[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Sven Vermeulen]

commit:     308888a12ee5791053d6d80cfc49fc620b54ba83
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Aug 16 18:20:03 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Aug 16 18:20:03 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=308888a1

Support executing postgresql utilities without transition

Clients that want to interact with postgresql need execute privileges on the
commands, but do not require domain transitions.

---
 policy/modules/services/postgresql.if |   18 ++++++++++++++++++
 1 files changed, 18 insertions(+), 0 deletions(-)

diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index ecef19f..81f87bd 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -334,6 +334,24 @@ interface(`postgresql_manage_db',`
 	allow $1 postgresql_db_t:lnk_file { getattr read };
 ')
 
+#######################################
+## <summary>
+##	Execute postgresql in the calling domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`postgresql_exec',`
+	gen_require(`
+		type postgresql_exec_t;
+	')
+
+	can_exec($1, postgresql_exec_t);
+')
+
 ########################################
 ## <summary>
 ##	Execute postgresql in the postgresql domain.