* sepgsql_needs_fmgr_hook * * It informs the core whether the supplied function is trusted procedure, * or not. If true, sepgsql_fmgr_hook shall be invoked at start, end, and * abort time of function invocation. */
| 265 | * abort time of function invocation. |
| 266 | */ |
| 267 | static bool |
| 268 | sepgsql_needs_fmgr_hook(Oid functionId) |
| 269 | { |
| 270 | ObjectAddress object; |
| 271 | |
| 272 | if (next_needs_fmgr_hook && |
| 273 | (*next_needs_fmgr_hook) (functionId)) |
| 274 | return true; |
| 275 | |
| 276 | /* |
| 277 | * SELinux needs the function to be called via security_definer wrapper, |
| 278 | * if this invocation will take a domain-transition. We call these |
| 279 | * functions as trusted-procedure, if the security policy has a rule that |
| 280 | * switches security label of the client on execution. |
| 281 | */ |
| 282 | if (sepgsql_avc_trusted_proc(functionId) != NULL) |
| 283 | return true; |
| 284 | |
| 285 | /* |
| 286 | * Even if not a trusted-procedure, this function should not be inlined |
| 287 | * unless the client has db_procedure:{execute} permission. Please note |
| 288 | * that it shall be actually failed later because of same reason with |
| 289 | * ACL_EXECUTE. |
| 290 | */ |
| 291 | object.classId = ProcedureRelationId; |
| 292 | object.objectId = functionId; |
| 293 | object.objectSubId = 0; |
| 294 | if (!sepgsql_avc_check_perms(&object, |
| 295 | SEPG_CLASS_DB_PROCEDURE, |
| 296 | SEPG_DB_PROCEDURE__EXECUTE | |
| 297 | SEPG_DB_PROCEDURE__ENTRYPOINT, |
| 298 | SEPGSQL_AVC_NOAUDIT, false)) |
| 299 | return true; |
| 300 | |
| 301 | return false; |
| 302 | } |
| 303 | |
| 304 | /* |
| 305 | * sepgsql_fmgr_hook |
nothing calls this directly
no test coverage detected