SELinux System Administration - Third Edition

Chapter 8: SEPostgreSQL – Extending PostgreSQL with SELinux

In the previous chapter, we covered a few example SELinux-aware applications: applications that know and interact with the SELinux subsystem to further enhance security within the application context. Some of these use existing policy constructs, such as Apache's mod_selinux, whereas others enhance the policy with custom classes to further fine-tune their behavior (as with D-Bus and the acquire_svc permission).

With Security-Enhanced PostgreSQL (SEPostgreSQL), we get a more elaborate example of an SELinux-aware application, which uses multiple additional classes within SELinux, as well as labeling its internal database objects to further enforce security rules. In this chapter, we will ...