SECURITY LABEL

定义或更改应用于对象的安全标签

英文手册覆盖始于 PostgreSQL 6.4. 来源历史与运行验证各自保留独立版本边界。

当前阅读 PG 18·选择有来源记录的版本

9.1 9.2 9.3 9.4 9.5 9.6 10 11 12 13 14 15 16 17 18 19 20

anchor: SQL-SECURITY-LABEL
file: sql-security-label.html
lang: en
name: SECURITY LABEL
purpose: define or change a security label applied to an object
purpose zh: 未知
sections same as: 未知
slug: 18

语法

SECURITY LABEL [ FOR provider ] ON
{
TABLE object_name |
COLUMN table_name.column_name |
AGGREGATE aggregate_name ( aggregate_signature ) |
DATABASE object_name |
DOMAIN object_name |
EVENT TRIGGER object_name |
FOREIGN TABLE object_name |
FUNCTION function_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
LARGE OBJECT large_object_oid |
MATERIALIZED VIEW object_name |
[ PROCEDURAL ] LANGUAGE object_name |
PROCEDURE procedure_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
PUBLICATION object_name |
ROLE object_name |
ROUTINE routine_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
SCHEMA object_name |
SEQUENCE object_name |
SUBSCRIPTION object_name |
TABLESPACE object_name |
TYPE object_name |
VIEW object_name
} IS { string_literal | NULL }

where aggregate_signature is:

* |
[ argmode ] [ argname ] argtype [ , ... ] |
[ [ argmode ] [ argname ] argtype [ , ... ] ] ORDER BY [ argmode ] [ argname ] argtype [ , ... ]

语法图

从左向右阅读；分支表示选择，旁路表示可选，循环表示重复。点击带下划线的参数可打开对应规则。

aggregate_signature

版本定义 PG 18

SECURITY LABEL [ FOR provider ] ON
{
TABLE object_name |
COLUMN table_name.column_name |
AGGREGATE aggregate_name ( aggregate_signature ) |
DATABASE object_name |
DOMAIN object_name |
EVENT TRIGGER object_name |
FOREIGN TABLE object_name |
FUNCTION function_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
LARGE OBJECT large_object_oid |
MATERIALIZED VIEW object_name |
[ PROCEDURAL ] LANGUAGE object_name |
PROCEDURE procedure_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
PUBLICATION object_name |
ROLE object_name |
ROUTINE routine_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
SCHEMA object_name |
SEQUENCE object_name |
SUBSCRIPTION object_name |
TABLESPACE object_name |
TYPE object_name |
VIEW object_name
} IS { string_literal | NULL }

其中 aggregate_signature 是：

* |
[ argmode ] [ argname ] argtype [ , ... ] |
[ [ argmode ] [ argname ] argtype [ , ... ] ] ORDER BY [ argmode ] [ argname ] argtype [ , ... ]

描述

SECURITY LABEL为数据库对象设置安全标签。一个给定的数据库对象可以关联任意数量的安全标签，每个标签提供者对应一个。标签提供者是使用函数register_label_provider注册自身的可加载模块。

注意

register_label_provider不是一个 SQL 函数；它只能从加载到后端的 C 代码中调用。

标签提供者决定给定标签是否有效，以及是否允许将该标签赋给给定对象。给定标签的含义同样由标签提供者自行决定。PostgreSQL不限制标签提供者是否解释安全标签，也不限制其如何解释；它仅提供一种存储安全标签的机制。实际上，此功能旨在支持与基于标签的强制访问控制（MAC）系统（例如SELinux）集成。这类系统基于对象标签，而不是基于用户和组等传统的自主访问控制（DAC）概念，做出所有访问控制决策。

要使用SECURITY LABEL，你必须拥有该数据库对象。

参数

object_name table_name.column_name aggregate_name function_name procedure_name routine_name: 要加上安全标签的对象名称。位于模式中的对象（表、函数等）的名称可以带模式限定。
provider: 要与该标签关联的标签提供者名称。指定的提供者必须已加载，并且必须同意所提议的标签设置操作。若只加载了一个提供者，则为简洁起见可以省略其名称。
argmode: 函数、过程或聚合函数参数的模式：IN、OUT、INOUT或VARIADIC。如果省略，默认值是 IN。注意SECURITY LABEL实际上并不关心OUT参数，因为确定函数身份只需要输入参数。因此，列出 IN、INOUT和VARIADIC参数就足够了。
argname: 函数、过程或聚合函数参数的名称。注意SECURITY LABEL 实际上并不关心参数名称，因为确定函数身份只需要参数数据类型。
argtype: 函数、过程或聚合函数参数的数据类型。
large_object_oid: 大对象的 OID。
PROCEDURAL: 这是一个噪声词。
string_literal: 安全标签的新值，以字符串字面量形式写出。
NULL: 写入NULL可删除安全标签。

示例

下面的示例展示了如何设置或更改一个表的安全标签：

SECURITY LABEL FOR selinux ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';

要移除该标签：

SECURITY LABEL FOR selinux ON TABLE mytable IS NULL;

兼容性

在 SQL 标准中没有SECURITY LABEL命令。

另见

sepgsql, src/test/modules/dummy_seclabel

比较版本

完整来源事实

synopsis html

SECURITY LABEL [ FOR <em class="replaceable"><code>provider</code></em> ] ON
{
  TABLE <em class="replaceable"><code>object_name</code></em> |
  COLUMN <em class="replaceable"><code>table_name</code></em>.<em class="replaceable"><code>column_name</code></em> |
  AGGREGATE <em class="replaceable"><code>aggregate_name</code></em> ( <em class="replaceable"><code>aggregate_signature</code></em> ) |
  DATABASE <em class="replaceable"><code>object_name</code></em> |
  DOMAIN <em class="replaceable"><code>object_name</code></em> |
  EVENT TRIGGER <em class="replaceable"><code>object_name</code></em> |
  FOREIGN TABLE <em class="replaceable"><code>object_name</code></em> |
  FUNCTION <em class="replaceable"><code>function_name</code></em> [ ( [ [ <em class="replaceable"><code>argmode</code></em> ] [ <em class="replaceable"><code>argname</code></em> ] <em class="replaceable"><code>argtype</code></em> [, ...] ] ) ] |
  LARGE OBJECT <em class="replaceable"><code>large_object_oid</code></em> |
  MATERIALIZED VIEW <em class="replaceable"><code>object_name</code></em> |
  [ PROCEDURAL ] LANGUAGE <em class="replaceable"><code>object_name</code></em> |
  PROCEDURE <em class="replaceable"><code>procedure_name</code></em> [ ( [ [ <em class="replaceable"><code>argmode</code></em> ] [ <em class="replaceable"><code>argname</code></em> ] <em class="replaceable"><code>argtype</code></em> [, ...] ] ) ] |
  PUBLICATION <em class="replaceable"><code>object_name</code></em> |
  ROLE <em class="replaceable"><code>object_name</code></em> |
  ROUTINE <em class="replaceable"><code>routine_name</code></em> [ ( [ [ <em class="replaceable"><code>argmode</code></em> ] [ <em class="replaceable"><code>argname</code></em> ] <em class="replaceable"><code>argtype</code></em> [, ...] ] ) ] |
  SCHEMA <em class="replaceable"><code>object_name</code></em> |
  SEQUENCE <em class="replaceable"><code>object_name</code></em> |
  SUBSCRIPTION <em class="replaceable"><code>object_name</code></em> |
  TABLESPACE <em class="replaceable"><code>object_name</code></em> |
  TYPE <em class="replaceable"><code>object_name</code></em> |
  VIEW <em class="replaceable"><code>object_name</code></em>
} IS { <em class="replaceable"><code>string_literal</code></em> | NULL }

<span class="phrase">where <em class="replaceable"><code>aggregate_signature</code></em> is:</span>

* |
[ <em class="replaceable"><code>argmode</code></em> ] [ <em class="replaceable"><code>argname</code></em> ] <em class="replaceable"><code>argtype</code></em> [ , ... ] |
[ [ <em class="replaceable"><code>argmode</code></em> ] [ <em class="replaceable"><code>argname</code></em> ] <em class="replaceable"><code>argtype</code></em> [ , ... ] ] ORDER BY [ <em class="replaceable"><code>argmode</code></em> ] [ <em class="replaceable"><code>argname</code></em> ] <em class="replaceable"><code>argtype</code></em> [ , ... ]

synopsis text

SECURITY LABEL [ FOR provider ] ON
{
TABLE object_name |
COLUMN table_name.column_name |
AGGREGATE aggregate_name ( aggregate_signature ) |
DATABASE object_name |
DOMAIN object_name |
EVENT TRIGGER object_name |
FOREIGN TABLE object_name |
FUNCTION function_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
LARGE OBJECT large_object_oid |
MATERIALIZED VIEW object_name |
[ PROCEDURAL ] LANGUAGE object_name |
PROCEDURE procedure_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
PUBLICATION object_name |
ROLE object_name |
ROUTINE routine_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
SCHEMA object_name |
SEQUENCE object_name |
SUBSCRIPTION object_name |
TABLESPACE object_name |
TYPE object_name |
VIEW object_name
} IS { string_literal | NULL }

where aggregate_signature is:

* |
[ argmode ] [ argname ] argtype [ , ... ] |
[ [ argmode ] [ argname ] argtype [ , ... ] ] ORDER BY [ argmode ] [ argname ] argtype [ , ... ]

来源引用

完整定义与证据 JSON

定义来源

center · PostgreSQL 18 · b7bd9cda

正文语言: zh-Hans · ca936764