDIT ((void *)(-1))
extern bool sepgsql_avc_check_perms_label(const char *tcontext,
Run pgindent on 9.2 source tree in preparation for first 9.3 commit-fest.
2012-06-11 03:20:04 +08:00
uint16 tclass,
uint32 required,
const char *audit_name,
sepgsql cleanups. This is needed to match recent changes elsewhere. Along the way, some renaming for clarity. KaiGai Kohei
2012-09-06 02:01:15 +08:00
bool abort_on_violation);
Userspace access vector cache for contrib/sepgsql. KaiGai Kohei
2011-09-01 20:37:33 +08:00
extern bool sepgsql_avc_check_perms(const ObjectAddress *tobject,
Run pgindent on 9.2 source tree in preparation for first 9.3 commit-fest.
2012-06-11 03:20:04 +08:00
uint16 tclass,
uint32 required,
const char *audit_name,
sepgsql cleanups. This is needed to match recent changes elsewhere. Along the way, some renaming for clarity. KaiGai Kohei
2012-09-06 02:01:15 +08:00
bool abort_on_violation);
Userspace access vector cache for contrib/sepgsql. KaiGai Kohei
2011-09-01 20:37:33 +08:00
extern char *sepgsql_avc_trusted_proc(Oid functionId);
extern void sepgsql_avc_init(void);
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
/*
* label.c
*/
extern char *sepgsql_get_client_label(void);
Run pgindent on 9.2 source tree in preparation for first 9.3 commit-fest.
2012-06-11 03:20:04 +08:00
extern void sepgsql_init_client_label(void);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern char *sepgsql_get_label(Oid relOid, Oid objOid, int32 subId);
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
extern void sepgsql_object_relabel(const ObjectAddress *object,
const char *seclabel);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern Datum sepgsql_getcon(PG_FUNCTION_ARGS);
sepgsql_setcon(). This is intended as infrastructure to allow sepgsql to cooperate with connection pooling software, by allowing the effective security label to be set for each new connection. KaiGai Kohei, reviewed by Yeb Havinga.
2012-03-16 04:08:40 +08:00
extern Datum sepgsql_setcon(PG_FUNCTION_ARGS);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern Datum sepgsql_mcstrans_in(PG_FUNCTION_ARGS);
extern Datum sepgsql_mcstrans_out(PG_FUNCTION_ARGS);
extern Datum sepgsql_restorecon(PG_FUNCTION_ARGS);
/*
* dml.c
*/
sepgsql cleanups. This is needed to match recent changes elsewhere. Along the way, some renaming for clarity. KaiGai Kohei
2012-09-06 02:01:15 +08:00
extern bool sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
Teach sepgsql about database labels. This is still a bit of a hack, but it's better than the old way, for sure. KaiGai Kohei, with one change by me to make it compile
2011-09-24 05:09:34 +08:00
/*
* database.c
*/
sepgsql: Check CREATE permissions for some object types. KaiGai Kohei, reviewed by Dimitri Fontaine and me.
2011-12-21 22:12:43 +08:00
extern void sepgsql_database_post_create(Oid databaseId,
Run pgindent on 9.2 source tree in preparation for first 9.3 commit-fest.
2012-06-11 03:20:04 +08:00
const char *dtemplate);
sepgsql DROP support. KaiGai Kohei
2012-03-10 04:18:45 +08:00
extern void sepgsql_database_drop(Oid databaseId);
Teach sepgsql about database labels. This is still a bit of a hack, but it's better than the old way, for sure. KaiGai Kohei, with one change by me to make it compile
2011-09-24 05:09:34 +08:00
extern void sepgsql_database_relabel(Oid databaseId, const char *seclabel);
sepgsql: Support for new post-ALTER access hook. KaiGai Kohei
2013-03-27 20:10:14 +08:00
extern void sepgsql_database_setattr(Oid databaseId);
Teach sepgsql about database labels. This is still a bit of a hack, but it's better than the old way, for sure. KaiGai Kohei, with one change by me to make it compile
2011-09-24 05:09:34 +08:00
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
/*
* schema.c
*/
extern void sepgsql_schema_post_create(Oid namespaceId);
sepgsql DROP support. KaiGai Kohei
2012-03-10 04:18:45 +08:00
extern void sepgsql_schema_drop(Oid namespaceId);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern void sepgsql_schema_relabel(Oid namespaceId, const char *seclabel);
sepgsql: Support for new post-ALTER access hook. KaiGai Kohei
2013-03-27 20:10:14 +08:00
extern void sepgsql_schema_setattr(Oid namespaceId);
sepgsql: Enforce db_schema:search permission. KaiGai Kohei, with comment and doc wordsmithing by me
2013-04-05 20:51:31 +08:00
extern bool sepgsql_schema_search(Oid namespaceId, bool abort_on_violation);
sepgsql: Support for new post-ALTER access hook. KaiGai Kohei
2013-03-27 20:10:14 +08:00
extern void sepgsql_schema_add_name(Oid namespaceId);
extern void sepgsql_schema_remove_name(Oid namespaceId);
extern void sepgsql_schema_rename(Oid namespaceId);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
/*
* relation.c
*/
extern void sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum);
sepgsql DROP support. KaiGai Kohei
2012-03-10 04:18:45 +08:00
extern void sepgsql_attribute_drop(Oid relOid, AttrNumber attnum);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern void sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum,
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
const char *seclabel);
sepgsql: Support for new post-ALTER access hook. KaiGai Kohei
2013-03-27 20:10:14 +08:00
extern void sepgsql_attribute_setattr(Oid relOid, AttrNumber attnum);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern void sepgsql_relation_post_create(Oid relOid);
sepgsql DROP support. KaiGai Kohei
2012-03-10 04:18:45 +08:00
extern void sepgsql_relation_drop(Oid relOid);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern void sepgsql_relation_relabel(Oid relOid, const char *seclabel);
Add context info to OAT_POST_CREATE security hook ... and have sepgsql use it to determine whether to check permissions during certain operations. Indexes that are being created as a result of REINDEX, for instance, do not need to have their permissions checked; they were already checked when the index was created. Author: KaiGai Kohei, slightly revised by me
2012-10-24 05:07:26 +08:00
extern void sepgsql_relation_setattr(Oid relOid);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
/*
* proc.c
*/
extern void sepgsql_proc_post_create(Oid functionId);
sepgsql DROP support. KaiGai Kohei
2012-03-10 04:18:45 +08:00
extern void sepgsql_proc_drop(Oid functionId);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
extern void sepgsql_proc_relabel(Oid functionId, const char *seclabel);
sepgsql: Support for new post-ALTER access hook. KaiGai Kohei
2013-03-27 20:10:14 +08:00
extern void sepgsql_proc_setattr(Oid functionId);
sepgsql: Enforce db_procedure:{execute} permission. To do this, we add an additional object access hook type, OAT_FUNCTION_EXECUTE. KaiGai Kohei
2013-04-12 20:55:56 +08:00
extern void sepgsql_proc_execute(Oid functionId);
sepgsql, an SE-Linux integration for PostgreSQL This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic framework in place. KaiGai Kohei
2011-01-24 09:44:48 +08:00
pgindent run before PG 9.1 beta 1.
2011-04-10 23:42:00 +08:00
#endif /* SEPGSQL_H */
Reference in New Issue Copy Permalink