项目作者: dalibo

项目描述 :
SELinux policy module for PGDG rpms
高级语言: Shell
项目地址: git://github.com/dalibo/selinux-pgsql-pgdg.git
创建时间: 2014-09-22T12:43:29Z
项目社区:https://github.com/dalibo/selinux-pgsql-pgdg

开源协议:PostgreSQL License

下载


SELinux policy module for the PostgreSQL install of the PGDG

This modules adds the file contexts needed by the RPM of PostgreSQL
provided by the PGDG (e.g. yum.postgresql.org). It requires the
postgresql module of the ref policy, which is enabled by default.

RedHat Version / Support

Version up to 1.2.0 support RHEL/Centos 6 (policy version 24)

As of 1.3.0, it supports RHEL/Centos 7 (policy version 31).

It does not force you to enable sepgsql.

Boolean Provided

This policy provides a postgresql_pgdg_can_http similar to postgresql_can_rsync
from refpolicy. When enabled, this boolean allows PostgreSQL to use HTTP ports
in e.g. archive_command, recovery_end_command, etc.

  1. # setsebool postgresql_pgdg_can_http on
  2. # getsebool postgresql_pgdg_can_http
  3. postgresql_pgdg_can_http --> on
  4. #

Read/Write access to watchdog devices is provided by the
postgresql_pgdg_use_watchdog boolean. The purpose of this boolean is
to allow confining Patroni (a HA framework for PostgreSQL) with the
postgresql_t type. Patroni being in charge of running the
postmaster.

  1. # setsebool postgresql_pgdg_use_watchdog on
  2. # getsebool postgresql_pgdg_use_watchdog
  3. postgresql_pgdg_use_watchdog --> on
  4. #

When we want to archive WAL segments on mount NFS filesystem, access
can be granted with the postgresql_pgdg_use_nfs boolean:

  1. # setsebool postgresql_pgdg_use_nfs on
  2. # getsebool postgresql_pgdg_use_nfs
  3. postgresql_pgdg_use_nfs --> on
  4. #

Permanent access shall be granted by setting boolean to on with the
semanage boolean command:

  1. # semanage boolean -m --on <boolean>

Notes

When running the postmaster on a TCP port different than 5432, you
need to allow it to bind to the port by adding a semanage port rule to the
local policy.

Appling postgresql_t to Patroni requires to :

  • enable postgresql_pgdg_can_http
  • label the DCS tcp port with http_port_t (tested with Etcd)
  • use a unregistered port for the API of Patroni and label it with postgresql_port_t

License

This is free software distributed under the PostgreSQL license.

Copyright (c) 2014-2020 Dalibo.