Using MCS and MLS

The most common use case for enabling the sepgsql module is to use Multi-Category Support (MCS) and Multi-Level Security (MLS) support within SELinux to fine-tune access to resources.

Limiting access to columns based on categories

Suppose we use the range of category numbers from c900 to c909 to address specific PII datasets, and grant users access to these categories either by granting them direct access, or by using specific SELinux contexts to consult this data.

Within the database, we could mark the PII-sensitive data with a category number within that range:

db_test=# SECURITY LABEL ON COLUMN tb_users.mail IS 'system_u:object_r:sepgsql_table_t:s0:c903';
db_test=# SECURITY LABEL ON COLUMN tb_users.address IS 'system_u:object_r:sepgsql_table_t:s0:c903';

With the labels applied, a user that does not have access to this category will not be able to access the data:

db_test=> SELECT sepgsql_getcon();
user_u:user_r:user_t:s0...