* sepgsql_relation_relabel * * It checks privileges to relabel the supplied relation by the `seclabel'. */
| 561 | * It checks privileges to relabel the supplied relation by the `seclabel'. |
| 562 | */ |
| 563 | void |
| 564 | sepgsql_relation_relabel(Oid relOid, const char *seclabel) |
| 565 | { |
| 566 | ObjectAddress object; |
| 567 | char *audit_name; |
| 568 | char relkind = get_rel_relkind(relOid); |
| 569 | uint16_t tclass = 0; |
| 570 | |
| 571 | if (relkind == RELKIND_RELATION || relkind == RELKIND_PARTITIONED_TABLE) |
| 572 | tclass = SEPG_CLASS_DB_TABLE; |
| 573 | else if (relkind == RELKIND_SEQUENCE) |
| 574 | tclass = SEPG_CLASS_DB_SEQUENCE; |
| 575 | else if (relkind == RELKIND_VIEW) |
| 576 | tclass = SEPG_CLASS_DB_VIEW; |
| 577 | else |
| 578 | ereport(ERROR, |
| 579 | (errcode(ERRCODE_WRONG_OBJECT_TYPE), |
| 580 | errmsg("cannot set security labels on relations except " |
| 581 | "for tables, sequences or views"))); |
| 582 | |
| 583 | object.classId = RelationRelationId; |
| 584 | object.objectId = relOid; |
| 585 | object.objectSubId = 0; |
| 586 | audit_name = getObjectIdentity(&object, false); |
| 587 | |
| 588 | /* |
| 589 | * check db_xxx:{setattr relabelfrom} permission |
| 590 | */ |
| 591 | sepgsql_avc_check_perms(&object, |
| 592 | tclass, |
| 593 | SEPG_DB_TABLE__SETATTR | |
| 594 | SEPG_DB_TABLE__RELABELFROM, |
| 595 | audit_name, |
| 596 | true); |
| 597 | |
| 598 | /* |
| 599 | * check db_xxx:{relabelto} permission |
| 600 | */ |
| 601 | sepgsql_avc_check_perms_label(seclabel, |
| 602 | tclass, |
| 603 | SEPG_DB_TABLE__RELABELTO, |
| 604 | audit_name, |
| 605 | true); |
| 606 | pfree(audit_name); |
| 607 | } |
| 608 | |
| 609 | /* |
| 610 | * sepgsql_relation_setattr |
no test coverage detected