postgresql_selinux(8)

1postgresql_selinux(8)      SELinux Policy postgresql     postgresql_selinux(8)
2
3
4

NAME

6       postgresql_selinux  - Security Enhanced Linux Policy for the postgresql
7       processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the postgresql processes  via  flexible
11       mandatory access control.
12
13       The  postgresql  processes  execute with the postgresql_t SELinux type.
14       You can check if you have these processes running by executing  the  ps
15       command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep postgresql_t
20
21
22

ENTRYPOINTS

24       The  postgresql_t SELinux type can be entered via the postgresql_exec_t
25       file type.
26
27       The default entrypoint paths for the postgresql_t domain are  the  fol‐
28       lowing:
29
30       /usr/bin/(se)?postgres,    /usr/bin/initdb(.sepgsql)?,   /usr/lib/post‐
31       gresql/bin/.*,      /usr/bin/pg_ctl,       /usr/libexec/postgresql-ctl,
32       /usr/bin/postgresql-check-db-dir,
33       /usr/lib/pgsql/test/regress/pg_regress
34

PROCESS TYPES

36       SELinux defines process types (domains) for each process running on the
37       system
38
39       You can see the context of a process using the -Z option to ps
40
41       Policy  governs  the  access confined processes have to files.  SELinux
42       postgresql policy is very flexible allowing users to setup their  post‐
43       gresql processes in as secure a method as possible.
44
45       The following process types are defined for postgresql:
46
47       postgresql_t
48
49       Note:  semanage  permissive  -a  postgresql_t  can  be used to make the
50       process type postgresql_t permissive. SELinux does not deny  access  to
51       permissive  process  types,  but the AVC (SELinux denials) messages are
52       still generated.
53
54

BOOLEANS

56       SELinux policy is customizable based on least access  required.   post‐
57       gresql policy is extremely flexible and has several booleans that allow
58       you to manipulate the policy and run postgresql with the  tightest  ac‐
59       cess possible.
60
61
62
63       If  you want to allow postgresql to use ssh and rsync for point-in-time
64       recovery, you must turn on the postgresql_can_rsync  boolean.  Disabled
65       by default.
66
67       setsebool -P postgresql_can_rsync 1
68
69
70
71       If  you  want  to  allow transmit client label to foreign database, you
72       must turn on the postgresql_selinux_transmit_client_label boolean. Dis‐
73       abled by default.
74
75       setsebool -P postgresql_selinux_transmit_client_label 1
76
77
78
79       If  you  want  to  dontaudit all daemons scheduling requests (setsched,
80       sys_nice), you must turn on the  daemons_dontaudit_scheduling  boolean.
81       Enabled by default.
82
83       setsebool -P daemons_dontaudit_scheduling 1
84
85
86
87       If you want to deny user domains applications to map a memory region as
88       both executable and writable, this  is  dangerous  and  the  executable
89       should be reported in bugzilla, you must turn on the deny_execmem bool‐
90       ean. Disabled by default.
91
92       setsebool -P deny_execmem 1
93
94
95
96       If you want to determine whether exim can  connect  to  databases,  you
97       must turn on the exim_can_connect_db boolean. Disabled by default.
98
99       setsebool -P exim_can_connect_db 1
100
101
102
103       If you want to allow all domains to execute in fips_mode, you must turn
104       on the fips_mode boolean. Enabled by default.
105
106       setsebool -P fips_mode 1
107
108
109
110       If you want to determine whether ftpd can connect to databases over the
111       TCP  network, you must turn on the ftpd_connect_db boolean. Disabled by
112       default.
113
114       setsebool -P ftpd_connect_db 1
115
116
117
118       If you want to allow HTTPD scripts and modules to connect to  databases
119       over  the  network,  you  must turn on the httpd_can_network_connect_db
120       boolean. Disabled by default.
121
122       setsebool -P httpd_can_network_connect_db 1
123
124
125
126       If you want to allow confined applications to run  with  kerberos,  you
127       must turn on the kerberos_enabled boolean. Enabled by default.
128
129       setsebool -P kerberos_enabled 1
130
131
132
133       If  you  want  to  allow  system  to run with NIS, you must turn on the
134       nis_enabled boolean. Disabled by default.
135
136       setsebool -P nis_enabled 1
137
138
139
140       If you want to allow PowerDNS to connect to databases over the network,
141       you  must  turn on the pdns_can_network_connect_db boolean. Disabled by
142       default.
143
144       setsebool -P pdns_can_network_connect_db 1
145
146
147

PORT TYPES

149       SELinux defines port types to represent TCP and UDP ports.
150
151       You can see the types associated with a port  by  using  the  following
152       command:
153
154       semanage port -l
155
156
157       Policy  governs  the  access  confined  processes  have to these ports.
158       SELinux postgresql policy is very  flexible  allowing  users  to  setup
159       their postgresql processes in as secure a method as possible.
160
161       The following port types are defined for postgresql:
162
163
164       postgresql_port_t
165
166
167
168       Default Defined Ports:
169                 tcp 5432,9898
170

MANAGED FILES

172       The SELinux process type postgresql_t can manage files labeled with the
173       following file types.  The paths listed are the default paths for these
174       file types.  Note the processes UID still need to have DAC permissions.
175
176       cluster_conf_t
177
178            /etc/cluster(/.*)?
179
180       cluster_var_lib_t
181
182            /var/lib/pcsd(/.*)?
183            /var/lib/cluster(/.*)?
184            /var/lib/openais(/.*)?
185            /var/lib/pengine(/.*)?
186            /var/lib/corosync(/.*)?
187            /usr/lib/heartbeat(/.*)?
188            /var/lib/heartbeat(/.*)?
189            /var/lib/pacemaker(/.*)?
190
191       cluster_var_run_t
192
193            /var/run/crm(/.*)?
194            /var/run/cman_.*
195            /var/run/rsctmp(/.*)?
196            /var/run/aisexec.*
197            /var/run/heartbeat(/.*)?
198            /var/run/pcsd-ruby.socket
199            /var/run/corosync-qnetd(/.*)?
200            /var/run/corosync-qdevice(/.*)?
201            /var/run/corosync.pid
202            /var/run/cpglockd.pid
203            /var/run/rgmanager.pid
204            /var/run/cluster/rgmanager.sk
205
206       faillog_t
207
208            /var/log/btmp.*
209            /var/log/faillog.*
210            /var/log/tallylog.*
211            /var/run/faillock(/.*)?
212
213       hugetlbfs_t
214
215            /dev/hugepages
216            /usr/lib/udev/devices/hugepages
217
218       krb5_host_rcache_t
219
220            /var/tmp/krb5_0.rcache2
221            /var/cache/krb5rcache(/.*)?
222            /var/tmp/nfs_0
223            /var/tmp/DNS_25
224            /var/tmp/host_0
225            /var/tmp/imap_0
226            /var/tmp/HTTP_23
227            /var/tmp/HTTP_48
228            /var/tmp/ldap_55
229            /var/tmp/ldap_487
230            /var/tmp/ldapmap1_0
231
232       lastlog_t
233
234            /var/log/lastlog.*
235
236       postgresql_db_t
237
238            /var/lib/pgsql(/.*)?
239            /var/lib/sepgsql(/.*)?
240            /var/lib/postgres(ql)?(/.*)?
241            /usr/share/jonas/pgsql(/.*)?
242            /usr/lib/pgsql/test/regress(/.*)?
243
244       postgresql_lock_t
245
246
247       postgresql_log_t
248
249            /var/lib/pgsql/.*.log
250            /var/log/rhdb/rhdb(/.*)?
251            /var/log/postgresql(/.*)?
252            /var/log/postgres.log.*
253            /var/lib/pgsql/logfile(/.*)?
254            /var/lib/pgsql/data/log(/.*)?
255            /var/log/sepostgresql.log.*
256            /var/lib/pgsql/data/pg_log(/.*)?
257            /var/lib/sepgsql/pgstartup.log
258
259       postgresql_tmp_t
260
261
262       postgresql_var_run_t
263
264            /var/run/postgresql(/.*)?
265
266       root_t
267
268            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
269            /
270            /initrd
271
272       security_t
273
274            /selinux
275
276

FILE CONTEXTS

278       SELinux requires files to have an extended attribute to define the file
279       type.
280
281       You can see the context of a file using the -Z option to ls
282
283       Policy governs the access  confined  processes  have  to  these  files.
284       SELinux  postgresql  policy  is  very  flexible allowing users to setup
285       their postgresql processes in as secure a method as possible.
286
287       EQUIVALENCE DIRECTORIES
288
289
290       postgresql policy stores data  with  multiple  different  file  context
291       types  under  the /var/lib/pgsql directory.  If you would like to store
292       the data in a different directory you can use the semanage  command  to
293       create  an equivalence mapping.  If you wanted to store this data under
294       the /srv directory you would execute the following command:
295
296       semanage fcontext -a -e /var/lib/pgsql /srv/pgsql
297       restorecon -R -v /srv/pgsql
298
299       postgresql policy stores data  with  multiple  different  file  context
300       types under the /var/lib/sepgsql directory.  If you would like to store
301       the data in a different directory you can use the semanage  command  to
302       create  an equivalence mapping.  If you wanted to store this data under
303       the /srv directory you would execute the following command:
304
305       semanage fcontext -a -e /var/lib/sepgsql /srv/sepgsql
306       restorecon -R -v /srv/sepgsql
307
308       STANDARD FILE CONTEXT
309
310       SELinux defines the file context  types  for  the  postgresql,  if  you
311       wanted  to  store files with these types in a different paths, you need
312       to execute the semanage command to specify alternate labeling and  then
313       use restorecon to put the labels on disk.
314
315       semanage   fcontext   -a   -t  postgresql_exec_t  '/srv/postgresql/con‐
316       tent(/.*)?'
317       restorecon -R -v /srv/mypostgresql_content
318
319       Note: SELinux often uses regular expressions  to  specify  labels  that
320       match multiple files.
321
322       The following file types are defined for postgresql:
323
324
325
326       postgresql_db_t
327
328       -  Set  files  with  the postgresql_db_t type, if you want to treat the
329       files as postgresql database content.
330
331
332       Paths:
333            /var/lib/pgsql(/.*)?,    /var/lib/sepgsql(/.*)?,    /var/lib/post‐
334            gres(ql)?(/.*)?,                     /usr/share/jonas/pgsql(/.*)?,
335            /usr/lib/pgsql/test/regress(/.*)?
336
337
338       postgresql_etc_t
339
340       - Set files with the postgresql_etc_t type, if you want to store  post‐
341       gresql files in the /etc directories.
342
343
344       Paths:
345            /etc/postgresql(/.*)?, /etc/sysconfig/pgsql(/.*)?
346
347
348       postgresql_exec_t
349
350       -  Set files with the postgresql_exec_t type, if you want to transition
351       an executable to the postgresql_t domain.
352
353
354       Paths:
355            /usr/bin/(se)?postgres, /usr/bin/initdb(.sepgsql)?, /usr/lib/post‐
356            gresql/bin/.*,    /usr/bin/pg_ctl,    /usr/libexec/postgresql-ctl,
357            /usr/bin/postgresql-check-db-dir,
358            /usr/lib/pgsql/test/regress/pg_regress
359
360
361       postgresql_initrc_exec_t
362
363       -  Set  files  with  the  postgresql_initrc_exec_t type, if you want to
364       transition an executable to the postgresql_initrc_t domain.
365
366
367
368       postgresql_lock_t
369
370       - Set files with the postgresql_lock_t type, if you want to  treat  the
371       files as postgresql lock data, stored under the /var/lock directory
372
373
374
375       postgresql_log_t
376
377       -  Set  files  with the postgresql_log_t type, if you want to treat the
378       data as postgresql log data, usually stored under the  /var/log  direc‐
379       tory.
380
381
382       Paths:
383            /var/lib/pgsql/.*.log,   /var/log/rhdb/rhdb(/.*)?,  /var/log/post‐
384            gresql(/.*)?,     /var/log/postgres.log.*,     /var/lib/pgsql/log‐
385            file(/.*)?,     /var/lib/pgsql/data/log(/.*)?,    /var/log/sepost‐
386            gresql.log.*,                    /var/lib/pgsql/data/pg_log(/.*)?,
387            /var/lib/sepgsql/pgstartup.log
388
389
390       postgresql_tmp_t
391
392       -  Set files with the postgresql_tmp_t type, if you want to store post‐
393       gresql temporary files in the /tmp directories.
394
395
396
397       postgresql_unit_file_t
398
399       - Set files with the postgresql_unit_file_t type, if you want to  treat
400       the files as postgresql unit content.
401
402
403
404       postgresql_var_run_t
405
406       -  Set  files  with the postgresql_var_run_t type, if you want to store
407       the postgresql files under the /run or /var/run directory.
408
409
410
411       Note: File context can be temporarily modified with the chcon  command.
412       If  you want to permanently change the file context you need to use the
413       semanage fcontext command.  This will modify the SELinux labeling data‐
414       base.  You will need to use restorecon to apply the labels.
415
416

COMMANDS

418       semanage  fcontext  can also be used to manipulate default file context
419       mappings.
420
421       semanage permissive can also be used to manipulate  whether  or  not  a
422       process type is permissive.
423
424       semanage  module can also be used to enable/disable/install/remove pol‐
425       icy modules.
426
427       semanage port can also be used to manipulate the port definitions
428
429       semanage boolean can also be used to manipulate the booleans
430
431
432       system-config-selinux is a GUI tool available to customize SELinux pol‐
433       icy settings.
434
435

AUTHOR

437       This manual page was auto-generated using sepolicy manpage .
438
439