diff options
Diffstat (limited to 'contrib/sepgsql/uavc.c')
| -rw-r--r-- | contrib/sepgsql/uavc.c | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/contrib/sepgsql/uavc.c b/contrib/sepgsql/uavc.c index 9641a17d79..b014b01f36 100644 --- a/contrib/sepgsql/uavc.c +++ b/contrib/sepgsql/uavc.c @@ -6,7 +6,7 @@ * access control decisions recently used, and reduce number of kernel * invocations to avoid unnecessary performance hit. * - * Copyright (c) 2011-2012, PostgreSQL Global Development Group + * Copyright (c) 2011-2014, PostgreSQL Global Development Group * * ------------------------------------------------------------------------- */ @@ -142,7 +142,7 @@ sepgsql_avc_reclaim(void) * Access control decisions must be atomic, but multiple system calls may * be required to make a decision; thus, when referencing the access vector * cache, we must loop until we complete without an intervening cache flush - * event. In practice, looping even once should be very rare. Callers should + * event. In practice, looping even once should be very rare. Callers should * do something like this: * * sepgsql_avc_check_valid(); @@ -250,10 +250,10 @@ sepgsql_avc_compute(const char *scontext, const char *tcontext, uint16 tclass) { if (!ucontext) ncontext = sepgsql_compute_create(scontext, tcontext, - SEPG_CLASS_PROCESS); + SEPG_CLASS_PROCESS, NULL); else ncontext = sepgsql_compute_create(scontext, ucontext, - SEPG_CLASS_PROCESS); + SEPG_CLASS_PROCESS, NULL); if (strcmp(scontext, ncontext) == 0) { pfree(ncontext); @@ -335,7 +335,7 @@ sepgsql_avc_lookup(const char *scontext, const char *tcontext, uint16 tclass) * * It returns 'true', if the security policy suggested to allow the required * permissions. Otherwise, it returns 'false' or raises an error according - * to the 'abort' argument. + * to the 'abort_on_violation' argument. * The 'tobject' and 'tclass' identify the target object being referenced, * and 'required' is a bitmask of permissions (SEPG_*__*) defined for each * object classes. @@ -345,7 +345,8 @@ sepgsql_avc_lookup(const char *scontext, const char *tcontext, uint16 tclass) bool sepgsql_avc_check_perms_label(const char *tcontext, uint16 tclass, uint32 required, - const char *audit_name, bool abort) + const char *audit_name, + bool abort_on_violation) { char *scontext = sepgsql_get_client_label(); avc_cache *cache; @@ -415,7 +416,7 @@ sepgsql_avc_check_perms_label(const char *tcontext, audit_name); } - if (abort && !result) + if (abort_on_violation && !result) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("SELinux: security policy violation"))); @@ -426,14 +427,15 @@ sepgsql_avc_check_perms_label(const char *tcontext, bool sepgsql_avc_check_perms(const ObjectAddress *tobject, uint16 tclass, uint32 required, - const char *audit_name, bool abort) + const char *audit_name, + bool abort_on_violation) { char *tcontext = GetSecurityLabel(tobject, SEPGSQL_LABEL_TAG); bool rc; rc = sepgsql_avc_check_perms_label(tcontext, tclass, required, - audit_name, abort); + audit_name, abort_on_violation); if (tcontext) pfree(tcontext); |