NB SQL - Revision history

RichardHaines: /* SE-PostgreSQL Overview */

RichardHaines — Sat, 15 Jan 2011 16:39:51 GMT

SE-PostgreSQL Overview

←Older revision		Revision as of 16:39, 15 January 2011
Line 68:		Line 68:
	Because PostgreSQL (and therefore SE-PostgreSQL) handles processes, files and directories as part of database operations, the OM also handles permissions for these objects where needed (see the <tt>sepostgresql-8.4.2-2583.fc12.src</tt> rpm - <tt>perms.c</tt> source code) by re-mapping these permissions internally.		Because PostgreSQL (and therefore SE-PostgreSQL) handles processes, files and directories as part of database operations, the OM also handles permissions for these objects where needed (see the <tt>sepostgresql-8.4.2-2583.fc12.src</tt> rpm - <tt>perms.c</tt> source code) by re-mapping these permissions internally.

-	SE-PostgreSQL supports SELinux services via the <tt>libselinux</tt> library, however it does not use the <tt>libselinux</tt> AVC API functions as it provides its own services. The AVC audits are logged into the <tt>sepostgresql.log</tt> file as described in the [[#Logging Security Events\|~~outline~~ Logging Security Events]] section.	+	SE-PostgreSQL supports SELinux services via the <tt>libselinux</tt> library, however it does not use the <tt>libselinux</tt> AVC API functions as it provides its own services. The AVC audits are logged into the <tt>sepostgresql.log</tt> file as described in the [[#Logging Security Events\| Logging Security Events]] section.

	The SE-PostgreSQL extensions to support MAC access control are described in the SE-PostgreSQL Extensions section below.		The SE-PostgreSQL extensions to support MAC access control are described in the SE-PostgreSQL Extensions section below.

RichardHaines: /* SE-PostgreSQL Overview */

RichardHaines — Sat, 15 Jan 2011 16:39:12 GMT

SE-PostgreSQL Overview

←Older revision		Revision as of 16:39, 15 January 2011
Line 68:		Line 68:
	Because PostgreSQL (and therefore SE-PostgreSQL) handles processes, files and directories as part of database operations, the OM also handles permissions for these objects where needed (see the <tt>sepostgresql-8.4.2-2583.fc12.src</tt> rpm - <tt>perms.c</tt> source code) by re-mapping these permissions internally.		Because PostgreSQL (and therefore SE-PostgreSQL) handles processes, files and directories as part of database operations, the OM also handles permissions for these objects where needed (see the <tt>sepostgresql-8.4.2-2583.fc12.src</tt> rpm - <tt>perms.c</tt> source code) by re-mapping these permissions internally.

-	SE-PostgreSQL supports SELinux services via the <tt>libselinux</tt> library, however it does not use the <tt>libselinux</tt> AVC API functions as it provides its own services. The AVC audits are logged into the <tt>sepostgresql.log</tt> file as described in the [#~~3.20.2.6.~~Logging Security Events\|outline Logging Security Events] section.	+	SE-PostgreSQL supports SELinux services via the <tt>libselinux</tt> library, however it does not use the <tt>libselinux</tt> AVC API functions as it provides its own services. The AVC audits are logged into the <tt>sepostgresql.log</tt> file as described in the [[#Logging Security Events\|outline Logging Security Events]] section.

	The SE-PostgreSQL extensions to support MAC access control are described in the SE-PostgreSQL Extensions section below.		The SE-PostgreSQL extensions to support MAC access control are described in the SE-PostgreSQL Extensions section below.
-

	== SE-PostgreSQL Extensions ==		== SE-PostgreSQL Extensions ==

Jaxelson at 21:05, 13 September 2010

Jaxelson — Mon, 13 Sep 2010 21:05:02 GMT

←Older revision		Revision as of 21:05, 13 September 2010
Line 796:		Line 796:
	----		----
	<references/>		<references/>
		+
		+	[[Category:Notebook]]

RichardHaines: /* SE-PostgreSQL Extensions */

RichardHaines — Tue, 18 May 2010 15:48:10 GMT

SE-PostgreSQL Extensions

←Older revision		Revision as of 15:48, 18 May 2010
Line 80:		Line 80:
	* Adding an object manager that utilises SELinux support for policy enforcement via <tt>libselinux</tt> as shown in the [http://taiga.selinuxproject.org/~rhaines/diagrams/28-sepostgresql.png SE-PostgreSQL Services] diagram. This runs as the <tt>sepostgresql</tt> server (replacing the <tt>postgresql</tt> server).		* Adding an object manager that utilises SELinux support for policy enforcement via <tt>libselinux</tt> as shown in the [http://taiga.selinuxproject.org/~rhaines/diagrams/28-sepostgresql.png SE-PostgreSQL Services] diagram. This runs as the <tt>sepostgresql</tt> server (replacing the <tt>postgresql</tt> server).

-	: The PostgreSQL internal tables (the system catalog) have also been enhanced to support security context information and are described in the [#~~3.20.1.5.Internal Tables~~\|~~outline~~ Internal Tables] section.	+	: The PostgreSQL internal tables (the system catalog) have also been enhanced to support security context information and are described in the [[NB_SQL#Internal_Tables \| Internal Tables]] section.

	* Extending SQL statements to support a security context field.		* Extending SQL statements to support a security context field.
Line 104:		Line 104:

	\|}		\|}
		+

	For example to create a table with a specific security context, execute:		For example to create a table with a specific security context, execute:
	<pre>		<pre>
	testdb=# CREATE TABLE info () SECURITY_CONTEXT = 'unconfined_u:object_r:sepgsql_table_t:s0:c10';		testdb=# CREATE TABLE info () SECURITY_CONTEXT = 'unconfined_u:object_r:sepgsql_table_t:s0:c10';
-
	CREATE TABLE		CREATE TABLE
	</pre>		</pre>
-

	=== Additional SQL Functions ===		=== Additional SQL Functions ===
Line 180:		Line 179:

	\|}		\|}
-

RichardHaines: /* SE-PostgreSQL Walk-through */

RichardHaines — Tue, 18 May 2010 15:40:39 GMT

SE-PostgreSQL Walk-through

←Older revision		Revision as of 15:40, 18 May 2010
Line 620:		Line 620:
	Insert Row 1:		Insert Row 1:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:sepgsql_table_t:s0:c100', 'fred', 'fred@yahoo.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr)
		+	VALUES ('unconfined_u:object_r:sepgsql_table_t:s0:c100', 'fred', 'fred@yahoo.com');
	INSERT 0 1		INSERT 0 1
	</pre>		</pre>
Line 636:		Line 637:
	Insert Rows 2 and 3 each with a unique security context:		Insert Rows 2 and 3 each with a unique security context:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:sepgsql_table_t:s0:c110', 'derf', 'derf@hotmail.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES
		+	('unconfined_u:object_r:sepgsql_table_t:s0:c110', 'derf', 'derf@hotmail.com');
	INSERT 0 1		INSERT 0 1

-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES ('unconfined_u:object_r:sepgsql_table_t:s0:c120', 'george',	+	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES
-	'george@hotmail.com');	+	('unconfined_u:object_r:sepgsql_table_t:s0:c120', 'george', 'george@hotmail.com');
	INSERT 0 1		INSERT 0 1
	</pre>		</pre>
Line 669:		Line 671:
	Now insert the row again:		Now insert the row again:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:unconfined_t:s0:c130', 'hidden', 'hidden@hotmail.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr)
		+	VALUES 'unconfined_u:object_r:unconfined_t:s0:c130', 'hidden', 'hidden@hotmail.com');
	INSERT 0 1		INSERT 0 1
	</pre>		</pre>

RichardHaines: /* Introduction */

RichardHaines — Tue, 18 May 2010 15:31:31 GMT

Introduction

←Older revision		Revision as of 15:31, 18 May 2010
Line 437:		Line 437:

	The areas covered are:		The areas covered are:
-	# Install <tt>sepostgresql</tt> using <tt>yum</tt>. It assumes that <tt>postgresql</tt> or <tt>sepostgresql</tt> are not installed.	+	* Install <tt>sepostgresql</tt> using <tt>yum</tt>. It assumes that <tt>postgresql</tt> or <tt>sepostgresql</tt> are not installed.
-	# Initialise a database cluster so that <tt>sepostgresql</tt> can be started.	+	* Initialise a database cluster so that <tt>sepostgresql</tt> can be started.
-	# Create a database called <tt>testdb</tt>.	+	* Create a database called <tt>testdb</tt>.
-	# Using the PostgreSQL terminal client <tt>psql</tt> create a simple table with two columns and insert 4 rows (or tuples) of data demonstrating how to add and show the security context information associated with these objects. To enable the security context information to be distinguished between the various objects the following will be used:	+	* Using the PostgreSQL terminal client <tt>psql</tt> create a simple table with two columns and insert 4 rows (or tuples) of data demonstrating how to add and show the security context information associated with these objects. To enable the security context information to be distinguished between the various objects the following will be used:

	{\| border="1"		{\| border="1"
Line 489:		Line 489:
	\|}		\|}

-	# Finally run some <tt>sepostgresql</tt> specific functions and explain their results.	+	* Finally run some <tt>sepostgresql</tt> specific functions and explain their results.
		+

	The following assumptions have been made:		The following assumptions have been made:

RichardHaines: /* Logging Security Events */

RichardHaines — Tue, 18 May 2010 15:29:24 GMT

Logging Security Events

←Older revision		Revision as of 15:29, 18 May 2010
Line 411:		Line 411:
	<pre>		<pre>
	# This is the 'psql testdb' sequence:		# This is the 'psql testdb' sequence:
-	LOG: SELinux: granted { access } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:sepgsql_db_t:s0 tclass=db_database name=testdb	+	LOG: SELinux: granted { access } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
		+	tcontext=unconfined_u:object_r:sepgsql_db_t:s0 tclass=db_database name=testdb

-	# This is the 'SELECT user_name, email_addr, security_context FROM info;'	+	# This is the 'SELECT user_name, email_addr, security_context FROM info;' sequence of events.
-	# sequence of events.	+	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:sepgsql_table_t:s0:c10 tclass=db_table name=info	+	tcontext=unconfined_u:object_r:sepgsql_table_t:s0:c10 tclass=db_table name=info
	STATEMENT: SELECT user_name, email_addr, security_context FROM info;		STATEMENT: SELECT user_name, email_addr, security_context FROM info;

-	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:sepgsql_table_t:s0 tclass=db_column name=info.security_context	+	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
		+	tcontext=unconfined_u:object_r:sepgsql_table_t:s0 tclass=db_column name=info.security_context
	STATEMENT: SELECT user_name, email_addr, security_context FROM info;		STATEMENT: SELECT user_name, email_addr, security_context FROM info;

-	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:sepgsql_table_t:s0:c20 tclass=db_column name=info.user_name	+	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
		+	tcontext=unconfined_u:object_r:sepgsql_table_t:s0:c20 tclass=db_column name=info.user_name
	STATEMENT: SELECT user_name, email_addr, security_context FROM info;		STATEMENT: SELECT user_name, email_addr, security_context FROM info;

-	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:sepgsql_table_t:s0:c30 tclass=db_column name=info.email_addr	+	LOG: SELinux: granted { select } scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
		+	tcontext=unconfined_u:object_r:sepgsql_table_t:s0:c30 tclass=db_column name=info.email_addr
	STATEMENT: SELECT user_name, email_addr, security_context FROM info;		STATEMENT: SELECT user_name, email_addr, security_context FROM info;
	</pre>		</pre>
-

	= SE-PostgreSQL Database Example =		= SE-PostgreSQL Database Example =

RichardHaines: /* Internal Tables */

RichardHaines — Tue, 18 May 2010 15:24:16 GMT

Internal Tables

←Older revision		Revision as of 15:24, 18 May 2010
Line 237:		Line 237:

	<pre>		<pre>
-	SELECT attname, security_context, attnum, attrelid FROM pg_attribute WHERE attrelid = 'info'::regclass AND attnum > 0;	+	SELECT attname, security_context, attnum, attrelid FROM pg_attribute WHERE attrelid = 'info'::regclass AND
		+	attnum > 0;

	attname \| security_context \| attnum \| attrelid		attname \| security_context \| attnum \| attrelid
Line 270:		Line 271:

	<pre>		<pre>
-	SELECT datname, secid, relid, secattr FROM pg_security, pg_stat_database WHERE pg_security.datid = pg_stat_database.datid AND datname='testdb';	+	SELECT datname, secid, relid, secattr FROM pg_security, pg_stat_database WHERE pg_security.datid = pg_stat_database.datid AND
		+	datname='testdb';
	</pre>		</pre>

Line 361:		Line 363:

	secid \| datid \| relid \| seckind \| secattr		secid \| datid \| relid \| seckind \| secattr
-	------+-------+-------+---------+-------------------------------------------- 16386 \| 16384 \| 1249 \| l \| unconfined_u:object_r:sepgsql_table_t:s0	+	------+-------+-------+---------+--------------------------------------------
		+	16386 \| 16384 \| 1249 \| l \| unconfined_u:object_r:sepgsql_table_t:s0
	</pre>		</pre>

Line 375:		Line 378:
	16393 \| 16384 \| 16389 \| l \| unconfined_u:object_r:sepgsql_table_t:s0:c110		16393 \| 16384 \| 16389 \| l \| unconfined_u:object_r:sepgsql_table_t:s0:c110
	</pre>		</pre>
-

	=== Logging Security Events ===		=== Logging Security Events ===

RichardHaines: /* Additional SQL Functions */

RichardHaines — Tue, 18 May 2010 15:18:35 GMT

Additional SQL Functions

←Older revision		Revision as of 15:18, 18 May 2010
Line 125:		Line 125:

	\|-		\|-
-	\| sepgsql_get_user	+	\| sepgsql_get_user
-	sepgsql_set_user	+	sepgsql_set_user
	\| Returns or sets the user portion of the security context.		\| Returns or sets the user portion of the security context.

	\|-		\|-
	\| sepgsql_get_role		\| sepgsql_get_role
-	sepgsql_set_role	+	sepgsql_set_role
	\| Returns or sets the role portion of the security context.		\| Returns or sets the role portion of the security context.

	\|-		\|-
	\| sepgsql_get_type		\| sepgsql_get_type
-	sepgsql_set_type	+	sepgsql_set_type
	\| Returns or sets the type portion of the security context.		\| Returns or sets the type portion of the security context.

	\|-		\|-
	\| sepgsql_get_range		\| sepgsql_get_range
-	sepgsql_set_range	+	sepgsql_set_range
	\| Returns or sets the range portion of the security context.		\| Returns or sets the range portion of the security context.

	\|-		\|-
	\| lo_get_security		\| lo_get_security
-	lo_set_security	+	lo_set_security
	\| Returns or sets the security context of a binary large object.		\| Returns or sets the security context of a binary large object.

Line 158:		Line 158:

	\|}		\|}
-
-

	=== Additional Utilities ===		=== Additional Utilities ===

RichardHaines at 15:08, 18 May 2010

RichardHaines — Tue, 18 May 2010 15:08:29 GMT

←Older revision		Revision as of 15:08, 18 May 2010
Line 60:		Line 60:
	[[NB_SQL#???? \| SE-PostgreSQL Database Example]] has a walk-through on how to install SE-PostgreSQL on F-12 with setting up a database, adding tables etc. to show how the security context is used to enforce access control.		[[NB_SQL#???? \| SE-PostgreSQL Database Example]] has a walk-through on how to install SE-PostgreSQL on F-12 with setting up a database, adding tables etc. to show how the security context is used to enforce access control.

-	To use SE-PostgreSQL each GNU / Linux user must have a valid PostgreSQL database role (not to be confused with an SELinux role). The default installation shown in the [[NB_SQL#~~????~~ \| SE-PostgreSQL Database Example]] section automatically adds a user called <tt>sepgsql</tt> with a suitable database role.	+	To use SE-PostgreSQL each GNU / Linux user must have a valid PostgreSQL database role (not to be confused with an SELinux role). The default installation shown in the [[NB_SQL#SE-PostgreSQL_Database_Example\| SE-PostgreSQL Database Example]] section automatically adds a user called <tt>sepgsql</tt> with a suitable database role.

	If a client is connecting remotely and labeled networking is required, then it is possible to use IPSec or NetLabel as discussed in the [[NB_Networking \| SELinux Networking Support]] section (the "[http://wiki.postgresql.org/wiki/SEPostgreSQL_Development Security-Enhanced PostgreSQL Security Wiki]" also covers these methods of connectivity with examples).		If a client is connecting remotely and labeled networking is required, then it is possible to use IPSec or NetLabel as discussed in the [[NB_Networking \| SELinux Networking Support]] section (the "[http://wiki.postgresql.org/wiki/SEPostgreSQL_Development Security-Enhanced PostgreSQL Security Wiki]" also covers these methods of connectivity with examples).
Line 74:		Line 74:

	== SE-PostgreSQL Extensions ==		== SE-PostgreSQL Extensions ==
-	The following sections describe the areas that have been extended to manage the security context information and enforce access control. There are a number of examples shown in the [[NB_SQL#~~????~~ \| SE-PostgreSQL Database Example]] section that contains a walk-through of the installation, set-up and using SE-PostgreSQL to build a simple database with a single table, two columns and then adding a number of rows.	+	The following sections describe the areas that have been extended to manage the security context information and enforce access control. There are a number of examples shown in the [[NB_SQL#SE-PostgreSQL_Database_Example \| SE-PostgreSQL Database Example]] section that contains a walk-through of the installation, set-up and using SE-PostgreSQL to build a simple database with a single table, two columns and then adding a number of rows.

	The main areas expanded are:		The main areas expanded are:
Line 114:		Line 114:

	=== Additional SQL Functions ===		=== Additional SQL Functions ===
-	The following functions have been added to manage the additional security context entries (examples are shown in [[NB_SQL#~~????~~ \| SE-PostgreSQL Database Example]] section):	+	The following functions have been added to manage the additional security context entries (examples are shown in [[NB_SQL#SE-PostgreSQL_Database_Example \| SE-PostgreSQL Database Example]] section):

	{\| border="1"		{\| border="1"
Line 167:		Line 167:

	=== Additional postgresql.conf Entries ===		=== Additional postgresql.conf Entries ===
-	The <tt>postgresql.conf</tt> file has the following additional entries added to manage the <tt>sepostgresql</tt> process<ref name="ftn33">For the default installation described in the [[NB_SQL#~~????~~ \| SE-PostgreSQL Database Example]] section, the configuration file is located at <tt>/var/lib/sepgsql/data/postgresql.conf</tt>.</ref>:	+	The <tt>postgresql.conf</tt> file has the following additional entries added to manage the <tt>sepostgresql</tt> process<ref name="ftn33">For the default installation described in the [[NB_SQL#SE-PostgreSQL_Database_Example \| SE-PostgreSQL Database Example]] section, the configuration file is located at <tt>/var/lib/sepgsql/data/postgresql.conf</tt>.</ref>:

	{\| border="1"		{\| border="1"
Line 186:		Line 186:

	=== Internal Tables ===		=== Internal Tables ===
-	To support the overall database operation PostgreSQL has internal tables in the system catalog that hold information relating to user databases, tables etc. This section will only highlight the internal tables and their columns used by SE-PostgreSQL to support the object classes and security context entries using examples taken from the [[NB_SQL#~~????~~ \| SE-PostgreSQL Database Example]] section.	+	To support the overall database operation PostgreSQL has internal tables in the system catalog that hold information relating to user databases, tables etc. This section will only highlight the internal tables and their columns used by SE-PostgreSQL to support the object classes and security context entries using examples taken from the [[NB_SQL#SE-PostgreSQL_Database_Example \| SE-PostgreSQL Database Example]] section.

	Table 1 describes each of the tables used by SE-PostgreSQL to support security context relationships with example <tt>SELECT</tt> statements to retrieve the relevant information. The only internal table to actually hold security context strings is the <tt>pg_security</tt> table as all others reference these strings using identifiers as described in Table 2.		Table 1 describes each of the tables used by SE-PostgreSQL to support security context relationships with example <tt>SELECT</tt> statements to retrieve the relevant information. The only internal table to actually hold security context strings is the <tt>pg_security</tt> table as all others reference these strings using identifiers as described in Table 2.
Line 206:		Line 206:

	datname \| security_context		datname \| security_context
-
	---------+-------------------------------------		---------+-------------------------------------
-
	testdb \| unconfined_u:object_r:sepgsql_db_t:s0		testdb \| unconfined_u:object_r:sepgsql_db_t:s0
	</pre>		</pre>
Line 226:		Line 224:

	relname \| security_context \| relnatts \| relfilenode		relname \| security_context \| relnatts \| relfilenode
-		+	---------+-----------------------------------------------+------------+-------------
-	---------+-----------------------------------------------+----------+-------------	+	info \| unconfined_u:object_r:sepgsql_table_t:s0:c10 \| 2 \| 16389
-		+
-	info \| unconfined_u:object_r:sepgsql_table_t:s0:c10 \| 2 \| 16389	+
	</pre>		</pre>

Line 246:		Line 242:

	attname \| security_context \| attnum \| attrelid		attname \| security_context \| attnum \| attrelid
-
	-------------+-----------------------------------------------+--------+-----------		-------------+-----------------------------------------------+--------+-----------
-
	user_name \| unconfined_u:object_r:sepgsql_table_t:s0:c20 \| 1 \| 16389		user_name \| unconfined_u:object_r:sepgsql_table_t:s0:c20 \| 1 \| 16389
-
	email_addr \| unconfined_u:object_r:sepgsql_table_t:s0:c30 \| 2 \| 16389		email_addr \| unconfined_u:object_r:sepgsql_table_t:s0:c30 \| 2 \| 16389
		+	</pre>

-	</pre>
	\|-		\|-
	\| pg_security		\| pg_security
Line 262:		Line 255:
	\|}		\|}
	''Table 1: PostgreSQL Internal Tables - Note that each table has other columns containing information, however only that relevant to the overview are described.''		''Table 1: PostgreSQL Internal Tables - Note that each table has other columns containing information, however only that relevant to the overview are described.''
-


Line 388:		Line 380:

	=== Logging Security Events ===		=== Logging Security Events ===
-	SE-PostgreSQL manages its own AVC audit entries in the <tt>/var/log/sepostgresql.log</tt> file and by default only errors are logged (i.e. it does not add AVC entries into the standard <tt>audit.log</tt>). To be able to see greater detail then the boolean <tt>sepgsql_enable_audit_allow</tt> can be enabled (although this does show much gory detail). A pre-requisite is that the <tt>sepostgresql-devel</tt> policy module is installed. If the SE-PostgreSQL package has been installed as shown in the [[NB_SQL#~~????~~ \| SE-PostgreSQL Database Example]] section, then the policy module would have been installed but not activated. To activate the module:	+	SE-PostgreSQL manages its own AVC audit entries in the <tt>/var/log/sepostgresql.log</tt> file and by default only errors are logged (i.e. it does not add AVC entries into the standard <tt>audit.log</tt>). To be able to see greater detail then the boolean <tt>sepgsql_enable_audit_allow</tt> can be enabled (although this does show much gory detail). A pre-requisite is that the <tt>sepostgresql-devel</tt> policy module is installed. If the SE-PostgreSQL package has been installed as shown in the [[NB_SQL#SE-PostgreSQL_Database_Example \| SE-PostgreSQL Database Example]] section, then the policy module would have been installed but not activated. To activate the module:
	<pre>		<pre>
	semodule -i /usr/share/selinux/packages/sepostgresql-devel.pp		semodule -i /usr/share/selinux/packages/sepostgresql-devel.pp
Line 435:		Line 427:
	STATEMENT: SELECT user_name, email_addr, security_context FROM info;		STATEMENT: SELECT user_name, email_addr, security_context FROM info;
	</pre>		</pre>
-
-
-


Line 445:		Line 434:

	The areas covered are:		The areas covered are:
-
	# Install <tt>sepostgresql</tt> using <tt>yum</tt>. It assumes that <tt>postgresql</tt> or <tt>sepostgresql</tt> are not installed.		# Install <tt>sepostgresql</tt> using <tt>yum</tt>. It assumes that <tt>postgresql</tt> or <tt>sepostgresql</tt> are not installed.
	# Initialise a database cluster so that <tt>sepostgresql</tt> can be started.		# Initialise a database cluster so that <tt>sepostgresql</tt> can be started.
Line 628:		Line 616:
	Insert Row 1:		Insert Row 1:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES ('unconfined_u:object_r:sepgsql_table_t:s0:c100', 'fred', 'fred@yahoo.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:sepgsql_table_t:s0:c100', 'fred', 'fred@yahoo.com');
	INSERT 0 1		INSERT 0 1
	</pre>		</pre>
Line 644:		Line 632:
	Insert Rows 2 and 3 each with a unique security context:		Insert Rows 2 and 3 each with a unique security context:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES ('unconfined_u:object_r:sepgsql_table_t:s0:c110', 'derf', 'derf@hotmail.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:sepgsql_table_t:s0:c110', 'derf', 'derf@hotmail.com');
	INSERT 0 1		INSERT 0 1

Line 666:		Line 654:
	To demonstrate that SE-PostgreSQL will not allow entries to be entered unless the security context is valid, an entry will be made with a type of <tt>unconfined_t</tt> as this is not valid for the standard targeted policy. It is assumed that SELinux is in enforcing mode:		To demonstrate that SE-PostgreSQL will not allow entries to be entered unless the security context is valid, an entry will be made with a type of <tt>unconfined_t</tt> as this is not valid for the standard targeted policy. It is assumed that SELinux is in enforcing mode:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES ('unconfined_u:object_r:unconfined_t:s0:c130', 'hidden', 'hidden@hotmail.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:unconfined_t:s0:c130', 'hidden', 'hidden@hotmail.com');
	ERROR: SELinux: security policy violation		ERROR: SELinux: security policy violation
	</pre>		</pre>
Line 677:		Line 665:
	Now insert the row again:		Now insert the row again:
	<pre>		<pre>
-	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES ('unconfined_u:object_r:unconfined_t:s0:c130', 'hidden', 'hidden@hotmail.com');	+	testdb=# INSERT INTO info (security_context, user_name, email_addr) VALUES 'unconfined_u:object_r:unconfined_t:s0:c130', 'hidden', 'hidden@hotmail.com');
	INSERT 0 1		INSERT 0 1
	</pre>		</pre>