Changeset: 2ad0e916de12 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=2ad0e916de12
Modified Files:
MonetDB.spec
buildtools/selinux/monetdb.te
sql/backends/monet5/sql_execute.c
tools/merovingian/daemon/config/monetdbd.service.in
Branch: Apr2019
Log Message:
Merge with Aug2018 branch.
diffs (79 lines):
diff --git a/MonetDB.spec b/MonetDB.spec
--- a/MonetDB.spec
+++ b/MonetDB.spec
@@ -895,7 +895,10 @@ automatic index management, extensibilit
accelerators. It also has an SQL frontend.
This package contains the SELinux policy for running MonetDB under
-control of systemd.
+control of systemd. There is one tunable parameter, mserver5_can_read_home,
+which can be set using "setsebool -P mserver5_can_read_home=true" to allow
+an mserver5 process started by monetdbd under the control of systemd to
+read files in users' home directories.
%post selinux
for selinuxvariant in %{selinux_variants}
diff --git a/buildtools/selinux/monetdb.te b/buildtools/selinux/monetdb.te
--- a/buildtools/selinux/monetdb.te
+++ b/buildtools/selinux/monetdb.te
@@ -1,4 +1,4 @@
-policy_module(monetdb, 0.3)
+policy_module(monetdb, 0.4)
# The above line declares that this file is a SELinux policy file. Its
# name is monetdb, so the file should be saved as monetdb.te
@@ -7,6 +7,7 @@ require {
type proc_net_t;
type tmp_t;
type var_t;
+ type user_home_t;
class dir { read };
class fd { use };
class fifo_file { getattr read write };
@@ -119,4 +120,9 @@ manage_sock_files_pattern(mserver5_t, ms
allow mserver5_t monetdbd_t:fifo_file { read write getattr };
allow mserver5_t monetdbd_t:unix_stream_socket { read write getopt shutdown };
allow mserver5_t var_t:dir { read };
+gen_tunable(mserver5_can_read_home, false)
+tunable_policy(`mserver5_can_read_home', `
+ userdom_search_user_home_dirs(mserver5_t)
+ allow mserver5_t user_home_t:file read_file_perms;
+')
allow monetdbd_t mserver5_t:unix_stream_socket { connectto };
diff --git a/sql/backends/monet5/sql_execute.c
b/sql/backends/monet5/sql_execute.c
--- a/sql/backends/monet5/sql_execute.c
+++ b/sql/backends/monet5/sql_execute.c
@@ -622,13 +622,19 @@ SQLstatementIntern(Client c, str *expr,
if (err || c->curprg->def->errors || msg) {
/* restore the state */
+ char *error = NULL;
MSresetInstructions(c->curprg->def, oldstop);
freeVariables(c, c->curprg->def, c->glb, oldvtop);
c->curprg->def->errors = 0;
if (strlen(m->errstr) > 6 && m->errstr[5] == '!')
- msg = createException(PARSE, "SQLparser", "%s",
m->errstr);
+ error = createException(PARSE, "SQLparser",
"%s", m->errstr);
+ else if (*m->errstr)
+ error = createException(PARSE, "SQLparser",
SQLSTATE(42000) "%s", m->errstr);
else
- msg = createException(PARSE, "SQLparser",
SQLSTATE(42000) "%s", m->errstr);
+ error = createException(PARSE, "SQLparser",
SQLSTATE(42000) "%s", msg);
+ if (msg)
+ freeException(msg);
+ msg = error;
*m->errstr = 0;
goto endofcompile;
}
diff --git a/tools/merovingian/daemon/config/monetdbd.service.in
b/tools/merovingian/daemon/config/monetdbd.service.in
--- a/tools/merovingian/daemon/config/monetdbd.service.in
+++ b/tools/merovingian/daemon/config/monetdbd.service.in
@@ -13,7 +13,7 @@ Restart=on-failure
PIDFile=@Erundir@/merovingian.pid
PrivateDevices=no
ProtectSystem=full
-ProtectHome=true
+ProtectHome=read-only
[Install]
WantedBy=multi-user.target
_______________________________________________
checkin-list mailing list
[email protected]
https://www.monetdb.org/mailman/listinfo/checkin-list
