* sepgsql_schema_post_create * * This routine assigns a default security label on a newly defined * schema. */
| 33 | * schema. |
| 34 | */ |
| 35 | void |
| 36 | sepgsql_schema_post_create(Oid namespaceId) |
| 37 | { |
| 38 | Relation rel; |
| 39 | ScanKeyData skey; |
| 40 | SysScanDesc sscan; |
| 41 | HeapTuple tuple; |
| 42 | char *tcontext; |
| 43 | char *ncontext; |
| 44 | const char *nsp_name; |
| 45 | ObjectAddress object; |
| 46 | Form_pg_namespace nspForm; |
| 47 | StringInfoData audit_name; |
| 48 | |
| 49 | /* |
| 50 | * Compute a default security label when we create a new schema object |
| 51 | * under the working database. |
| 52 | * |
| 53 | * XXX - upcoming version of libselinux supports to take object name to |
| 54 | * handle special treatment on default security label; such as special |
| 55 | * label on "pg_temp" schema. |
| 56 | */ |
| 57 | rel = table_open(NamespaceRelationId, AccessShareLock); |
| 58 | |
| 59 | ScanKeyInit(&skey, |
| 60 | Anum_pg_namespace_oid, |
| 61 | BTEqualStrategyNumber, F_OIDEQ, |
| 62 | ObjectIdGetDatum(namespaceId)); |
| 63 | |
| 64 | sscan = systable_beginscan(rel, NamespaceOidIndexId, true, |
| 65 | SnapshotSelf, 1, &skey); |
| 66 | tuple = systable_getnext(sscan); |
| 67 | if (!HeapTupleIsValid(tuple)) |
| 68 | elog(ERROR, "could not find tuple for namespace %u", namespaceId); |
| 69 | |
| 70 | nspForm = (Form_pg_namespace) GETSTRUCT(tuple); |
| 71 | nsp_name = NameStr(nspForm->nspname); |
| 72 | if (strncmp(nsp_name, "pg_temp_", 8) == 0) |
| 73 | nsp_name = "pg_temp"; |
| 74 | else if (strncmp(nsp_name, "pg_toast_temp_", 14) == 0) |
| 75 | nsp_name = "pg_toast_temp"; |
| 76 | |
| 77 | tcontext = sepgsql_get_label(DatabaseRelationId, MyDatabaseId, 0); |
| 78 | ncontext = sepgsql_compute_create(sepgsql_get_client_label(), |
| 79 | tcontext, |
| 80 | SEPG_CLASS_DB_SCHEMA, |
| 81 | nsp_name); |
| 82 | |
| 83 | /* |
| 84 | * check db_schema:{create} |
| 85 | */ |
| 86 | initStringInfo(&audit_name); |
| 87 | appendStringInfo(&audit_name, "%s", quote_identifier(nsp_name)); |
| 88 | sepgsql_avc_check_perms_label(ncontext, |
| 89 | SEPG_CLASS_DB_SCHEMA, |
| 90 | SEPG_DB_SCHEMA__CREATE, |
| 91 | audit_name.data, |
| 92 | true); |
no test coverage detected