Summary
The PostgreSQL database can be extended with SELinux support using the sepgsql module. The module adds label support to the various objects within a database, and checks access permissions between the session context and the target label. To obtain the session context, sepgsql relies either on purely socket-based communication, or labeled networking.
In this chapter, we learned how to enable the sepgsql module and how to troubleshoot possible policy issues. We then used the various default types within an example database and used these types to show how the access controls in sepgsql work. We then used SELinux's MCS support to further handle category-based access controls. Finally, we integrated PostgreSQL in a network using fallback labeling support.
In the next chapter, we will examine secure virtualization within Linux and see how SELinux contributes to the isolation of virtual guests.
