From 4d355a8336e0f2265b31d678ffd1ee5cf9e79fae Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Mon, 27 Sep 2010 20:55:27 -0400 Subject: Add a SECURITY LABEL command. This is intended as infrastructure to support integration with label-based mandatory access control systems such as SE-Linux. Further changes (mostly hooks) will be needed, but this is a big chunk of it. KaiGai Kohei and Robert Haas --- doc/src/sgml/catalogs.sgml | 172 +++++++++++++++++++++++++++++++ doc/src/sgml/ref/allfiles.sgml | 1 + doc/src/sgml/ref/pg_dump.sgml | 10 ++ doc/src/sgml/ref/pg_dumpall.sgml | 9 ++ doc/src/sgml/ref/pg_restore.sgml | 10 ++ doc/src/sgml/ref/security_label.sgml | 194 +++++++++++++++++++++++++++++++++++ doc/src/sgml/reference.sgml | 1 + 7 files changed, 397 insertions(+) create mode 100644 doc/src/sgml/ref/security_label.sgml (limited to 'doc/src') diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index ab11b150653..8e4081cb33c 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -208,6 +208,11 @@ query rewrite rules + + pg_seclabel + security labels on database objects + + pg_shdepend dependencies on shared objects @@ -4229,6 +4234,77 @@ + + <structname>pg_seclabel</structname> + + + pg_seclabel + + + + The catalog pg_seclabel stores security + labels on database objects. See the + statement. + + + + <structname>pg_seclabel</structname> Columns + + + + + Name + Type + References + Description + + + + + + objoid + oid + any OID column + The OID of the object this security label pertains to + + + + classoid + oid + pg_class.oid + The OID of the system catalog this object appears in + + + + objsubid + int4 + + + For a security label on a table column, this is the column number (the + objoid and classoid refer to + the table itself). For all other object types, this column is + zero. + + + + + provider + text + + The label provider associated with this label. + + + + label + text + + The security label applied to this object. + + + +
+ + <structname>pg_shdepend</structname> @@ -5883,6 +5959,11 @@ rules + + pg_seclabels + security labels + + pg_settings parameter settings @@ -6791,6 +6872,97 @@ + + <structname>pg_seclabels</structname> + + + pg_seclabels + + + + The view pg_seclabels provides information about + security labels. It as an easier-to-query version of the + pg_seclabel catalog. + + + + <structname>pg_seclabels</> Columns + + + + + Name + Type + References + Description + + + + + objoid + oid + any OID column + The OID of the object this security label pertains to + + + classoid + oid + pg_class.oid + The OID of the system catalog this object appears in + + + objsubid + int4 + + + For a security label on a table column, this is the column number (the + objoid and classoid refer to + the table itself). For all other object types, this column is + zero. + + + + objtype + text + + + The type of object to which this label applies, as text. + + + + objnamespace + oid + pg_namespace.oid + + The OID of the namespace for this object, if applicable; + otherwise NULL. + + + + objname + text + + + The name of the object to which this label applies, as text. + + + + provider + text + pg_seclabel.provider + The label provider associated with this label. + + + label + text + pg_seclabel.label + The security label applied to this object. + + + +
+ + <structname>pg_settings</structname> diff --git a/doc/src/sgml/ref/allfiles.sgml b/doc/src/sgml/ref/allfiles.sgml index 7b97883d1bd..f5d67a20787 100644 --- a/doc/src/sgml/ref/allfiles.sgml +++ b/doc/src/sgml/ref/allfiles.sgml @@ -132,6 +132,7 @@ Complete list of usable sgml source files in this directory. + diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml index 1b8402e78c1..8242b536d73 100644 --- a/doc/src/sgml/ref/pg_dump.sgml +++ b/doc/src/sgml/ref/pg_dump.sgml @@ -778,6 +778,16 @@ PostgreSQL documentation + + + + + + With this option, it also outputs security labels of database + objects to be dumped, if labeled. + + + diff --git a/doc/src/sgml/ref/pg_dumpall.sgml b/doc/src/sgml/ref/pg_dumpall.sgml index 14fa1091128..68dcc35c50e 100644 --- a/doc/src/sgml/ref/pg_dumpall.sgml +++ b/doc/src/sgml/ref/pg_dumpall.sgml @@ -493,6 +493,15 @@ PostgreSQL documentation + + + + + With this option, it also outputs security labels of database + objects to be dumped, if labeled. + + + diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgml index 9dc2511f5f3..78606969a98 100644 --- a/doc/src/sgml/ref/pg_restore.sgml +++ b/doc/src/sgml/ref/pg_restore.sgml @@ -328,6 +328,16 @@ + + + + + Do not output commands to restore security labels, + even if the archive contains them. + + + + diff --git a/doc/src/sgml/ref/security_label.sgml b/doc/src/sgml/ref/security_label.sgml new file mode 100644 index 00000000000..7fce58bc13a --- /dev/null +++ b/doc/src/sgml/ref/security_label.sgml @@ -0,0 +1,194 @@ + + + + + SECURITY LABEL + 7 + SQL - Language Statements + + + + SECURITY LABEL + define or change a security label applied to an object + + + + SECURITY LABEL + + + + +SECURITY LABEL [ FOR provider ] ON +{ + TABLE object_name | + COLUMN table_name.column_name | + AGGREGATE agg_name (agg_type [, ...] ) | + DOMAIN object_name | + FUNCTION function_name ( [ [ argmode ] [ argname ] argtype [, ...] ] ) | + LARGE OBJECT large_object_oid | + [ PROCEDURAL ] LANGUAGE object_name | + SCHEMA object_name | + SEQUENCE object_name | + TYPE object_name | + VIEW object_name +} IS 'label' + + + + + Description + + + SECURITY LABEL applies a security label to a database + object. An arbitrary number of security labels, one per label provider, can + be associated with a given database object. Label providers are loadable + modules which register themselves by using the function + register_label_provider. + + + + + register_label_provider is not an SQL function; it can + only be called from C code loaded into the backend. + + + + + The label provider determines whether a given a label is valid and whether + it is permissible to assign that label to a given object. The meaning of a + given label is likewise at the discretion of the label provider. + PostgreSQL places no restrictions on whether or how a + label provider must interpret security labels; it merely provides a + mechanism for storing them. In practice, this facility is intended to allow + integration with label-based mandatory access control (MAC) systems such as + SE-Linux. Such systems make all access control decisions + based on object labels, rather than traditional discretionary access control + (DAC) concepts such as users and groups. + + + + + Parameters + + + + object_name + table_name.column_name + agg_name + function_name + + + The name of the object to be commented. Names of tables, + aggregates, domains, functions, sequences, types, and views can + be schema-qualified. + + + + + + provider + + + The name of the provider with which this label is to be associated. The + named provider must be loaded and must consent to the proposed labeling + operation. If exactly one provider is loaded, the provider name may be + omitted for brevity. + + + + + + argmode + + + + The mode of a function argument: IN, OUT, + INOUT, or VARIADIC. + If omitted, the default is IN. + Note that COMMENT ON FUNCTION does not actually pay + any attention to OUT arguments, since only the input + arguments are needed to determine the function's identity. + So it is sufficient to list the IN, INOUT, + and VARIADIC arguments. + + + + + + argname + + + + The name of a function argument. + Note that COMMENT ON FUNCTION does not actually pay + any attention to argument names, since only the argument data + types are needed to determine the function's identity. + + + + + + argtype + + + + The data type(s) of the function's arguments (optionally + schema-qualified), if any. + + + + + + large_object_oid + + + The OID of the large object. + + + + + + PROCEDURAL + + + + This is a noise word. + + + + + + label + + + The new security label, written as a string literal; or NULL + to drop the security label. + + + + + + + + Examples + + + The following example shows how the security label of a table might + be changed. + + +SECURITY LABEL FOR selinux ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0'; + + + + + + Compatibility + + There is no SECURITY LABEL command in the SQL standard. + + + diff --git a/doc/src/sgml/reference.sgml b/doc/src/sgml/reference.sgml index 052fe0e8fb2..463746cda3a 100644 --- a/doc/src/sgml/reference.sgml +++ b/doc/src/sgml/reference.sgml @@ -160,6 +160,7 @@ &rollbackPrepared; &rollbackTo; &savepoint; + &securityLabel; &select; &selectInto; &set; -- cgit v1.2.3