trunk: Tunable connection to postgresql for users from KaiGai Kohei.

diff --git a/Changelog b/Changelog
index 0e09011f44b8979625f51bf608501fb3b7ed2444..6f9a3fb8f1de4324e9673ad21361d67812b75a8d 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Tunable connection to postgresql for users from KaiGai Kohei.
 - Memprotect support patch from Stephen Smalley.
 - Add logging_send_audit_msgs() interface and deprecate
   send_audit_msgs_pattern().

diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
index ab075ab8647e90f4457fea222af8ead46b3fda16..e5a6a25a16e60f09aa373ae347cf0bc7972cb612 100644 (file)
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -175,16 +175,6 @@ optional_policy(`
 ')
 
 ifdef(`TODO',`
-ifdef(`targeted_policy', `', `
-bool allow_user_postgresql_connect false;
-
-if (allow_user_postgresql_connect) {
-# allow any user domain to connect to the database server
-allow userdomain postgresql_t:unix_stream_socket connectto;
-allow userdomain postgresql_var_run_t:sock_file write;
-allow userdomain postgresql_tmp_t:sock_file write;
-}
-')
 ifdef(`distro_debian', `
        init_exec_script_files(postgresql_t)
        # gross hack

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 60f6fd80d5fb9e282d95e5752ecfd5ddbd0606ad..fcd45722698bb13665460d0ea41413c5c2f6cc3b 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -904,6 +904,12 @@ template(`userdom_common_user_template',`
                pcscd_stream_connect($1_t)
        ')
 
+       optional_policy(`
+               tunable_policy(`allow_user_postgresql_connect',`
+                       postgresql_stream_connect($1_t)
+               ')
+       ')
+
        optional_policy(`
                quota_dontaudit_getattr_db($1_t)
        ')

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 1ad652d4b65816373717d3f4af1ae441bd46cc26..22ac2f2ade7951874a3e2a1417d69bc2ed4ca1ae 100644 (file)
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -1,5 +1,5 @@
 
-policy_module(userdomain,2.2.2)
+policy_module(userdomain,2.2.3)
 
 gen_require(`
        role sysadm_r, staff_r, user_r;
@@ -30,6 +30,13 @@ gen_tunable(allow_ptrace,false)
 ## </desc>
 gen_tunable(allow_user_mysql_connect,false)
 
+## <desc>
+## <p>
+## Allow users to connect to PostgreSQL
+## </p>
+## </desc>
+gen_tunable(allow_user_postgresql_connect,false)
+
 ## <desc>
 ## <p>
 ## Allow regular users direct mouse access