Configuring PostgreSQL with SELinux

XorMon can be installed on operating systems with SELinux enabled in enforcing mode.
If you follow our installation guide for Red Hat Enterprise Linux, no additional configuration is required.

However, it is important to note that the PostgreSQL database is installed by default with the "unconfined_service_t" domain.

PostgreSQL can be configured with its own SELinux domain so that the database can access only its own files (data, logs).

The procedure may vary depending on the operating system version and the PostgreSQL installation.

Prerequisites for the procedure below:

• RHEL 9.8 x86_64
• PostgreSQL installed from the PGDG repository according to the instructions on our website
  https://xormon.com/install-redhat-x86.php
• Service name: postgresql-16.service
• Directory containing binaries: /usr/pgsql-16/bin
• Directory containing data files: /app/postgres/data

Checking the current configuration

ps -eo label,pid,user,comm,args | grep '[p]ostgres'

Expected output

system_u:system_r:unconfined_service_t:s0

"unconfined_service_t" means that PostgreSQL is not running in its own restricted domain.

Installing additional tools

dnf install policycoreutils-python-utils selinux-policy-doc setools-console

Binary File Settings

Create a new rule

semanage fcontext -a -t postgresql_exec_t '/usr/pgsql-16/bin/(postgres|postmaster|pg_ctl|initdb)'

Apply the rule

restorecon -v "/usr/pgsql-16/bin/postgres" "/usr/pgsql-16/bin/pg_ctl" "/usr/pgsql-16/bin/initdb"

Verification

ls -lZ "/usr/pgsql-16/bin/postgres" "/usr/pgsql-16/bin/pg_ctl" "/usr/pgsql-16/bin/initdb"

matchpathcon -V "/usr/pgsql-16/bin/postgres" "/usr/pgsql-16/bin/pg_ctl" "/usr/pgsql-16/bin/initdb"

Expected type

postgresql_exec_t

Configuring the Data Directory

Stop PostgreSQL

systemctl stop postgresql-16.service

Add a persistent rule

semanage fcontext -a -t postgresql_db_t '/app/postgres/data(/.*)?'

Apply the rule to existing data

restorecon -Rv "/app/postgres/data"

Verification

ls -ldZ "/app/postgres/data"
find "/app/postgres/data" -maxdepth 2 -printf '%Z %p\n' | head -50
matchpathcon -V "/app/postgres/data"

Expected data type

postgresql_db_t

Directory Path Check

PostgreSQL must be able to navigate through every directory in the path

namei -l "/app/postgres/data"

ls -ldZ \
    /app \
    /app/postgres \
    /app/postgres/data

Spuštění a ověření domény

Start PostgreSQL

systemctl start postgresql-16.service
systemctl status postgresql-16.service --no-pager

Check the processes

ps -eo label,pid,user,comm,args | grep '[p]ostgres'

Expected output

system_u:system_r:postgresql_t:s0

Data directory

ls -ldZ "/app/postgres/data"

The expected result contains

system_u:object_r:postgresql_db_t:s0

A typical correct combination is therefore

binary:  postgresql_exec_t
process:  postgresql_t
data:    postgresql_db_t