Understanding SELinux's database-specific object classes and permissions

The sepgsql module uses several database-specific SELinux classes to fine-tune the policies and access controls. The supported classes can be listed through /sys/fs/selinux/class or the seinfo command:

# seinfo --class | grep db_
db_blob
db_column
db_database
db_language
db_procedure
db_schema
db_sequence
db_table
db_tuple
db_view

These classes have an obvious relational database meaning: db_database is for database-related permissions, db_table for table permissions, db_procedure for database procedures, and so on. While not all classes are still supported by sepgsql (the db_database class has no immediate support anymore), most do have their usual mapping within the PostgreSQL database.

Let's see what permissions are supported by sepgsql and how this can be used to fine-tune access controls within the database.

Understanding sepgsql permissions

The access controls that sepgsql enforces...