Chapter 8: SEPostgreSQL – Extending PostgreSQL with SELinux

In the previous chapter, we covered a few example SELinux-aware applications: applications that know and interact with the SELinux subsystem to further enhance security within the application context. Some of these use existing policy constructs, such as Apache's mod_selinux, whereas others enhance the policy with custom classes to further fine-tune their behavior (as with D-Bus and the acquire_svc permission).

With Security-Enhanced PostgreSQL (SEPostgreSQL), we get a more elaborate example of an SELinux-aware application, which uses multiple additional classes within SELinux, as well as labeling its internal database objects to further enforce security rules. In this chapter, we will learn how to apply labels within PostgreSQL, debug its enforcement rules, associate the right labels with the PostgreSQL resources, and show how this label-based security method can be used to augment specific security practices...