[BUG] legacy typenames of se-postgresql still remain

[Daniel J Walsh]

KaiGai Kohei wrote:
> Daniel J Walsh wrote:
>> KaiGai Kohei wrote:
>>> Sorry, the previous patch was imcomplete one.
>>>
>>> We allows sepgsql_client_type and sepgsql_unconfined_type to invoke
>>> sepgsql_trusted_proc_t, but it should be sepgsql_trusted_proc_exec_t,
>>> because sepgsql_trusted_proc_t is a domain.
>>>
>>> This matter also exists at upstreamed policy now.
>>> The attached "refpolicy-sepgsql-trusted-proc-fixes.patch" can be applied
>>> to upstreamed reference policy.
>>>
>>> Thanks,
>>>
>>> KaiGai Kohei wrote:
>>>> I got the following access denied logs, when I tries to connect
>>>> SE-PostgreSQL (postgresql_t) from PHP script (httpd_t) via unix
>>>> domain socket (/tmp/.s.PGSQL.5432).
>>>>
>>>> type=AVC msg=audit(1218613044.484:10388): avc:  denied  { write }
>>>>     for  pid=4805 comm="httpd" name=".s.PGSQL.5432" dev=sda6 ino=1079246
>>>>     scontext=unconfined_u:system_r:httpd_t:s0
>>>>     tcontext=unconfined_u:object_r:postgresql_tmp_t:s0
>>>>     tclass=sock_file
>>>> type=AVC msg=audit(1218613044.484:10388): avc:  denied  { connectto }
>>>>     for  pid=4805 comm="httpd" path="/tmp/.s.PGSQL.5432"
>>>>     scontext=unconfined_u:system_r:httpd_t:s0
>>>>     tcontext=unconfined_u:system_r:postgresql_t:s0
>>>>     tclass=unix_stream_socket
>>>>
>>>> However, both permissions are allowed via postgresql_stream_connect()
>>>> independent from any booleans, if required types are provided by
>>>> postgresql.te.
>>>>
>>>> postgresql_stream_connect() and postgresql_unpriv_client() are put
>>>> within same optional_policy section at apache.te.
>>>> postgresql_unpriv_client() requires trusted procedure related types,
>>>> but postgresql.te declares them in legacy names.
>>>>
>>>>  old: sepgsql_trusted_domain_t --> new: sepgsql_trusted_proc_t
>>>>  old: sepgsql_trusted_proc_t   --> new: sepgsql_trusted_proc_exec_t
>>>>
>>>> Could you apply the attached patch?
>>>> It fixes them as upstream doing.
>>>>
>>>> Thanks,
>>>>
>>>>
>>>> ------------------------------------------------------------------------
>>>>
>>>> --
>>>> fedora-selinux-list mailing list
>>>> fedora-selinux-list at redhat.com
>>>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>> Fedora 9?  Rawhide?
> 
> Sorry, I missed the version.
> It is in Rawhide. (selinux-policy-3.5.1-4.fc10)
> 
> Thanks,

Current Rawhide is pretty much the same as upstream.  Here is the only
patch I have on postgresql as of today's rawhide.  Fedora 9 next update
should match this policy in the next update also.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: services_postgresql.patch
URL: <http://listman.redhat.com/archives/fedora-selinux-list/attachments/20080814/323c5207/attachment.ksh>