* sepgsql_set_client_label * * This routine tries to switch the current security label of the client, and * checks related permissions. The supplied new label shall be added to the * client_label_pending list, then saved at transaction-commit time to ensure * transaction-awareness. */
| 108 | * transaction-awareness. |
| 109 | */ |
| 110 | static void |
| 111 | sepgsql_set_client_label(const char *new_label) |
| 112 | { |
| 113 | const char *tcontext; |
| 114 | MemoryContext oldcxt; |
| 115 | pending_label *plabel; |
| 116 | |
| 117 | /* Reset to the initial client label, if NULL */ |
| 118 | if (!new_label) |
| 119 | tcontext = client_label_peer; |
| 120 | else |
| 121 | { |
| 122 | if (security_check_context_raw(new_label) < 0) |
| 123 | ereport(ERROR, |
| 124 | (errcode(ERRCODE_INVALID_NAME), |
| 125 | errmsg("SELinux: invalid security label: \"%s\"", |
| 126 | new_label))); |
| 127 | tcontext = new_label; |
| 128 | } |
| 129 | |
| 130 | /* Check process:{setcurrent} permission. */ |
| 131 | sepgsql_avc_check_perms_label(sepgsql_get_client_label(), |
| 132 | SEPG_CLASS_PROCESS, |
| 133 | SEPG_PROCESS__SETCURRENT, |
| 134 | NULL, |
| 135 | true); |
| 136 | /* Check process:{dyntransition} permission. */ |
| 137 | sepgsql_avc_check_perms_label(tcontext, |
| 138 | SEPG_CLASS_PROCESS, |
| 139 | SEPG_PROCESS__DYNTRANSITION, |
| 140 | NULL, |
| 141 | true); |
| 142 | |
| 143 | /* |
| 144 | * Append the supplied new_label on the pending list until the current |
| 145 | * transaction is committed. |
| 146 | */ |
| 147 | oldcxt = MemoryContextSwitchTo(CurTransactionContext); |
| 148 | |
| 149 | plabel = palloc0(sizeof(pending_label)); |
| 150 | plabel->subid = GetCurrentSubTransactionId(); |
| 151 | if (new_label) |
| 152 | plabel->label = pstrdup(new_label); |
| 153 | client_label_pending = lappend(client_label_pending, plabel); |
| 154 | |
| 155 | MemoryContextSwitchTo(oldcxt); |
| 156 | } |
| 157 | |
| 158 | /* |
| 159 | * sepgsql_xact_callback |
no test coverage detected