Skip to content

P
Postgres FD Implementation
Commit a4b3feeb authored by Robert Haas's avatar Robert Haas
Browse files
Options

Clean up 'chkselinuxenv' script. 

Eliminate dependencies on "which", as we don't really need that to be
installed for proper testing.  Don't number the tests, as that increases
the footprint of every patch that wants to add or remove tests.  Make
the test output more informative, so that it's a bit easier to see what
went right (or wrong).  Spelling and grammar improvements.
parent 10c378f2
Hide whitespace changes
Inline Side-by-side
Showing with 136 additions and 192 deletions
contrib/sepgsql/chkselinuxenv
View file @ a4b3feeb
...@@ -9,200 +9,153 @@ PG_DATADIR="$2" ...@@ -9,200 +9,153 @@ PG_DATADIR="$2"
echo echo
echo "============== checking selinux environment ==============" echo "============== checking selinux environment =============="
#
# Test.0 - necessary commands for environment checks # matchpathcon must be present to assess whether the installation environment
# # is OK.
echo -n "test installed commands ... " echo -n "checking for matchpathcon ... "
if ! which --help >&/dev/null; then if ! matchpathcon -n . >/dev/null 2>&1; then
echo "failed" echo "not found"
echo echo ""
echo "'which' command was not found, executable or installed." echo "matchpathcon not found; please install it or update your PATH."
echo "Please make sure your PATH, or install this command at first."
echo
echo "If yum is available on your system, it will suggest packages"
echo "to be installed:"
echo " # yum provides which"
exit 1 exit 1
fi fi
if ! matchpathcon -n / >&/dev/null; then echo "ok"
# runcon must be present to launch psql using the correct environment
echo -n "checking for runcon ... "
if ! runcon --help >/dev/null 2>&1; then
echo "failed" echo "failed"
echo echo ""
echo "'matchpathcon' command was not found, executable or installed." echo "The runcon command must exist and be executable; it is used to"
echo "Please make sure your PATH, or install this command at first." echo "launch psql command with a particular domain. It is typically"
echo echo "included within the coreutils package."
echo "If yum is available on your system, it will suggest packages" echo ""
echo "to be installed:"
echo " # yum provides which"
exit 1 exit 1
fi fi
echo "ok" echo "ok"
# # check that the user is running in the unconfined_t domain
# Test.1 - must be launched at unconfined_t domain echo -n "checking current user domain ... "
#
echo -n "test unconfined_t domain ... "
DOMAIN=`id -Z 2>/dev/null | sed 's/:/ /g' | awk '{print $3}'` DOMAIN=`id -Z 2>/dev/null | sed 's/:/ /g' | awk '{print $3}'`
echo ${DOMAIN:-failed}
if [ "${DOMAIN}" != "unconfined_t" ]; then if [ "${DOMAIN}" != "unconfined_t" ]; then
echo "failed" echo ""
echo echo "This regression test must be launched from the unconfined_t domain."
echo "This regression test needs to be launched on unconfined_t domain." echo ""
echo echo "The unconfined_t domain is typically the default domain for user"
echo "The unconfined_t domain is mostly default domain of users' shell" echo "shell processes. If the default has been changed on your system,"
echo "process. So, we suggest you to revert your special configuration" echo "you can revert the changes like this:"
echo "on your system, as follows:" echo ""
echo
echo " \$ su -" echo " \$ su -"
echo " # semanage login -d `whoami`" echo " # semanage login -d `whoami`"
echo echo ""
echo "Or, add a setting to login as unconfined_t domain" echo "Or, you can add a setting to log in using the unconfined_t domain:"
echo echo ""
echo " \$ su -" echo " \$ su -"
echo " # semanage login -a -s unconfined_u -r s0-s0:c0.c255 `whoami`" echo " # semanage login -a -s unconfined_u -r s0-s0:c0.c255 `whoami`"
echo echo ""
exit 1 exit 1
fi fi
echo "ok"
#
# Test.2 - 'runcon' must exist and be executable
#
echo -n "test runcon command ... "
CMD_RUNCON="`which runcon 2>/dev/null`" # SELinux must be configured to enforcing mode
if [ ! -x "${CMD_RUNCON}" ]; then echo -n "checking selinux operating mode ... "
echo "failed" CURRENT_MODE=`env LANG=C sestatus | grep 'Current mode:' | awk '{print $3}'`
echo echo ${CURRENT_MODE:-failed}
echo "The runcon must exist and be executable; it is internally used to" if [ "${CURRENT_MODE}" != enforcing ]; then
echo "launch psql command with a particular domain. It is mostly included" if [ "${CURRENT_MODE}" = permissive -o "${CURRENT_MODE}" = disabled ]; then
echo "within coreutils package. So, our suggestion is to install the latest" echo ""
echo "version of this package." echo "Before running the regression tests, SELinux must be enabled and"
echo echo "must be running in enforcing mode."
exit 1 echo ""
fi echo "If SELinux is currently running in permissive mode, you can"
echo "ok" echo "switch to enforcing command using the 'setenforce' command."
echo
# echo " \$ su -"
# Test.3 - 'sestatus' must exist and be executable echo " # setenforce 1"
# echo ""
echo -n "test sestatus command ... " echo "The system default setting is configured in /etc/selinux/config,"
echo "or using a kernel bool parameter."
CMD_SESTATUS="`which sestatus 2>/dev/null`" echo ""
if [ ! -x "${CMD_SESTATUS}" ]; then else
echo "failed" echo ""
echo echo "Unable to determine the current selinux operating mode. Please"
echo "The sestatus should exist and be executable; it is internally used to" echo "verify that the sestatus command is installed and in your PATH."
echo "this checks; to show configuration of SELinux. It is mostly included" echo ""
echo "within policycoreutils package. So, our suggestion is to install the" fi
echo "latest version of this package."
echo
exit 1 exit 1
fi fi
echo "ok"
#
# Test.4 - 'getsebool' must exist and be executable
#
echo -n "test getsebool command ... "
CMD_GETSEBOOL="`which getsebool`"
if [ ! -x "${CMD_GETSEBOOL}" ]; then
echo "failed"
echo
echo "The getsebool should exist and be executable; it is internally used to"
echo "this checks; to show current setting of SELinux boolean variables."
echo "It is mostly included within libselinux-utils package. So, our suggestion"
echo "is to install the latest version of this package."
echo
exit 1
fi
echo "ok"
#
# Test.5 - SELinux must be configured to enforcing mode
#
echo -n "test enforcing mode ... "
CURRENT_MODE=`env LANG=C ${CMD_SESTATUS} | grep 'Current mode:' | awk '{print $3}'` # 'sepgsql-regtest' policy module must be loaded
if [ "${CURRENT_MODE}" != "enforcing" ]; then echo -n "checking for sepgsql-regtest policy ... "
echo "failed" SELINUX_MNT=`env LANG=C sestatus 2>/dev/null | grep '^SELinuxfs mount:' | awk '{print $3}'`
echo if [ "$SELINUX_MNT" = "" ]; then
echo "SELinux must be configured to 'enforcing' mode." echo "failed"
echo "You can switch SELinux to enforcing mode using setenforce command," echo ""
echo "as follows:" echo "Unable to find SELinuxfs mount point."
echo echo ""
echo " \$ su -" echo "The sestatus command should report the location where SELinuxfs"
echo " # setenforce 1" echo "is mounted, but did not do so."
echo echo ""
echo "The system default setting is configured at /etc/selinux/config," exit 1
echo "or kernel bool parameter. Please also check it, if you see this"
echo "message although you didn't switch to permissive mode."
echo
exit 1
fi fi
echo "ok"
#
# Test.6 - 'sepgsql-regtest' policy module must be loaded
#
echo -n "test sepgsql-regtest policy ... "
SELINUX_MNT=`env LANG=C ${CMD_SESTATUS} | grep '^SELinuxfs mount:' | awk '{print $3}'`
if [ ! -e ${SELINUX_MNT}/booleans/sepgsql_regression_test_mode ]; then if [ ! -e ${SELINUX_MNT}/booleans/sepgsql_regression_test_mode ]; then
echo "failed" echo "failed"
echo echo ""
echo "The 'sepgsql-regtest' policy module must be installed; that provide" echo "The 'sepgsql-regtest' policy module appears not to be installed."
echo "a set of special rules for this regression test." echo "Without this policy installed, the regression tests will fail."
echo "You can install this module as follows:" echo "You can install this module using the following commands:"
echo echo ""
echo " \$ make -f /usr/share/selinux/devel/Makefile -C contrib/selinux" echo " \$ make -f /usr/share/selinux/devel/Makefile -C contrib/selinux"
echo " \$ su" echo " \$ su"
echo " # semodule -i contrib/sepgsql/sepgsql-regtest.pp" echo " # semodule -i contrib/sepgsql/sepgsql-regtest.pp"
echo echo ""
echo "Then, you can confirm the policy package being installed, as follows:" echo "To confirm that policy package is installed, use this command:"
echo echo ""
echo " # semodule -l | grep sepgsql" echo " # semodule -l | grep sepgsql"
echo echo ""
exit 1 exit 1
fi fi
echo "ok" echo "ok"
# # Verify that sepgsql_regression_test_mode is active.
# Test.7 - 'sepgsql_regression_test_mode' must be turned on echo -n "checking whether policy is enabled ... "
# POLICY_STATUS=`getsebool sepgsql_regression_test_mode | awk '{print $3}'`
echo -n "test selinux boolean ... " echo ${POLICY_STATUS:-failed}
if [ "${POLICY_STATUS}" != "on" ]; then
if ! ${CMD_GETSEBOOL} sepgsql_regression_test_mode | grep -q ' on$'; then echo ""
echo "failed" echo "The SELinux boolean 'sepgsql_regression_test_mode' must be"
echo echo "turned on in order to enable the rules necessary to run the"
echo "The boolean variable of 'sepgsql_regression_test_mode' must be" echo "regression tests."
echo "turned. It affects an internal state of SELinux policy, then" echo ""
echo "a set of rules to run regression test will be activated." if "${POLICY_STATUS}" = ""; then
echo "You can turn on this variable as follows:" echo "We attempted to determine the state of this Boolean using"
echo echo "'getsebool', but that command did not produce the expected"
echo " \$ su -" echo "output. Please verify that getsebool is available and in"
echo " # setsebool sepgsql_regression_test_mode 1" echo "your PATH."
echo else
echo "Also note that we recommend to turn off this variable after the" echo "You can turn on this variable using the following commands:"
echo "regression test, because it activates unnecessary rules." echo ""
echo echo " \$ su -"
echo " # setsebool sepgsql_regression_test_mode 1"
echo ""
echo "For security reasons, it is suggested that you turn off this"
echo "variable when regression testing is complete and the associated"
echo "rules are no longer needed."
fi
echo ""
exit 1 exit 1
fi fi
echo "ok"
#
# Test.8 - 'psql' command must be executable by test domain
#
echo -n "test execution of psql ... "
# 'psql' command must be executable by test domain
echo -n "checking whether we can run psql ... "
CMD_PSQL="${PG_BINDIR}/psql" CMD_PSQL="${PG_BINDIR}/psql"
${CMD_RUNCON} -t sepgsql_regtest_user_t ${CMD_PSQL} --help >& /dev/null runcon -t sepgsql_regtest_user_t ${CMD_PSQL} --help >& /dev/null
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
echo "failed" echo "failed"
echo echo
echo "The ${CMD_PSQL} must be executable by sepgsql_regtest_user_t" echo "${CMD_PSQL} must be executable from the sepgsql_regtest_user_t"
echo "domain. It has restricted privileges compared to unconfined_t," echo "domain. The domain has restricted privileges compared to"
echo "so you should ensure whether this command is labeled correctly." echo "unconfined_t, so you should ensure that it is labeled correctly."
echo echo
echo " \$ su - (not needed, if you owns installation directory)" echo " \$ su - (not needed, if you owns installation directory)"
EXPECT_PSQL=`matchpathcon -n ${CMD_PSQL} | sed 's/:/ /g' | awk '{print $3}'` EXPECT_PSQL=`matchpathcon -n ${CMD_PSQL} | sed 's/:/ /g' | awk '{print $3}'`
...@@ -226,61 +179,52 @@ if [ $? -ne 0 ]; then ...@@ -226,61 +179,52 @@ if [ $? -ne 0 ]; then
fi fi
echo "ok" echo "ok"
# # loadable module must be installed and not configured to permissive mode
# Test.9 - 'sepgsql' must be installed echo -n "checking sepgsql installation ... "
# and, not configured to permissive mode
#
echo -n "test sepgsql installation ... "
VAL="`${CMD_PSQL} template1 -tc 'SHOW sepgsql.permissive' 2>/dev/null`" VAL="`${CMD_PSQL} template1 -tc 'SHOW sepgsql.permissive' 2>/dev/null`"
RETVAL="$?" RETVAL="$?"
if [ $RETVAL -eq 2 ]; then if [ $RETVAL -eq 2 ]; then
echo "failed" echo "failed"
echo echo ""
echo "The postgresql server process is not connectable." echo "Unable to connect to the server. Please check your installation."
echo "Please check your installation first, rather than selinux settings." echo ""
echo
exit 1 exit 1
elif [ $RETVAL -ne 0 ]; then elif [ $RETVAL -ne 0 ]; then
echo "failed" echo "failed"
echo echo ""
echo "The sepgsql module was not loaded. So, our recommendation is to" echo "The 'sepgsql' module does not appear to be loaded. Please verify"
echo "confirm 'shared_preload_libraries' setting in postgresql.conf," echo "that the 'shared_preload_libraries' setting in postgresql.conf"
echo "then restart server process." echo "includes sepgsql, and then stop and restart the server."
echo "It must have '\$libdir/sepgsql' at least." echo ""
echo
exit 1 exit 1
elif ! echo "$VAL" | grep -q 'off$'; then elif ! echo "$VAL" | grep -q 'off$'; then
echo "failed" echo "failed"
echo echo ""
echo "The GUC variable 'sepgsql.permissive' was set to 'on', although" echo "The GUC variable 'sepgsql.permissive' is set to 'on'. It must be"
echo "system configuration is enforcing mode." echo "turned off before running the regression tests."
echo "You should eliminate this setting from postgresql.conf, then" echo ""
echo "restart server process."
echo
exit 1 exit 1
fi fi
echo "ok" echo "ok"
# # template1 database must be labeled
# Test.10 - 'template1' database must be labeled echo -n "checking for labels in template1 ... "
# NUM=`${CMD_PSQL} template1 -Atc 'SELECT count(*) FROM pg_catalog.pg_seclabel' 2>/dev/null`
echo -n "test template1 database ... "
NUM=`${CMD_PSQL} template1 -tc 'SELECT count(*) FROM pg_catalog.pg_seclabel' 2>/dev/null`
if [ -z "${NUM}" -o "$NUM" -eq 0 ]; then if [ -z "${NUM}" -o "$NUM" -eq 0 ]; then
echo "failed!" echo "failed"
echo echo ""
echo "Initial labels must be assigned on the 'template1' database; that shall" echo "In order to regression test sepgsql, initial labels must be assigned"
echo "be copied to the database for regression test." echo "on the 'template1' database. These labels will be copied into the"
echo "regression test database."
echo ""
echo "See Installation section of the PostgreSQL documentation." echo "See Installation section of the PostgreSQL documentation."
echo echo ""
exit 1 exit 1
fi fi
echo "ok" echo "found ${NUM}"
# #
# check complete - # check complete -
# #
echo echo ""
exit 0 exit 0
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment