[PATCH] SE-PgSQL/tiny rev.2193 - Mailing list pgsql-hackers

The following patch is the tiny version of SE-PostgreSQL:
 http://sepgsql.googlecode.com/files/sepgsql-01-tiny-8.5devel-r2193.patch.gz

In this version, all the security hooks (to make decision) invoked from
outside of the pg_xxx_aclcheck() and superuser_arg() were separated.
So, SE-PgSQL/tiny only checks the following only four permissions:- db_database:{connect}   ... equivalent to
ACL_CONNECTon the database- db_database:{superuser} ... equivalent to the superuser privilege- db_schema:{usage}
...equivalent to ACL_USAGE on the namespace- db_procedure:{execute}  ... equivalent to ACL_EXECUTE on the procedure
 

All the database objects to be labeled are databases, namespaces and
procedures, so I modified system column definitions.- db_database.datseclabel (text)- db_namespace.nspseclabel (text)-
db_procedure.proseclabel(text)
 
When we create a new one, a default security label shall be assigned
as far as we don't give any explicit security label.
(In the current version, it only checks sanity check of security label,
no any permission checks.)

The following features were separated.- Facility to cache access control decisions- Table/column level access controls-
Trustedprocedures
 

FYI, It is the scale of patch.

It may seem you the "tiny" is larger than the "lite".
But, 50% of changeset is at include/catalog/pg_proc.h, because we separate
the pg_security facility, so it was necessary to add a new regular attribute
into pg_proc system catalog. The pg_proc.h has 2000 of definitions for built
in functions, using DATA(...) macro. I updates them by sed secript.
It is the reason for the big changeset.

This patch also contains 570L of documentation changes, and 442L of testcases.
So, actual code changeset is about 2700L.

[kaigai@saba]$ diffstat /home/kaigai/RPMS/SOURCES/sepgsql-01-tiny-8.5devel-r2193.patch.gzconfigure
                                   |  112configure.in                                                       |
13doc/src/sgml/catalogs.sgml                                        |   21doc/src/sgml/config.sgml
                    |   42doc/src/sgml/errcodes.sgml                                         |
21doc/src/sgml/filelist.sgml                                        |    1doc/src/sgml/postgres.sgml
                    |    1doc/src/sgml/ref/alter_database.sgml                               |
12doc/src/sgml/ref/alter_function.sgml                              |   13doc/src/sgml/ref/alter_schema.sgml
                    |   11doc/src/sgml/ref/create_database.sgml                              |
14doc/src/sgml/ref/create_function.sgml                             |   12doc/src/sgml/ref/create_schema.sgml
                    |   16doc/src/sgml/ref/initdb.sgml                                       |
11doc/src/sgml/sepgsql.sgml                                         |  395src/Makefile.global.in
                    |    1src/backend/Makefile                                               |
7src/backend/bootstrap/bootstrap.c                                 |    4src/backend/catalog/aclchk.c
                   |   22src/backend/catalog/namespace.c                                    |
17src/backend/catalog/pg_aggregate.c                                |    3src/backend/catalog/pg_namespace.c
                    |    6src/backend/catalog/pg_proc.c                                      |
29src/backend/commands/alter.c                                      |   31src/backend/commands/dbcommands.c
                    |   86src/backend/commands/functioncmds.c                                |
82src/backend/commands/proclang.c                                   |    6src/backend/commands/schemacmds.c
                    |   69src/backend/nodes/copyfuncs.c                                      |
19src/backend/nodes/equalfuncs.c                                    |   17src/backend/parser/gram.y
                    |   68src/backend/security/Makefile                                      |
11src/backend/security/sepgsql/Makefile                             |   16src/backend/security/sepgsql/avc.c
                    |  331src/backend/security/sepgsql/dummy.c                               |
31src/backend/security/sepgsql/hooks.c                              |  167src/backend/security/sepgsql/label.c
                    |  523 +src/backend/security/sepgsql/misc.c                                |
152src/backend/security/sepgsql/perms.c                              |  353src/backend/security/sepgsql/policy/Makefile
                     |   28src/backend/security/sepgsql/policy/sepostgresql-devel.fc.template |
12src/backend/security/sepgsql/policy/sepostgresql-devel.te         |  119src/backend/tcop/utility.c
                    |   27src/backend/utils/init/postinit.c                                  |
11src/backend/utils/misc/guc.c                                      |   19src/backend/utils/misc/postgresql.conf.sample
                    |    4src/backend/utils/misc/superuser.c                                 |
16src/bin/initdb/initdb.c                                           |   13src/include/catalog/pg_attribute.h
                    |    4src/include/catalog/pg_class.h                                     |
2src/include/catalog/pg_database.h                                 |    6src/include/catalog/pg_namespace.h
                   |   12src/include/catalog/pg_proc.h                                      | 4242
!!!!!!!!!!src/include/catalog/pg_proc_fn.h                                  |    3src/include/commands/alter.h
                            |    1src/include/commands/dbcommands.h                                  |
1src/include/commands/defrem.h                                     |    1src/include/commands/schemacmds.h
                   |    1src/include/nodes/nodes.h                                          |
1src/include/nodes/parsenodes.h                                    |   15src/include/parser/kwlist.h
                   |    1src/include/pg_config.h.in                                         |
3src/include/security/sepgsql.h                                    |  295src/include/utils/errcodes.h
                   |    5src/test/sepgsql/Makefile                                          |
74src/test/sepgsql/expected/functions.out                           |   54src/test/sepgsql/expected/seclabel.out
                    |  129src/test/sepgsql/launch_psql.c                                     |
86src/test/sepgsql/sql/functions.sql                                |   27src/test/sepgsql/sql/seclabel.sql
                    |   7270 files changed, 3695 insertions(+), 4335 modifications(!)
 

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>