SE-PostgreSQL Linux SELinux Security-Enhanced PostgreSQL

Size: px

Start display at page:

Download "SE-PostgreSQL Linux SELinux Security-Enhanced PostgreSQL"

まなかんけ
9 years ago
Views:

1 Open Source Conference 2008.DB (07-Jun-2008, Tokyo/Japan) Security-Enhanced PostgreSQL OS OS

2 SE-PostgreSQL Linux SELinux Security-Enhanced PostgreSQL 2006 IPA

googlecode.com/files/osc2008.db-sepgsql.

3 1,280 PRICELESS etc UNIX permission... Database ACL

4 Operating System SELinux MAC MAC = Mandatory Access Control ( )

5 Operating System SELinux MAC SE-PostgreSQL MAC = Mandatory Access Control ( )

6 OS/DBMS OS... DBMS... SQL DB SE-PostgreSQL Operating System UNIX Permission SELinux Policy SE-PostgreSQL Database ACL SE-PostgreSQL SQL Query Execution Engine *** +++ ## *** ++ ### * + # ***** +++ #####

7 SE-PostgreSQL PostgreSQL OS OS SQL

8 security_context postgres=# select security_context, * from drink; security_context id name price unconfined_u:object_r:sepgsql_table_t 1 water 110 unconfined_u:object_r:sepgsql_table_t 2 coke 120 unconfined_u:object_r:sepgsql_table_t 3 milk 150 unconfined_u:object_r:sepgsql_table_t 4 juice 130 unconfined_u:object_r:sepgsql_table_t:classified 5 beer 240 unconfined_u:object_r:sepgsql_table_t:classified 6 wine 380 (6 rows) SELinux [kaigai@masu ~]$ ls -Z /etc/ -rw-r--r-- root root system_u:object_r:etc_aliases_t aliases -rw-r--r-- root root system_u:object_r:etc_t auto.master -rw-r--r-- root root system_u:object_r:etc_t auto.misc -rw-r--r-- root root system_u:object_r:etc_t group -r root root system_u:object_r:shadow_t shadow -rw-r--r-- root root system_u:object_r:etc_t passwd : : : : :

unconfined_u:object_r:sepgsql_table_t:classified 5 beer 240 unconfined_u:object_r:sepgsql_table_t:classified 6 wine 380 (6 rows) SELinux [kaigai@masu ~]$ ls -Z /etc/ -rw-r--r-- root root

9 SELECT... UPDATE/DELETE... / Unclassified water, coke, beer security_context id name price Unclassified...:sepgsql_table_t:Unclassified 1 water 110 SELECT...:sepgsql_table_t:Unclassified...:sepgsql_table_t:Classified 2 3 coke milk SELECT...:sepgsql_table_t:Classified 4 juice 130 Classified...:sepgsql_table_t:Unclassified 5 beer :sepgsql_table_t:Secret 6 wine 380 Unclassified Classified water, coke, milk, juice, beer

..:sepgsql_table_t:Classified 4 juice 130 Classified...:sepgsql_table_t:Unclassified 5 beer 240.

10 SELECT uid, uid, uname,, age(birthday), dname FROM person p JOIN division d ON ON p.did = d.did WHERE p.residence = OR OR d.address = ; person division SE-PostgreSQL uid did uname residence birthday did dname address

11 Case Study (1/2) SELECT name, price * 2 FROM drink WHERE id < 40; db_column:{select}... name price db_column:{use}... id {use} : db_procedure:{execute}... int4mulint4lt db_table:{select use}... drink SQL db_tuple:{select use}...

$.. id {use} : db_procedure:{execute}.$

12 Case Study (2/2) db_column:{update}... size db_column:{select update}... price price db_column:{use}... alcohol db_procedure:{execute}... booleqint4mul db_table:{select use update}... drink SQL UPDATE drink SET size = 500, price = price * 2 WHERE alcohol = true; db_tuple:{select use update}...

$.. booleqint4mul db_table:{select use update}.$

13 Performance CPU: CPU: Core2Duo Core2Duo E6400, E6400, Mem: Mem: 1GB, 1GB, HDD: HDD: SATA SATA shared_buffer=512m, rest rest of of options options are are in in default. default. $ $ pgbench pgbench -c -c 22 -t -t % access vector cache (AVC):

of options options are are in in default.

14 Demonstration All or Nothing

15 World Wide (1/3) SELinux Linux kernel Fedora Project Fedora 8 SELinux Developer Summit USA

16 World Wide (2/3) PostgreSQL Data: From: Josh Berkus I'm chasing a rumor that someone is working on integrating PostgreSQL with the SELinux security framework. Anyone know anything about this? SE-PostgreSQL Data: From: KaiGai Kohei Subject: [ANN] SE-PostgreSQL alpha release SELinux PostgreSQL Conference version & Developer Summit Feature 2007@Baltimore Freeze ( 08/04/01) (3/14-16) Data: From: KaiGai Kohei Subject: [RFC] PostgreSQL Access Control Extension (PGACE) Data: From: Tome Lane Well, personally I won't have any cycles to think hard about any post-8.3 work until after the beta is out. orz

0 alpha release SELinux PostgreSQL Conference version & Developer 8.3.

17 World Wide (3/3) PostgreSQL v8.4 CommitFest:May Date: From: Josh Berkus Folks, For hackers who don't understand security frameworks, I'm going to make a strong case for KaiGai's patch. Because of... PostgreSQL Development Commit Fest PGcon 2008@Ottawa Beta version Stable Release

For hackers who don't understand security frameworks, I'm going to make a

18 SE-PostgreSQL PostgreSQL PostgreSQL v8.4 Operating System SELinux MAC SE-PostgreSQL X-Window

19 SE-PostgreSQL Home SVNRPM The SE-PostgreSQL Security Guide (/ ) SE-PostgreSQL

20 Any Question?

21 Thank you!

DOUSHISYA-sports_R12339(高解像度).pdf

DOUSHISYA-sports_R12339(高解像度).pdf Doshisha Journal of Health & Sports Science, 4, 41-50 2012 41 A Case Study of the Comprehensive community sports clubs that People with Disability Participate in. Motoaki Fujita In this study, the interview