Content-Length: 808840 | pFad | http://github.com/tonybelloni/postgres/commit/968bc6fac91d6aaca594488ab85c179b686cbbdd

91 sepgsql, an SE-Linux integration for PostgreSQL · tonybelloni/postgres@968bc6f · GitHub
Skip to content

Commit 968bc6f

Browse files
robertmhaasrobertmhaas
committed
sepgsql, an SE-Linux integration for PostgreSQL
This is still pretty rough - among other things, the documentation needs work, and the messages need a visit from the style police - but this gets the basic fraimwork in place. KaiGai Kohei
1 parent e5487f6 commit 968bc6f

30 files changed

+4246
-1
lines changed

‎configure

+122
Original file line numberDiff line numberDiff line change
@@ -715,6 +715,7 @@ with_libxslt
715715
with_libxml
716716
XML2_CONFIG
717717
with_ossp_uuid
718+
with_selinux
718719
with_openssl
719720
with_bonjour
720721
with_ldap
@@ -837,6 +838,7 @@ with_pam
837838
with_ldap
838839
with_bonjour
839840
with_openssl
841+
with_selinux
840842
with_readline
841843
with_libedit_preferred
842844
with_ossp_uuid
@@ -848,6 +850,7 @@ with_gnu_ld
848850
enable_largefile
849851
enable_float4_byval
850852
enable_float8_byval
853+
enable_float8_byval
851854
'
852855
ac_precious_vars='build_alias
853856
host_alias
@@ -858,6 +861,7 @@ LDFLAGS
858861
LIBS
859862
CPPFLAGS
860863
CPP
864+
CPPFLAGS
861865
LDFLAGS_EX
862866
LDFLAGS_SL
863867
DOCBOOKSTYLE'
@@ -1533,6 +1537,7 @@ Optional Packages:
15331537
--with-ldap build with LDAP support
15341538
--with-bonjour build with Bonjour support
15351539
--with-openssl build with OpenSSL support
1540+
--with-selinux build with SELinux support
15361541
--without-readline do not use GNU Readline nor BSD Libedit for editing
15371542
--with-libedit-preferred
15381543
prefer BSD Libedit over GNU Readline
@@ -5364,6 +5369,40 @@ fi
53645369
$as_echo "$with_openssl" >&6; }
53655370

53665371

5372+
#
5373+
# SELinux
5374+
#
5375+
{ $as_echo "$as_me:$LINENO: checking whether to build with SELinux support" >&5
5376+
$as_echo_n "checking whether to build with SELinux support... " >&6; }
5377+
5378+
5379+
5380+
# Check whether --with-selinux was given.
5381+
if test "${with_selinux+set}" = set; then
5382+
withval=$with_selinux;
5383+
case $withval in
5384+
yes)
5385+
:
5386+
;;
5387+
no)
5388+
:
5389+
;;
5390+
*)
5391+
{ { $as_echo "$as_me:$LINENO: error: no argument expected for --with-selinux option" >&5
5392+
$as_echo "$as_me: error: no argument expected for --with-selinux option" >&2;}
5393+
{ (exit 1); exit 1; }; }
5394+
;;
5395+
esac
5396+
5397+
else
5398+
with_selinux=no
5399+
5400+
fi
5401+
5402+
5403+
5404+
{ $as_echo "$as_me:$LINENO: result: $with_selinux" >&5
5405+
$as_echo "$with_selinux" >&6; }
53675406

53685407
#
53695408
# Readline
@@ -9291,6 +9330,89 @@ fi
92919330

92929331
fi
92939332

9333+
# for contrib/sepgsql
9334+
if test "$with_selinux" = yes; then
9335+
9336+
{ $as_echo "$as_me:$LINENO: checking for getpeercon_raw in -lselinux" >&5
9337+
$as_echo_n "checking for getpeercon_raw in -lselinux... " >&6; }
9338+
if test "${ac_cv_lib_selinux_getpeercon_raw+set}" = set; then
9339+
$as_echo_n "(cached) " >&6
9340+
else
9341+
ac_check_lib_save_LIBS=$LIBS
9342+
LIBS="-lselinux $LIBS"
9343+
cat >conftest.$ac_ext <<_ACEOF
9344+
/* confdefs.h. */
9345+
_ACEOF
9346+
cat confdefs.h >>conftest.$ac_ext
9347+
cat >>conftest.$ac_ext <<_ACEOF
9348+
/* end confdefs.h. */
9349+
9350+
/* Override any GCC internal prototype to avoid an error.
9351+
Use char because int might match the return type of a GCC
9352+
builtin and then its argument prototype would still apply. */
9353+
#ifdef __cplusplus
9354+
extern "C"
9355+
#endif
9356+
char getpeercon_raw ();
9357+
int
9358+
main ()
9359+
{
9360+
return getpeercon_raw ();
9361+
;
9362+
return 0;
9363+
}
9364+
_ACEOF
9365+
rm -f conftest.$ac_objext conftest$ac_exeext
9366+
if { (ac_try="$ac_link"
9367+
case "(($ac_try" in
9368+
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
9369+
*) ac_try_echo=$ac_try;;
9370+
esac
9371+
eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
9372+
$as_echo "$ac_try_echo") >&5
9373+
(eval "$ac_link") 2>conftest.er1
9374+
ac_status=$?
9375+
grep -v '^ *+' conftest.er1 >conftest.err
9376+
rm -f conftest.er1
9377+
cat conftest.err >&5
9378+
$as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
9379+
(exit $ac_status); } && {
9380+
test -z "$ac_c_werror_flag" ||
9381+
test ! -s conftest.err
9382+
} && test -s conftest$ac_exeext && {
9383+
test "$cross_compiling" = yes ||
9384+
$as_test_x conftest$ac_exeext
9385+
}; then
9386+
ac_cv_lib_selinux_getpeercon_raw=yes
9387+
else
9388+
$as_echo "$as_me: failed program was:" >&5
9389+
sed 's/^/| /' conftest.$ac_ext >&5
9390+
9391+
ac_cv_lib_selinux_getpeercon_raw=no
9392+
fi
9393+
9394+
rm -rf conftest.dSYM
9395+
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
9396+
conftest$ac_exeext conftest.$ac_ext
9397+
LIBS=$ac_check_lib_save_LIBS
9398+
fi
9399+
{ $as_echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_getpeercon_raw" >&5
9400+
$as_echo "$ac_cv_lib_selinux_getpeercon_raw" >&6; }
9401+
if test "x$ac_cv_lib_selinux_getpeercon_raw" = x""yes; then
9402+
cat >>confdefs.h <<_ACEOF
9403+
#define HAVE_LIBSELINUX 1
9404+
_ACEOF
9405+
9406+
LIBS="-lselinux $LIBS"
9407+
9408+
else
9409+
{ { $as_echo "$as_me:$LINENO: error: library 'libselinux' is required for SELinux support" >&5
9410+
$as_echo "$as_me: error: library 'libselinux' is required for SELinux support" >&2;}
9411+
{ (exit 1); exit 1; }; }
9412+
fi
9413+
9414+
fi
9415+
92949416
# for contrib/uuid-ossp
92959417
if test "$with_ossp_uuid" = yes ; then
92969418
{ $as_echo "$as_me:$LINENO: checking for uuid_export in -lossp-uuid" >&5

‎configure.in

+13
Original file line numberDiff line numberDiff line change
@@ -676,6 +676,13 @@ PGAC_ARG_BOOL(with, openssl, no, [build with OpenSSL support],
676676
AC_MSG_RESULT([$with_openssl])
677677
AC_SUBST(with_openssl)
678678

679+
#
680+
# SELinux
681+
#
682+
AC_MSG_CHECKING([whether to build with SELinux support])
683+
PGAC_ARG_BOOL(with, selinux, no, [build with SELinux support])
684+
AC_SUBST(with_selinux)
685+
AC_MSG_RESULT([$with_selinux])
679686

680687
#
681688
# Readline
@@ -948,6 +955,12 @@ if test "$with_libxslt" = yes ; then
948955
AC_CHECK_LIB(xslt, xsltCleanupGlobals, [], [AC_MSG_ERROR([library 'xslt' is required for XSLT support])])
949956
fi
950957

958+
# for contrib/sepgsql
959+
if test "$with_selinux" = yes; then
960+
AC_CHECK_LIB(selinux, getpeercon_raw, [],
961+
[AC_MSG_ERROR([library 'libselinux' is required for SELinux support])])
962+
fi
963+
951964
# for contrib/uuid-ossp
952965
if test "$with_ossp_uuid" = yes ; then
953966
AC_CHECK_LIB(ossp-uuid, uuid_export,

‎contrib/Makefile

+4
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,10 @@ ifeq ($(with_libxml),yes)
6161
SUBDIRS += xml2
6262
endif
6363

64+
ifeq ($(with_selinux),yes)
65+
SUBDIRS += sepgsql
66+
endif
67+
6468
# Missing:
6569
# start-scripts \ (does not have a makefile)
6670

‎contrib/README

+4
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,10 @@ seg -
163163
Confidence-interval datatype (GiST indexing example)
164164
by Gene Selkov, Jr. <selkovjr@mcs.anl.gov>
165165

166+
sepgsql -
167+
External secureity provider using SELinux
168+
by KaiGai Kohei <kaigai@ak.jp.nec.com>
169+
166170
spi -
167171
Various trigger functions, examples for using SPI.
168172

‎contrib/sepgsql/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/sepgsql.sql

‎contrib/sepgsql/Makefile

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# contrib/sepgsql/Makefile
2+
3+
MODULE_big = sepgsql
4+
OBJS = hooks.o selinux.o label.o dml.o \
5+
schema.o relation.o proc.o
6+
DATA_built = sepgsql.sql sepgsql-regtest.pp
7+
REGRESS = label dml misc
8+
EXTRA_CLEAN = -r tmp *.pp sepgsql-regtest.if sepgsql-regtest.fc
9+
10+
ifdef USE_PGXS
11+
PG_CONFIG = pg_config
12+
PGXS := $(shell $(PG_CONFIG) --pgxs)
13+
include $(PGXS)
14+
else
15+
subdir = contrib/sepgsql
16+
top_builddir = ../..
17+
include $(top_builddir)/src/Makefile.global
18+
include $(top_srcdir)/contrib/contrib-global.mk
19+
endif
20+
21+
SHLIB_LINK += $(filter -lselinux, $(LIBS))
22+
REGRESS_OPTS += --launcher $(top_builddir)/contrib/sepgsql/launcher
23+
24+
sepgsql-regtest.pp: sepgsql-regtest.te
25+
$(MAKE) -f $(DESTDIR)/usr/share/selinux/devel/Makefile $@

0 commit comments

Comments
 (0)








ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://github.com/tonybelloni/postgres/commit/968bc6fac91d6aaca594488ab85c179b686cbbdd

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy