From: Tom Lane <tgl@sss.pgh.pa.us>
To: Mike Palmiotto <mike.palmiotto@crunchydata.com>
cc: pgsql-hackers@lists.postgresql.org, Joe Conway <mail@joeconway.com>
Subject: Re: sepgsql seems rather thoroughly broken on Fedora 30
In-reply-to: 
 <CAMN686Ew55FmGAZMsin_r2GKOpTwNwGS2PJ2v+KX8jO2yU3Sqw@mail.gmail.com>
References: <23856.1563381159@sss.pgh.pa.us>
 <CAMN686Ew55FmGAZMsin_r2GKOpTwNwGS2PJ2v+KX8jO2yU3Sqw@mail.gmail.com>
Comments: In-reply-to Mike Palmiotto <mike.palmiotto@crunchydata.com>
	message dated "Thu, 18 Jul 2019 19:23:08 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <25537.1563549575.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 19 Jul 2019 11:19:35 -0400
Message-ID: <25538.1563549575@sss.pgh.pa.us>
Precedence: bulk

Mike Palmiotto <mike.palmiotto@crunchydata.com> writes:
> The sepgsql_regtest_user_t domain should be allowed to read any file
> labeled "passwd_file_t". We can check that with the `sesearch` tool,
> provided by the "setools-console" package on F30:

> % sudo sesearch -A -s sepgsql_regtest_user_t -t passwd_file_t
> allow domain file_type:blk_file map; [ domain_can_mmap_files ]:True
> allow domain file_type:chr_file map; [ domain_can_mmap_files ]:True
> allow domain file_type:file map; [ domain_can_mmap_files ]:True
> allow nsswitch_domain passwd_file_t:file { getattr ioctl lock map open r=
ead };

I got around to trying this, and lookee here:

$ sudo sesearch -A -s sepgsql_regtest_user_t -t passwd_file_t
allow domain file_type:blk_file map; [ domain_can_mmap_files ]:True
allow domain file_type:chr_file map; [ domain_can_mmap_files ]:True
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow domain file_type:lnk_file map; [ domain_can_mmap_files ]:True

Nothing about passwd_file_t.  So *something* is different about the
way the policy is being expanded.

			regards, tom lane