SECURITY_LABEL(7pg14)

💅 SECURITY LABEL — like, the whole manual page, bestie

okay so real talk: SECURITY LABEL is the PostgreSQL 14 command that slaps a security label onto a database object, or swaps out one that's already there. yes it's a mouthful, no we're not skipping anything, sit down, grab a strawberry 🍓

---

✨ SYNOPSIS ✨

SECURITY LABEL [ FOR provider ] ON
{
  TABLE object_name |
  COLUMN table_name.column_name |
  AGGREGATE aggregate_name ( aggregate_signature ) |
  DATABASE object_name |
  DOMAIN object_name |
  EVENT TRIGGER object_name |
  FOREIGN TABLE object_name |
  FUNCTION function_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
  LARGE OBJECT large_object_oid |
  MATERIALIZED VIEW object_name |
  [ PROCEDURAL ] LANGUAGE object_name |
  PROCEDURE procedure_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
  PUBLICATION object_name |
  ROLE object_name |
  ROUTINE routine_name [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] |
  SCHEMA object_name |
  SEQUENCE object_name |
  SUBSCRIPTION object_name |
  TABLESPACE object_name |
  TYPE object_name |
  VIEW object_name
} IS { string_literal | NULL }

and aggregate_signature is literally this:

* |
[ argmode ] [ argname ] argtype [ , ... ] |
[ [ argmode ] [ argname ] argtype [ , ... ] ] ORDER BY [ argmode ] [ argname ] argtype [ , ... ]

---

🦋 DESCRIPTION 🦋

SECURITY LABEL applies a security label to a database object. and like, an arbitrary number of security labels can be attached to one single object — one per label provider, bestie. a whole lil friend group of labels on one table. iconic. 👑

label providers are loadable modules that register themselves by calling the function register_label_provider.

⭐ note note note: register_label_provider is NOT an SQL function. like, at all. it can only be called from C code that's been loaded into the backend. so don't try it in psql, it's giving "wrong room, wrong party." 💀

the label provider is the one who decides whether a given label is even valid, and whether it's permissible to assign that label to that particular object. what a label means? also entirely up to the provider's discretion, no cap. PostgreSQL places no restrictions on whether or how a label provider has to interpret security labels — it just gives you the storage mechanism, that's it, that's the whole job. 🫶

in practice this facility exists so you can integrate with label-based mandatory access control (MAC) systems like SELinux. those systems make all their access control decisions based on object labels, instead of the traditional discretionary access control (DAC) concepts like users and groups. different vibe entirely.

💀 important: you must own the database object to use SECURITY LABEL. no owning, no labeling. periodt.

---

🎀 PARAMETERS 🎀

• object_name, table_name.column_name, aggregate_name, function_name, procedure_name, routine_name — the name of the object you're labeling. objects that live in schemas (tables, functions, etc.) can be schema-qualified. slay, be specific.
• provider — the name of the provider this label gets associated with. the named provider must be loaded, and it must consent to the proposed labeling operation (yes, consent, it's a whole thing). if exactly one provider is loaded, you can omit the provider name for brevity. queen of shortcuts. ✨
• argmode — the mode of a function, procedure, or aggregate argument: IN, OUT, INOUT, or VARIADIC. if you omit it, the default is IN. and ngl, SECURITY LABEL does not actually pay any attention to OUT arguments, because only the input arguments are needed to determine the function's identity. so listing the IN, INOUT, and VARIADIC arguments is sufficient, bestie. don't waste your time. 🙈
• argname — the name of a function, procedure, or aggregate argument. and again: SECURITY LABEL does not actually pay any attention to argument names, because only the argument data types are needed to determine the function's identity. it's the types that matter here, not the names.
• argtype — the data type of a function, procedure, or aggregate argument.
• large_object_oid — the OID of the large object.
• PROCEDURAL — this is a noise word. literally. it's just sitting there making noise. 💅
• string_literal — the new setting of the security label, written as a string literal.
• NULL — write NULL to drop the security label. bye bye label 🌸

---

🔥 EXAMPLES 🔥

so here's how you'd set or change the security label of a table, look:

SECURITY LABEL FOR selinux ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';

and to remove the label? also easy:

SECURITY LABEL FOR selinux ON TABLE mytable IS NULL;

---

🌈 COMPATIBILITY 🌈

there is no SECURITY LABEL command in the SQL standard. it's simply not a thing there. we made it, we love it. 😌

---

👑 SEE ALSO 👑

• sepgsql
• src/test/modules/dummy_seclabel

---

okay that's the whole thing, you're officially educated 💜 stay hydrated, own your objects, and remember: register_label_provider is C-only, don't @ me. this has been PostgreSQL 14.24, dated 2026, signing off — SECURITY LABEL(7) OUT. 🧚‍♀️✨