commit: 30142b2d3d2fbe3e30c81bd7463e8bb8e4f1752d
Author: Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May 6 20:14:04 2024 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Tue May 14 17:41:39 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=30142b2d
postgres: add a standalone execmem tunable
Add a separate tunable to allow Postgres to use execmem. This is to
support JIT in the Postgres server without enabling it for the entire
system.
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/services/postgresql.te | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/postgresql.te
b/policy/modules/services/postgresql.te
index 810fb0ed4..7eec1b665 100644
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -18,6 +18,13 @@ gen_require(`
# Declarations
#
+## <desc>
+## <p>
+## Allow postgresql to map memory regions as both executable and writable
(e.g. for JIT).
+## </p>
+## </desc>
+gen_tunable(psql_allow_execmem, false)
+
## <desc>
## <p>
## Allow unprived users to execute DDL statement
@@ -363,7 +370,7 @@ optional_policy(`
mta_getattr_spool(postgresql_t)
')
-tunable_policy(`allow_execmem',`
+tunable_policy(`allow_execmem || psql_allow_execmem',`
allow postgresql_t self:process execmem;
')
