Function sepgsql_compute_create

contrib/sepgsql/selinux.c:835–882

* sepgsql_compute_create * * It returns a default security context to be assigned on a new database * object. SELinux compute it based on a combination of client, upper object * which owns the new object and object class. * * For example, when a client (staff_u:staff_r:staff_t:s0) tries to create * a new table within a schema (system_u:object_r:sepgsql_schema_t:s0), * SELinux looks-up its

 * tclass: class code (SEPG_CLASS_*) of the new object in creation
 */
char *
sepgsql_compute_create(const char *scontext,
					   const char *tcontext,
					   uint16 tclass,
					   const char *objname)
{
	char	   *ncontext;
	security_class_t tclass_ex;
	const char *tclass_name;
	char	   *result;

	/* Get external code of the object class */
	Assert(tclass < SEPG_CLASS_MAX);

	tclass_name = selinux_catalog[tclass].class_name;
	tclass_ex = string_to_security_class(tclass_name);

	/*
	 * Ask SELinux what is the default context for the given object class on a
	 * pair of security contexts
	 */
	if (security_compute_create_name_raw(scontext,
										 tcontext,
										 tclass_ex,
										 objname,
										 &ncontext) < 0)
		ereport(ERROR,
				(errcode(ERRCODE_INTERNAL_ERROR),
				 errmsg("SELinux could not compute a new context: "
						"scontext=%s tcontext=%s tclass=%s: %m",
						scontext, tcontext, tclass_name)));

	/*
	 * libselinux returns malloc()'ed string, so we need to copy it on the
	 * palloc()'ed region.
	 */
	PG_TRY();
	{
		result = pstrdup(ncontext);
	}
	PG_FINALLY();
	{
		freecon(ncontext);
	}
	PG_END_TRY();

	return result;
}

/*
 * sepgsql_check_perms