* check_relation_privileges * * It actually checks required permissions on a certain relation * and its columns. */
| 138 | * and its columns. |
| 139 | */ |
| 140 | static bool |
| 141 | check_relation_privileges(Oid relOid, |
| 142 | Bitmapset *selected, |
| 143 | Bitmapset *inserted, |
| 144 | Bitmapset *updated, |
| 145 | uint32 required, |
| 146 | bool abort_on_violation) |
| 147 | { |
| 148 | ObjectAddress object; |
| 149 | char *audit_name; |
| 150 | Bitmapset *columns; |
| 151 | int index; |
| 152 | char relkind = get_rel_relkind(relOid); |
| 153 | bool result = true; |
| 154 | |
| 155 | /* |
| 156 | * Hardwired Policies: SE-PostgreSQL enforces - clients cannot modify |
| 157 | * system catalogs using DMLs - clients cannot reference/modify toast |
| 158 | * relations using DMLs |
| 159 | */ |
| 160 | if (sepgsql_getenforce() > 0) |
| 161 | { |
| 162 | if ((required & (SEPG_DB_TABLE__UPDATE | |
| 163 | SEPG_DB_TABLE__INSERT | |
| 164 | SEPG_DB_TABLE__DELETE)) != 0 && |
| 165 | IsCatalogRelationOid(relOid)) |
| 166 | ereport(ERROR, |
| 167 | (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), |
| 168 | errmsg("SELinux: hardwired security policy violation"))); |
| 169 | |
| 170 | if (relkind == RELKIND_TOASTVALUE) |
| 171 | ereport(ERROR, |
| 172 | (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), |
| 173 | errmsg("SELinux: hardwired security policy violation"))); |
| 174 | } |
| 175 | |
| 176 | /* |
| 177 | * Check permissions on the relation |
| 178 | */ |
| 179 | object.classId = RelationRelationId; |
| 180 | object.objectId = relOid; |
| 181 | object.objectSubId = 0; |
| 182 | audit_name = getObjectIdentity(&object, false); |
| 183 | switch (relkind) |
| 184 | { |
| 185 | case RELKIND_RELATION: |
| 186 | case RELKIND_PARTITIONED_TABLE: |
| 187 | result = sepgsql_avc_check_perms(&object, |
| 188 | SEPG_CLASS_DB_TABLE, |
| 189 | required, |
| 190 | audit_name, |
| 191 | abort_on_violation); |
| 192 | break; |
| 193 | |
| 194 | case RELKIND_SEQUENCE: |
| 195 | Assert((required & ~SEPG_DB_TABLE__SELECT) == 0); |
| 196 | |
| 197 | if (required & SEPG_DB_TABLE__SELECT) |
no test coverage detected