SECURITY_LABEL(7)

✨ SECURITY LABEL ✨

okay bestie, sit down, hydrate, because we're talking about SECURITY LABEL — the PostgreSQL 18.6 manual page that lets you define or change a security label applied to an object 💅 no cap.

---

🎀 NAME 🎀

SECURITY_LABEL — define or change a security label applied to an object. that's it, that's the whole vibe 🦋

---

🌸 SYNOPSIS 🌸

SECURITY LABEL [ FOR provider ] ON
{
  TABLE object_name |
  COLUMN table_name.column_name |
  AGGREGATE aggregate_name ( aggregate_signature ) |
  DATABASE object_name |
  DOMAIN object_name |
  EVENT TRIGGER object_name |
  FOREIGN TABLE object_name |
  FUNCTION function_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
  LARGE OBJECT large_object_oid |
  MATERIALIZED VIEW object_name |
  [ PROCEDURAL ] LANGUAGE object_name |
  PROCEDURE procedure_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
  PUBLICATION object_name |
  ROLE object_name |
  ROUTINE routine_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
  SCHEMA object_name |
  SEQUENCE object_name |
  SUBSCRIPTION object_name |
  TABLESPACE object_name |
  TYPE object_name |
  VIEW object_name
} IS { string_literal | NULL }

and where aggregate_signature is, bestie:

* |
[ argmode ] [ argname ] argtype [ , ... ] |
[ [ argmode ] [ argname ] argtype [ , ... ] ] ORDER BY [ argmode ] [ argname ] argtype [ , ... ]

like. that's a LOT of object types and honestly? she ate 👑

---

💖 DESCRIPTION 💖

SECURITY LABEL slaps a security label onto a database object. you can stack an arbitrary number of security labels on one object — literally one per label provider, no drama. and what even IS a label provider? it's a loadable module that registers itself by calling the function register_label_provider. periodt.

Note 📌 register_label_provider is not an SQL function. it can only be called from C code loaded into the backend. so like, not a "just type it in psql" situation, bestie 😭

so the label provider is the one making all the calls: it decides whether a given label is even valid, and whether it's permissible to assign that label to a given object. what the label means? also entirely up to the provider. PostgreSQL places no restrictions on whether or how a label provider must interpret security labels — she literally just provides a mechanism for storing them 🫶

in practice this facility is intended to allow integration with label-based mandatory access control (MAC) systems such as SELinux. those systems make all access control decisions based on object labels, rather than traditional discretionary access control (DAC) concepts such as users and groups. it's giving main character energy, honestly.

⚠️ You must own the database object to use SECURITY LABEL. no owning, no labeling. rules are rules 💅

---

🦋 PARAMETERS 🦋

• object_name, table_name.column_name, aggregate_name, function_name, procedure_name, routine_name — the name of the object to be labeled. and here's the tea: names of objects that reside in schemas (tables, functions, etc.) can be schema-qualified. slay 🌈
• provider — the name of the provider this label is gonna be associated with. the named provider must be loaded and must consent to the proposed labeling operation (yes, consent, we love that for her). if exactly one provider is loaded, the provider name may be omitted for brevity. lowkey convenient ✨
• argmode — the mode of a function, procedure, or aggregate argument: IN, OUT, INOUT, or VARIADIC. if omitted, the default is IN. heads up though: SECURITY LABEL does not actually pay any attention to OUT arguments, since only the input arguments are needed to determine the function's identity. so it is sufficient to list the IN, INOUT, and VARIADIC arguments. don't waste your breath on the OUTs, they're not the moment 🙈
• argname — the name of a function, procedure, or aggregate argument. ngl, SECURITY LABEL does not actually pay any attention to argument names either, since only the argument data types are needed to determine the function's identity. so yeah, names are decorative here 💀
• argtype — the data type of a function, procedure, or aggregate argument.
• large_object_oid — the OID of the large object. just the number, bestie.
• PROCEDURAL — this is a noise word. literally that. a noise word. iconic honestly 🎀
• string_literal — the new setting of the security label, written as a string literal.
• NULL — write NULL to drop the security label. bye bye label 👋

---

💜 EXAMPLES 💜

the following example shows how the security label of a table could be set or changed:

SECURITY LABEL FOR selinux ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';

to remove the label:

SECURITY LABEL FOR selinux ON TABLE mytable IS NULL;

see how clean that is? obsessed 🔥

---

👑 COMPATIBILITY 👑

there is no SECURITY LABEL command in the SQL standard. not a thing. we made this. we're built different 💅

---

⭐ SEE ALSO ⭐

• sepgsql
• src/test/modules/dummy_seclabel

---

and that's the whole page, bestie!! 🩷

PostgreSQL 18.6 — dated 2026 — SECURITY LABEL(7). go forth and label responsibly, you absolute queen 🧚💖