[BUG] legacy typenames of se-postgresql still remain

[KaiGai Kohei]

Daniel J Walsh wrote:
> KaiGai Kohei wrote:
>> Sorry, the previous patch was imcomplete one.
>>
>> We allows sepgsql_client_type and sepgsql_unconfined_type to invoke
>> sepgsql_trusted_proc_t, but it should be sepgsql_trusted_proc_exec_t,
>> because sepgsql_trusted_proc_t is a domain.
>>
>> This matter also exists at upstreamed policy now.
>> The attached "refpolicy-sepgsql-trusted-proc-fixes.patch" can be applied
>> to upstreamed reference policy.
>>
>> Thanks,
>>
>> KaiGai Kohei wrote:
>>> I got the following access denied logs, when I tries to connect
>>> SE-PostgreSQL (postgresql_t) from PHP script (httpd_t) via unix
>>> domain socket (/tmp/.s.PGSQL.5432).
>>>
>>> type=AVC msg=audit(1218613044.484:10388): avc:  denied  { write }
>>>     for  pid=4805 comm="httpd" name=".s.PGSQL.5432" dev=sda6 ino=1079246
>>>     scontext=unconfined_u:system_r:httpd_t:s0
>>>     tcontext=unconfined_u:object_r:postgresql_tmp_t:s0
>>>     tclass=sock_file
>>> type=AVC msg=audit(1218613044.484:10388): avc:  denied  { connectto }
>>>     for  pid=4805 comm="httpd" path="/tmp/.s.PGSQL.5432"
>>>     scontext=unconfined_u:system_r:httpd_t:s0
>>>     tcontext=unconfined_u:system_r:postgresql_t:s0
>>>     tclass=unix_stream_socket
>>>
>>> However, both permissions are allowed via postgresql_stream_connect()
>>> independent from any booleans, if required types are provided by
>>> postgresql.te.
>>>
>>> postgresql_stream_connect() and postgresql_unpriv_client() are put
>>> within same optional_policy section at apache.te.
>>> postgresql_unpriv_client() requires trusted procedure related types,
>>> but postgresql.te declares them in legacy names.
>>>
>>>  old: sepgsql_trusted_domain_t --> new: sepgsql_trusted_proc_t
>>>  old: sepgsql_trusted_proc_t   --> new: sepgsql_trusted_proc_exec_t
>>>
>>> Could you apply the attached patch?
>>> It fixes them as upstream doing.
>>>
>>> Thanks,
>>>
>>>
>>> ------------------------------------------------------------------------
>>>
>>> --
>>> fedora-selinux-list mailing list
>>> fedora-selinux-list at redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>
> Fedora 9?  Rawhide?

Sorry, I missed the version.
It is in Rawhide. (selinux-policy-3.5.1-4.fc10)

Thanks,
-- 
KaiGai Kohei <kaigai at kaigai.gr.jp>