rpms/sepostgresql/devel sepostgresql.if, 1.1, 1.2 sepostgresql.init, 1.14, 1.15 sepostgresql.spec, 1.15, 1.16 sepostgresql.te, 1.14, 1.15

[KaiGai Kohei (kaigai)]

Author: kaigai

Update of /cvs/pkgs/rpms/sepostgresql/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv18084

Modified Files:
	sepostgresql.if sepostgresql.init sepostgresql.spec 
	sepostgresql.te 
Log Message:
sepostgresql security policy module updated.



Index: sepostgresql.if
===================================================================
RCS file: /cvs/pkgs/rpms/sepostgresql/devel/sepostgresql.if,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- sepostgresql.if	1 Sep 2007 13:07:32 -0000	1.1
+++ sepostgresql.if	27 Feb 2008 09:49:39 -0000	1.2
@@ -1,11 +1,11 @@
 ########################################
 ## <summary>
-##     marks as a server process of SE-PostgreSQL.
+##      Marks the specified domain as SE-PostgreSQL server process.
 ## </summary>
-## <param name="type">
-##     <summary>
-##     Type marked as a database object type.
-##     </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to be marked
+##      </summary>
 ## </param>
 #
 interface(`sepgsql_server_domain',`
@@ -17,53 +17,72 @@
 
 ########################################
 ## <summary>
-##     Marks as a SE-PostgreSQL loadable shared library module
+##      Allow the specified domain unconfined accesses to any database objects
+##  managed by SE-PostgreSQL,
 ## </summary>
-## <param name="type">
-##     <summary>
-##     Type marked as a database object type.
-##     </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
 ## </param>
 #
-interface(`sepgsql_module_object',`
+interface(`sepgsql_unconfined_domain',`
 	gen_require(`
-		attribute sepgsql_module_type;
+		attribute sepgsql_unconfined_type;
+		attribute sepgsql_client_type;
 	')
-	typeattribute $1 sepgsql_module_type;
+	typeattribute $1 sepgsql_unconfined_type;
+	typeattribute $1 sepgsql_client_type;
 ')
 
 ########################################
 ## <summary>
-##     marks as a administrative client process of SE-PostgreSQL.
+##      Allow the specified domain unprivileged accesses to any database objects
+##  managed by SE-PostgreSQL,
 ## </summary>
-## <param name="type">
-##     <summary>
-##     A domain marked as a administrative client domain
-##     </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
 ## </param>
 #
-interface(`sepgsql_unconfined_domain',`
+interface(`sepgsql_client_domain',`
 	gen_require(`
-		attribute sepgsql_admin_domain;
-		attribute sepgsql_users_domain;
+		attribute sepgsql_client_type;
 	')
-	typeattribute $1 sepgsql_admin_domain;
-	typeattribute $1 sepgsql_users_domain;
+	typeattribute $1 sepgsql_client_type;
 ')
 
 ########################################
 ## <summary>
-##     marks as a generic client process of SE-PostgreSQL.
+##      Allow the specified role to invoke trusted procedures
+## </summary>
+## <param name="role">
+##  <summary>
+##  The role associated with the domain.
+##  </summary>
+## </param>
+#
+interface(`sepgsql_trusted_procedure_role',`
+	gen_require(`
+		type sepgsql_trusted_domain_t;
+	')
+	role $1 types sepgsql_trusted_domain_t;
+')
+
+########################################
+## <summary>
+##     Marks as a SE-PostgreSQL loadable shared library module
 ## </summary>
 ## <param name="type">
 ##     <summary>
-##     A domain marked as a generic client domain
+##     Type marked as a database object type.
 ##     </summary>
 ## </param>
 #
-interface(`sepgsql_client_domain',`
+interface(`sepgsql_loadable_module',`
 	gen_require(`
-		attribute sepgsql_users_domain;
+		attribute sepgsql_module_type;
 	')
-	typeattribute $1 sepgsql_users_domain;
+	typeattribute $1 sepgsql_module_type;
 ')


Index: sepostgresql.init
===================================================================
RCS file: /cvs/pkgs/rpms/sepostgresql/devel/sepostgresql.init,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- sepostgresql.init	26 Feb 2008 08:04:10 -0000	1.14
+++ sepostgresql.init	27 Feb 2008 09:49:39 -0000	1.15
@@ -9,7 +9,7 @@
 
 PGVERSION="8.3.0"
 PGMAJORVERSION=`echo "$PGVERSION" | sed 's/^\([0-9]*\.[0-9a-z]*\).*$/\1/'`
-SEPGVERSION="2.113"
+SEPGVERSION="2.117"
 
 # source function library
 . /etc/rc.d/init.d/functions


Index: sepostgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/sepostgresql/devel/sepostgresql.spec,v
retrieving revision 1.15
retrieving revision 1.16
diff -u -r1.15 -r1.16
--- sepostgresql.spec	26 Feb 2008 08:09:33 -0000	1.15
+++ sepostgresql.spec	27 Feb 2008 09:49:39 -0000	1.16
@@ -8,12 +8,12 @@
 %define selinux_variants mls strict targeted
 
 # SE-PostgreSQL status extension
-%{!?sepgsql_extension:%define sepgsql_extension .beta}
+
 
 Summary: Security Enhanced PostgreSQL
 Name: sepostgresql
 Version: 8.3.0
-Release: 2.114%{?sepgsql_extension}%{?dist}
+Release: 2.117%{?sepgsql_extension}%{?dist}
 License: BSD
 Group: Applications/Databases
 Url: http://code.google.com/p/sepgsql/
@@ -211,7 +211,13 @@
 %attr(700,sepgsql,sepgsql) %dir %{_localstatedir}/lib/sepgsql/backups
 
 %changelog
-* Tue Feb 26 2008 <kaigai at kaigai.gr.jp> - sepostgresql-8.3.0-2.114
+* Wed Feb 27 2008 <kaigai at kaigai.gr.jp> - sepostgresql-8.3.0-2.117
+- ".beta" removed.
+
+* Wed Feb 27 2008 <kaigai at kaigai.gr.jp> - sepostgresql-8.3.0-2.114
+- Security policy updates
+
+* Tue Feb 26 2008 <kaigai at kaigai.gr.jp> - sepostgresql-8.3.0-2.113
 - BUGFIX: CREATE/ALTER TABLE with CONTEXT='...' did nothing.
 
 * Thu Feb  7 2008 <kaigai at kaigai.gr.jp> - sepostgresql-8.3.0-2.108


Index: sepostgresql.te
===================================================================
RCS file: /cvs/pkgs/rpms/sepostgresql/devel/sepostgresql.te,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- sepostgresql.te	26 Feb 2008 08:04:10 -0000	1.14
+++ sepostgresql.te	27 Feb 2008 09:49:39 -0000	1.15
@@ -1,85 +1,243 @@
-policy_module(sepostgresql, 2.113)
+policy_module(sepostgresql, 2.117)
 
 gen_require(`
 	all_userspace_class_perms
 
-	type postgresql_t;
-	type lib_t, shlib_t;
-	type unlabeled_t;
+	type postgresql_t, unlabeled_t;
+	attribute domain, file_type;
 
-	attribute domain;
-	attribute file_type;
+	role system_r;
 ')
 
-########################################
+#################################
 #
-# Declarations
+# SE-PostgreSQL Boolean declarations
 #
 
-# ---- Booleans ----
+## <desc>
+## <p>
+## Allow to enable unconfined domains
+## </p>
+## </desc>
 gen_tunable(sepgsql_enable_unconfined, true)
+
+## <desc>
+## <p>
+## Allow to generate auditallow logs
+## </p>
+## </desc>
 gen_tunable(sepgsql_enable_auditallow, false)
+
+## <desc>
+## <p>
+## Allow to generate auditdeny logs
+## </p>
+## </desc>
 gen_tunable(sepgsql_enable_auditdeny,  true)
+
+## <desc>
+## <p>
+## Allow to generate audit(allow|deny) logs for tuples
+## </p>
+## </desc>
 gen_tunable(sepgsql_enable_audittuple, false)
+
+## <desc>
+## <p>
+## Allow unprivileged users to execute DDL statement
+## </p>
+## </desc>
 gen_tunable(sepgsql_enable_users_ddl,  true)
 
-# ---- Database client type ----
-attribute sepgsql_admin_domain;
-attribute sepgsql_users_domain;
+#################################
+#
+# SE-PostgreSQL Type/Attribute declarations
+#
 
-# ---- Database object type ----
+# database subjects
 attribute sepgsql_server_type;
+attribute sepgsql_client_type;
+attribute sepgsql_unconfined_type;
+
+# database objects attribute
 attribute sepgsql_database_type;
 attribute sepgsql_table_type;
 attribute sepgsql_procedure_type;
 attribute sepgsql_blob_type;
 attribute sepgsql_module_type;
 
-#---------------------------------------
-# SE-PostgreSQL userspace-managed objects
+# database trusted domain
+type sepgsql_trusted_domain_t;
 
-# for database class
+# database object types
 type sepgsql_db_t,		sepgsql_database_type;
 
-# for table/column/tuple class
 type sepgsql_table_t,		sepgsql_table_type;
 type sepgsql_sysobj_t,		sepgsql_table_type;
 type sepgsql_secret_table_t,	sepgsql_table_type;
 type sepgsql_ro_table_t,	sepgsql_table_type;
 type sepgsql_fixed_table_t,	sepgsql_table_type;
 
-# for procedure class
 type sepgsql_proc_t,		sepgsql_procedure_type;
 type sepgsql_user_proc_t,	sepgsql_procedure_type;
 type sepgsql_trusted_proc_t,	sepgsql_procedure_type;
 
-# for blob class
 type sepgsql_blob_t,		sepgsql_blob_type;
 type sepgsql_ro_blob_t,		sepgsql_blob_type;
 type sepgsql_secret_blob_t,	sepgsql_blob_type;
 
-#---------------------------------------
-# SE-PostgreSQL trusted procedure domain
-type sepgsql_trusted_domain_t;
+typeattribute unlabeled_t	sepgsql_database_type;
+typeattribute unlabeled_t	sepgsql_table_type;
+typeattribute unlabeled_t	sepgsql_procedure_type;
+typeattribute unlabeled_t	sepgsql_blob_type;
+
+########################################
+#
+# SE-PostgreSQL Server Local policy
+#                    (sepgsql_server_type)
+allow sepgsql_server_type self : netlink_selinux_socket create_socket_perms;
+selinux_get_fs_mount(sepgsql_server_type)
+selinux_get_enforce_mode(sepgsql_server_type)
+selinux_validate_context(sepgsql_server_type)
+selinux_compute_access_vector(sepgsql_server_type)
+selinux_compute_create_context(sepgsql_server_type)
+selinux_compute_relabel_context(sepgsql_server_type)
+
+allow sepgsql_server_type sepgsql_database_type : db_database *;
+allow sepgsql_server_type sepgsql_module_type : db_database { install_module };
+allow sepgsql_server_type sepgsql_table_type : { db_table db_column db_tuple } *;
+allow sepgsql_server_type sepgsql_procedure_type : db_procedure *;
+allow sepgsql_server_type sepgsql_blob_type : db_blob *;
+
+# server specific type transitions
+type_transition sepgsql_server_type sepgsql_database_type : db_table sepgsql_sysobj_t;
+type_transition sepgsql_server_type sepgsql_database_type : db_procedure sepgsql_proc_t;
+
+########################################
+#
+# SE-PostgreSQL Administrative domain local policy
+#                    (sepgsql_unconfined_type)
+
+tunable_policy(`sepgsql_enable_unconfined',`
+	allow sepgsql_unconfined_type sepgsql_database_type : db_database *;
+	allow sepgsql_unconfined_type sepgsql_module_type : db_database { install_module };
+	allow sepgsql_unconfined_type sepgsql_table_type : { db_table db_column db_tuple } *;
+	allow sepgsql_unconfined_type { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure *;
+	allow sepgsql_unconfined_type sepgsql_user_proc_t : db_procedure { create drop getattr setattr relabelfrom relabelto };
+	allow sepgsql_unconfined_type sepgsql_blob_type : db_blob *;
+	allow sepgsql_unconfined_type postgresql_t : db_blob { import export };
+
+	type_transition { sepgsql_unconfined_type - sepgsql_server_type } sepgsql_database_type : db_procedure sepgsql_proc_t;
+',`
+	type_transition { sepgsql_unconfined_type - sepgsql_server_type } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
+')
+
+########################################
+#
+# SE-PostgreSQL Users domain local policy
+#                     (sepgsql_client_type)
+
+allow sepgsql_client_type sepgsql_db_t : db_database { getattr access get_param set_param};
+
+allow sepgsql_client_type sepgsql_table_t : db_table { getattr use select update insert delete };
+allow sepgsql_client_type sepgsql_table_t : db_column { getattr use select update insert };
+allow sepgsql_client_type sepgsql_table_t : db_tuple { use select update insert delete };
+
+allow sepgsql_client_type sepgsql_sysobj_t : db_table { getattr use select };
+allow sepgsql_client_type sepgsql_sysobj_t : db_column { getattr use select };
+allow sepgsql_client_type sepgsql_sysobj_t : db_tuple { use select };
+tunable_policy(`sepgsql_enable_users_ddl',`
+	allow sepgsql_client_type sepgsql_table_t : db_table { create drop setattr };
+	allow sepgsql_client_type sepgsql_table_t : db_column { create drop setattr };
+	allow sepgsql_client_type sepgsql_sysobj_t : db_tuple { update insert delete };
+')
+
+allow sepgsql_client_type sepgsql_secret_table_t : db_table { getattr };
+allow sepgsql_client_type sepgsql_secret_table_t : db_column { getattr };
+
+allow sepgsql_client_type sepgsql_ro_table_t : db_table { getattr use select };
+allow sepgsql_client_type sepgsql_ro_table_t : db_column { getattr use select };
+allow sepgsql_client_type sepgsql_ro_table_t : db_tuple { use select };
+
+allow sepgsql_client_type sepgsql_fixed_table_t : db_table { getattr use select insert };
+allow sepgsql_client_type sepgsql_fixed_table_t : db_column { getattr use select insert };
+allow sepgsql_client_type sepgsql_fixed_table_t : db_tuple { use select insert };
+
+allow sepgsql_client_type sepgsql_proc_t : db_procedure { getattr execute };
+allow { sepgsql_client_type - sepgsql_unconfined_type } sepgsql_user_proc_t : db_procedure { create drop getattr setattr execute };
+allow sepgsql_client_type sepgsql_trusted_proc_t : db_procedure { getattr execute entrypoint };
+
+allow sepgsql_client_type sepgsql_blob_t : db_blob { create drop getattr setattr read write };
+allow sepgsql_client_type sepgsql_ro_blob_t : db_blob { getattr read };
+allow sepgsql_client_type sepgsql_secret_blob_t : db_blob { getattr };
+
+# call trusted procedure
+type_transition sepgsql_client_type sepgsql_trusted_proc_t : process sepgsql_trusted_domain_t;
+allow sepgsql_client_type sepgsql_trusted_domain_t : process { transition };
+
+# type transitions for rest of domains
+type_transition domain domain : db_database sepgsql_db_t;
+type_transition { domain - sepgsql_server_type } sepgsql_database_type : db_table sepgsql_table_t;
+type_transition { domain - sepgsql_server_type - sepgsql_unconfined_type } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
+type_transition domain sepgsql_database_type : db_blob sepgsql_blob_t;
+
+########################################
+#
+# SE-PostgreSQL Misc policies
+#
+
+# Trusted Procedure Domain
 domain_type(sepgsql_trusted_domain_t)
+role system_r types sepgsql_trusted_domain_t;
 sepgsql_unconfined_domain(sepgsql_trusted_domain_t)
 
-#---------------------------------------
-# SE-PostgreSQL loadable shared library modules
-sepgsql_module_object(lib_t)
-sepgsql_module_object(shlib_t)
-
-#---------------------------------------
-# unlabeled object (unlabeled_t)
-typeattribute unlabeled_t sepgsql_database_type;
-typeattribute unlabeled_t sepgsql_table_type;
-typeattribute unlabeled_t sepgsql_procedure_type;
-typeattribute unlabeled_t sepgsql_blob_type;
+# The following permissions are allowed, even if sepgsql_enable_unconfined is disabled.
+allow sepgsql_trusted_domain_t sepgsql_database_type : db_database { getattr setattr access get_param set_param};
+allow sepgsql_trusted_domain_t sepgsql_table_type : db_table { getattr use select update insert delete lock };
+allow sepgsql_trusted_domain_t sepgsql_table_type : db_column { getattr use select update insert };
+allow sepgsql_trusted_domain_t sepgsql_table_type : db_tuple { use select update insert delete };
+
+allow sepgsql_trusted_domain_t { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure { getattr execute };
+allow sepgsql_trusted_domain_t sepgsql_user_proc_t : db_procedure { getattr };
+allow sepgsql_trusted_domain_t sepgsql_blob_type : db_blob { getattr setattr read write };
+
+# Database/Loadable module
+allow sepgsql_database_type sepgsql_module_type : db_database { load_module };
 
 ########################################
 #
-# SE-PostgreSQL server domain's policy
+# SE-PostgreSQL audit switch
 #
+tunable_policy(`sepgsql_enable_auditallow',`
+	auditallow domain sepgsql_database_type  : db_database all_db_database_perms;
+	auditallow domain sepgsql_table_type     : db_table all_db_table_perms;
+	auditallow domain sepgsql_table_type     : db_column all_db_column_perms;
+	auditallow domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
+	auditallow domain sepgsql_blob_type      : db_blob all_db_blob_perms;
+	auditallow domain sepgsql_server_type    : db_blob { import export };
+	auditallow domain sepgsql_module_type    : db_database { install_module };
+')
+tunable_policy(`sepgsql_enable_audittuple && sepgsql_enable_auditallow',`
+	auditallow domain sepgsql_table_type     : db_tuple all_db_tuple_perms;
+')
+tunable_policy(`! sepgsql_enable_auditdeny',`
+	dontaudit domain sepgsql_database_type   : db_database all_db_database_perms;
+	dontaudit domain sepgsql_table_type      : db_table all_db_table_perms;
+	dontaudit domain sepgsql_table_type      : db_column all_db_column_perms;
+	dontaudit domain sepgsql_procedure_type  : db_procedure all_db_procedure_perms;
+	dontaudit domain sepgsql_blob_type       : db_blob all_db_blob_perms;
+	dontaudit domain sepgsql_server_type     : db_blob { import export };
+	dontaudit domain sepgsql_module_type     : db_database { install_module };
+')
+tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
+	dontaudit domain sepgsql_table_type      : db_tuple all_db_tuple_perms;
+')
+########################################
+#
+# Allow permission to external domains
+#
+
+# server domains
 optional_policy(`
 	gen_require(`
 		type postgresql_t;
@@ -87,12 +245,7 @@
 	sepgsql_server_domain(postgresql_t)
 ')
 
-########################################
-#
-# SE-PostgreSQL client domains
-#
-
-# -- unconfined_t --
+# unconfined client domain
 optional_policy(`
 	gen_require(`
 		type unconfined_t;
@@ -100,7 +253,6 @@
 	sepgsql_unconfined_domain(unconfined_t)
 ')
 
-# -- sysadm_t --
 optional_policy(`
 	gen_require(`
 		type sysadm_t;
@@ -108,39 +260,52 @@
 	sepgsql_unconfined_domain(sysadm_t)
 ')
 
-# -- user_t --
+# generic client domain
 optional_policy(`
 	gen_require(`
 		type user_t;
+		role user_r;
 	')
 	sepgsql_client_domain(user_t)
+	sepgsql_trusted_procedure_role(user_r)
 ')
 
-# -- staff_t --
 optional_policy(`
 	gen_require(`
 		type staff_t;
+		role staff_r;
 	')
 	sepgsql_client_domain(staff_t)
+	sepgsql_trusted_procedure_role(staff_r)
+')
+
+optional_policy(`
+	gen_require(`
+		type user_t;
+		role user_r;
+	')
+	sepgsql_client_domain(user_t)
+	sepgsql_trusted_procedure_role(user_r)
 ')
 
-# -- guest_t --
 optional_policy(`
 	gen_require(`
 		type guest_t;
+		role guest_r;
 	')
 	sepgsql_client_domain(guest_t)
+	sepgsql_trusted_procedure_role(guest_r)
 ')
 
-# -- httpd_t (PHP script) --
 optional_policy(`
 	gen_require(`
-		type httpd_t;
+		type xguest_t;
+		role xguest_r;
 	')
-	sepgsql_client_domain(httpd_t)
+	sepgsql_client_domain(xguest_t)
+	sepgsql_trusted_procedure_role(xguest_r)
 ')
 
-# -- httpd_sys_script_t (CGI script) --
 optional_policy(`
 	gen_require(`
 		type httpd_sys_script_t;
@@ -148,138 +313,27 @@
 	sepgsql_client_domain(httpd_sys_script_t)
 ')
 
-########################################
-#
-# SE-PostgreSQL Type Transition
-#
-type_transition domain domain : db_database sepgsql_db_t;
-type_transition { domain - sepgsql_server_type } sepgsql_database_type : db_table sepgsql_table_t;
-type_transition sepgsql_server_type sepgsql_database_type : db_table sepgsql_sysobj_t;
-type_transition domain sepgsql_database_type : db_blob sepgsql_blob_t;
-
-########################################
-#
-# SE-PostgreSQL policy for server domain
-#
-allow sepgsql_server_type self : netlink_selinux_socket create_socket_perms;
-selinux_get_fs_mount(sepgsql_server_type)
-selinux_get_enforce_mode(sepgsql_server_type)
-selinux_validate_context(sepgsql_server_type)
-selinux_compute_access_vector(sepgsql_server_type)
-selinux_compute_create_context(sepgsql_server_type)
-selinux_compute_relabel_context(sepgsql_server_type)
-
-allow sepgsql_server_type sepgsql_database_type : db_database all_db_database_perms;
-allow sepgsql_server_type sepgsql_module_type : db_database { install_module };
-allow sepgsql_server_type sepgsql_table_type : db_table all_db_table_perms;
-allow sepgsql_server_type sepgsql_table_type : db_column all_db_column_perms;
-allow sepgsql_server_type sepgsql_table_type : db_tuple all_db_tuple_perms;
-allow sepgsql_server_type sepgsql_procedure_type : db_procedure all_db_procedure_perms;
-allow sepgsql_server_type sepgsql_blob_type : db_blob all_db_blob_perms;
-# type transition for procedure
-type_transition sepgsql_server_type sepgsql_database_type : db_procedure sepgsql_proc_t;
-
-########################################
-#
-# SE-PostgreSQL policy for administrative domain
-#
-tunable_policy(`sepgsql_enable_unconfined',`
-	allow sepgsql_admin_domain sepgsql_database_type : db_database all_db_database_perms;
-	allow sepgsql_admin_domain sepgsql_module_type : db_database { install_module };
-	allow sepgsql_admin_domain sepgsql_table_type : db_table all_db_table_perms;
-	allow sepgsql_admin_domain sepgsql_table_type : db_column all_db_column_perms;
-	allow sepgsql_admin_domain sepgsql_table_type : db_tuple all_db_tuple_perms;
-	allow sepgsql_admin_domain { sepgsql_procedure_type - sepgsql_user_proc_t } : db_procedure all_db_procedure_perms;
-	allow sepgsql_admin_domain sepgsql_user_proc_t : db_procedure { create drop getattr setattr relabelfrom relabelto };
-	allow sepgsql_admin_domain sepgsql_blob_type : db_blob all_db_blob_perms;
-	allow sepgsql_admin_domain sepgsql_server_type : db_blob { import export };
-	# type transition for procedure
-	type_transition sepgsql_admin_domain sepgsql_database_type : db_procedure sepgsql_proc_t;
-',`
-	# type transition for procedure
-	type_transition sepgsql_admin_domain sepgsql_database_type : db_procedure sepgsql_user_proc_t;	
+# RBAC
+optional_policy(`
+	gen_require(`
+		role unconfined_r;
+	')
+	sepgsql_trusted_procedure_role(unconfined_r)
 ')
 
-########################################
-#
-# SE-PostgreSQL policy for generic domain
-#
-
-allow sepgsql_users_domain sepgsql_db_t : db_database { getattr access get_param set_param};
-
-allow sepgsql_users_domain sepgsql_table_t : db_table { getattr use select update insert delete };
-allow sepgsql_users_domain sepgsql_table_t : db_column { getattr use select update insert };
-allow sepgsql_users_domain sepgsql_table_t : db_tuple { use select update insert delete };
-
-allow sepgsql_users_domain sepgsql_sysobj_t : db_table { getattr use select };
-allow sepgsql_users_domain sepgsql_sysobj_t : db_column { getattr use select };
-allow sepgsql_users_domain sepgsql_sysobj_t : db_tuple { use select };
-tunable_policy(`sepgsql_enable_users_ddl',`
-	allow sepgsql_users_domain sepgsql_table_t : db_table { create drop setattr };
-	allow sepgsql_users_domain sepgsql_table_t : db_column { create drop setattr };
-	allow sepgsql_users_domain sepgsql_sysobj_t : db_tuple { update insert delete };
+# loadable module types
+optional_policy(`
+	gen_require(`
+		type lib_t;
+	')
+	sepgsql_loadable_module(lib_t)
 ')
 
-allow sepgsql_users_domain sepgsql_secret_table_t : db_table { getattr };
-allow sepgsql_users_domain sepgsql_secret_table_t : db_column { getattr };
-
-allow sepgsql_users_domain sepgsql_ro_table_t : db_table { getattr use select };
-allow sepgsql_users_domain sepgsql_ro_table_t : db_column { getattr use select };
-allow sepgsql_users_domain sepgsql_ro_table_t : db_tuple { use select };
-
-allow sepgsql_users_domain sepgsql_fixed_table_t : db_table { getattr use select insert };
-allow sepgsql_users_domain sepgsql_fixed_table_t : db_column { getattr use select insert };
-allow sepgsql_users_domain sepgsql_fixed_table_t : db_tuple { use select insert };
-
-allow sepgsql_users_domain sepgsql_proc_t : db_procedure { getattr execute };
-allow { sepgsql_users_domain - sepgsql_admin_domain} sepgsql_user_proc_t : db_procedure { create drop getattr setattr execute };
-allow sepgsql_users_domain sepgsql_trusted_proc_t : db_procedure { getattr execute entrypoint };
-
-allow sepgsql_users_domain sepgsql_blob_t : db_blob { create drop getattr setattr read write };
-allow sepgsql_users_domain sepgsql_ro_blob_t : db_blob { getattr read };
-allow sepgsql_users_domain sepgsql_secret_blob_t : db_blob { getattr };
-
-# type transition for procedure
-type_transition { sepgsql_users_domain - sepgsql_admin_domain } sepgsql_database_type : db_procedure sepgsql_user_proc_t;
-
-# trusted procedure
-type_transition sepgsql_users_domain sepgsql_trusted_proc_t : process sepgsql_trusted_domain_t;
-allow sepgsql_users_domain sepgsql_trusted_domain_t : process { transition };
-
-########################################
-#
-# SE-PostgreSQL loadable shared library policy
-#
-
-allow sepgsql_database_type sepgsql_module_type : db_database { load_module };
-
-########################################
-#
-# SE-PostgreSQL audit switch
-#
-tunable_policy(`sepgsql_enable_auditallow',`
-	auditallow domain sepgsql_database_type : db_database all_db_database_perms;
-	auditallow domain sepgsql_table_type : db_table all_db_table_perms;
-	auditallow domain sepgsql_table_type : db_column all_db_column_perms;
-	auditallow domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
-	auditallow domain sepgsql_blob_type : db_blob all_db_blob_perms;
-	auditallow domain sepgsql_server_type : db_blob { import export };
-	auditallow domain file_type : db_database { install_module };
-')
-tunable_policy(`sepgsql_enable_audittuple && sepgsql_enable_auditallow',`
-	auditallow domain sepgsql_table_type : db_tuple all_db_tuple_perms;
-')
-tunable_policy(`! sepgsql_enable_auditdeny',`
-	dontaudit domain sepgsql_database_type : db_database all_db_database_perms;
-	dontaudit domain sepgsql_table_type : db_table all_db_table_perms;
-	dontaudit domain sepgsql_table_type : db_column all_db_column_perms;
-	dontaudit domain sepgsql_procedure_type : db_procedure all_db_procedure_perms;
-	dontaudit domain sepgsql_blob_type : db_blob all_db_blob_perms;
-	dontaudit domain sepgsql_server_type : db_blob { import export };
-	dontaudit domain file_type : db_database { install_module };
-')
-tunable_policy(`! sepgsql_enable_audittuple || ! sepgsql_enable_auditdeny',`
-	dontaudit domain sepgsql_table_type : db_tuple all_db_tuple_perms;
+optional_policy(`
+	gen_require(`
+		type textrel_shlib_t;
+	')
+	sepgsql_loadable_module(textrel_shlib_t)
 ')
 
 ########################################
@@ -287,24 +341,8 @@
 # Hotfixes for labeled networking
 # 
 # NOTE: These changes are to be merged in the later releases.
+corenet_tcp_recvfrom_labeled(sepgsql_server_type, sepgsql_client_type)
 optional_policy(`
-	gen_require(`
-		attribute sepgsql_server_type;
-		attribute sepgsql_users_domain;
-		attribute unconfined_domain_type;
-		type unlabeled_t;
-		type ipsec_spd_t;
-		type racoon_t;
-	')
-	# allow unconfined_t to set default SPD context
-	allow unconfined_domain_type ipsec_spd_t : association { setcontext };
-	# allow server/client domain to communicate via default SPD context
-	allow { sepgsql_server_type sepgsql_users_domain } ipsec_spd_t : association { polmatch };
-	allow { sepgsql_server_type sepgsql_users_domain } self : association { sendto };
-	allow sepgsql_server_type sepgsql_users_domain : { association tcp_socket } recvfrom;
-	allow sepgsql_users_domain sepgsql_server_type : { association tcp_socket } recvfrom;
-	# racoon_t/unlabeled_t related
-	allow unlabeled_t self : association { sendto };
-	allow unlabeled_t ipsec_spd_t : association { polmatch };
-	allow racoon_t unlabeled_t : association { setcontext };
+	ipsec_match_default_spd(sepgsql_server_type)
+	ipsec_match_default_spd(sepgsql_client_type)
 ')