Product SiteDocumentation Site

Chapter 21. PostgreSQL

21.1. PostgreSQL and SELinux
21.2. Types
21.3. Booleans
21.4. Configuration Examples
21.4.1. PostgreSQL Changing Database Location
PostgreSQL is an Object-Relational database management system (DBMS).[22]
In Fedora, the postgresql-server package provides PostgreSQL. Run the following command to see if the postgresql-server package is installed:
~]# rpm -q postgresql-server
If it is not installed, use the DNF utility as root to install it:
~]# dnf install postgresql-server

21.1. PostgreSQL and SELinux

When PostgreSQL is enabled, it runs confined by default. Confined processes run in their own domains, and are separated from other confined processes. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited. The following example demonstrates the PostgreSQL processes running in their own domain. This example assumes the postgresql-server package is installed:
  1. Run the getenforce command to confirm SELinux is running in enforcing mode:
    ~]$ getenforce
    The command returns Enforcing when SELinux is running in enforcing mode.
  2. Run the following command as the root user to start postgresql:
    ~]# systemctl start postgresql.service
    Confirm that the service is running. The output should include the information below (only the time stamp will differ):
    ~]# systemctl start postgresql.service
    postgresql.service - PostgreSQL database server
       Loaded: loaded (/usr/lib/systemd/system/postgresql.service; disabled)
       Active: active (running) since Mon 2013-08-05 14:57:49 CEST; 12s
  3. Run the following command to view the postgresql processes:
    ~]$ ps -eZ | grep postgres
    system_u:system_r:postgresql_t:s0 395 ?    00:00:00 postmaster
    system_u:system_r:postgresql_t:s0 397 ?    00:00:00 postmaster
    system_u:system_r:postgresql_t:s0 399 ?    00:00:00 postmaster
    system_u:system_r:postgresql_t:s0 400 ?    00:00:00 postmaster
    system_u:system_r:postgresql_t:s0 401 ?    00:00:00 postmaster
    system_u:system_r:postgresql_t:s0 402 ?    00:00:00 postmaster
    The SELinux context associated with the postgresql processes is system_u:system_r:postgresql_t:s0. The second last part of the context, postgresql_t, is the type. A type defines a domain for processes and a type for files. In this case, the postgresql processes are running in the postgresql_t domain.

[22] See the PostgreSQL project page for more information.