pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedOracle Label Security/ Row Level Security on Postgresql
11+ messages / 7 participants
[nested] [flat]
* Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-07 15:00 H S <aras_h1988@yahoo.com>
0 siblings, 2 replies; 11+ messages in thread
From: H S @ 2011-03-07 15:00 UTC (permalink / raw)
To: pgsql-admin
Dear Sirs,
We would like to implement Oracle Label Security or Row level security or associated concepts mechanism on PostgreSQL.
What projects have don on it bis now?
refer me to them.
I would like to hear any from you.
What should I do, and ...
Regards,...
Sara
^ permalink raw reply [nested|flat] 11+ messages in thread
* Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-07 16:04 H S <aras_h1988@yahoo.com>
0 siblings, 1 reply; 11+ messages in thread
From: H S @ 2011-03-07 16:04 UTC (permalink / raw)
To: pgsql-admin
--- On Mon, 3/7/11, H S <aras_h1988@yahoo.com> wrote:
From: H S <aras_h1988@yahoo.com>
Subject: Oracle Label Security/ Row Level Security on Postgresql
To: "admin" <pgsql-admin@postgresql.org>
Date: Monday, March 7, 2011, 6:30 PM
Dear Sirs,
We would like to implement Oracle Label Security or Row level security or associated concepts mechanism on PostgreSQL.
What projects have don on it bis now?
refer me to them.
I would like to hear any from you.
What should I do, and ...
Regards,...
Sara
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-07 16:05 bricklen <bricklen@gmail.com>
parent: H S <aras_h1988@yahoo.com>
1 sibling, 0 replies; 11+ messages in thread
From: bricklen @ 2011-03-07 16:05 UTC (permalink / raw)
To: H S <aras_h1988@yahoo.com>; +Cc: pgsql-admin
On Mon, Mar 7, 2011 at 7:00 AM, H S <aras_h1988@yahoo.com> wrote:
>
> Dear Sirs,
>
> We would like to implement Oracle Label Security or Row level security or
> associated concepts mechanism on PostgreSQL.
> What projects have don on it bis now?
> refer me to them.
> I would like to hear any from you.
>
> What should I do, and ...
>
> Regards,...
>
> Sara
>
>
VEIL might be of use to you: http://pgfoundry.org/projects/veil
I've never used it though.
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-07 16:16 Kevin Grittner <Kevin.Grittner@wicourts.gov>
parent: H S <aras_h1988@yahoo.com>
0 siblings, 0 replies; 11+ messages in thread
From: Kevin Grittner @ 2011-03-07 16:16 UTC (permalink / raw)
To: pgsql-admin; H S <aras_h1988@yahoo.com>
H S <aras_h1988@yahoo.com> wrote:
> [five posts to the same list in two days with the same question]
Spamming the list with the same hand-wavy question multiple times
per day is not going to do you much good. Taking some time to
explain your situation and needs in more detail might. Keep in mind
that responses here are on a volunteer basis, and people are pretty
busy right now trying to wrap up a release.
Even though you don't seem to be reporting a problem, per se, this
page might help you formulate a post which will get responses you
will find more useful:
http://wiki.postgresql.org/wiki/Guide_to_reporting_problems
-Kevin
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-10 05:52 Jaime Casanova <jaime@2ndquadrant.com>
parent: H S <aras_h1988@yahoo.com>
1 sibling, 1 reply; 11+ messages in thread
From: Jaime Casanova @ 2011-03-10 05:52 UTC (permalink / raw)
To: H S <aras_h1988@yahoo.com>; +Cc: pgsql-admin
On Mon, Mar 7, 2011 at 10:00 AM, H S <aras_h1988@yahoo.com> wrote:
>
> We would like to implement Oracle Label Security or Row level security or associated concepts mechanism on PostgreSQL.
for pg <= 9.0 you can try: http://wiki.postgresql.org/wiki/SEPostgreSQL
part of this is now part of pg 9.1 (not yet released) as a contrib module
--
Jaime Casanova www.2ndQuadrant.com
Professional PostgreSQL: Soporte y capacitación de PostgreSQL
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-10 11:35 H S <aras_h1988@yahoo.com>
parent: Jaime Casanova <jaime@2ndquadrant.com>
0 siblings, 0 replies; 11+ messages in thread
From: H S @ 2011-03-10 11:35 UTC (permalink / raw)
To: Jaime Casanova <jaime@2ndquadrant.com>; +Cc: pgsql-admin
Would be available for me , that Version of Postgresql that include the mention mechanism?
Have I the opportunity to see the code for example before releasing?
Regards,
Sara
--- On Thu, 3/10/11, Jaime Casanova <jaime@2ndquadrant.com> wrote:
From: Jaime Casanova <jaime@2ndquadrant.com>
Subject: Re: [ADMIN] Oracle Label Security/ Row Level Security on Postgresql
To: "H S" <aras_h1988@yahoo.com>
Cc: "admin" <pgsql-admin@postgresql.org>
Date: Thursday, March 10, 2011, 9:22 AM
On Mon, Mar 7, 2011 at 10:00 AM, H S <aras_h1988@yahoo.com> wrote:
>
> We would like to implement Oracle Label Security or Row level security or associated concepts mechanism on PostgreSQL.
for pg <= 9.0 you can try: http://wiki.postgresql.org/wiki/SEPostgreSQL
part of this is now part of pg 9.1 (not yet released) as a contrib module
--
Jaime Casanova www.2ndQuadrant.com
Professional PostgreSQL: Soporte y capacitación de PostgreSQL
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-10 14:45 Mark Johnson <mark@remingtondatabasesolutions.com>
0 siblings, 2 replies; 11+ messages in thread
From: Mark Johnson @ 2011-03-10 14:45 UTC (permalink / raw)
To: Jaime Casanova <jaime@2ndquadrant.com>; H S <aras_h1988@yahoo.com>; +Cc: pgsql-admin
I am in the same boat, and I do not think SE-PG or the pending PG 9.1 will do what we want. I don't see where it provides per-user row filtering or column filtering as is possible with Oracle (well, certain Oracle editions and/or certain extra cost software). I think even in PG 9.1 you will need to use views or application layer logic to simulate Oracle's VPD and OLS. It's my understanding that if your business requires row level security, then in PG you actually need to install separate clusters.
Please correct me if I am mistaken, but I think SE-PG allows us to establish Mandatory Access Controls (MAC) for each operation for each object, such as creating an operating system group to explicitly names all users who can query table foo, and another group to define who can insert into foo. Of course it's more than just that, but no point giving too much detail here as people can read the docs. I think SE-PG is more like Trusted Oracle, which was abandoned by Oracle after version 7 because MAC simply didn't satisfy customer requirements. Trusted Oracle was replaced with a combination of OLS and Data Vault, both sold as add-ons to the Enterprise Edition. (According to the OLS and Data Vault presentations I have been to, neither product alone does all of what Trusted Oracle used to do, and Trusted Oracle didn't do all of the things OLS and DV do today, so we would be incorrect to think its one-for-one swap).
-Mark
-----Original Message-----
From: Jaime Casanova [mailto:jaime@2ndquadrant.com]
Sent: Thursday, March 10, 2011 12:52 AM
To: 'H S'
Cc: 'admin'
Subject: Re: [ADMIN] Oracle Label Security/ Row Level Security on Postgresql
On Mon, Mar 7, 2011 at 10:00 AM, H S wrote: > > We would like to implement Oracle Label Security or Row level security or associated concepts mechanism on PostgreSQL. for pg <= 9.0 you can try: http://wiki.postgresql.org/wiki/SEPostgreSQL part of this is now part of pg 9.1 (not yet released) as a contrib module -- Jaime Casanova www.2ndQuadrant.com Professional PostgreSQL: Soporte y capacitación de PostgreSQL -- Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-10 14:54 Kevin Grittner <Kevin.Grittner@wicourts.gov>
parent: Mark Johnson <mark@remingtondatabasesolutions.com>
1 sibling, 1 reply; 11+ messages in thread
From: Kevin Grittner @ 2011-03-10 14:54 UTC (permalink / raw)
To: Jaime Casanova <jaime@2ndquadrant.com>; Mark Johnson <mark@remingtondatabasesolutions.com>; H S <aras_h1988@yahoo.com>; +Cc: pgsql-admin
"Mark Johnson" <mark@remingtondatabasesolutions.com> wrote:
> I don't see where it provides per-user row filtering or column
> filtering
Did you look at veil?
http://veil.projects.postgresql.org/curdocs/index.html
(This was mentioned earlier, but the OP didn't respond to that.)
-Kevin
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-10 15:06 Stephen Frost <sfrost@snowman.net>
parent: Mark Johnson <mark@remingtondatabasesolutions.com>
1 sibling, 0 replies; 11+ messages in thread
From: Stephen Frost @ 2011-03-10 15:06 UTC (permalink / raw)
To: Mark Johnson <mark@remingtondatabasesolutions.com>; +Cc: Jaime Casanova <jaime@2ndquadrant.com>; H S <aras_h1988@yahoo.com>; pgsql-admin
* Mark Johnson (mark@remingtondatabasesolutions.com) wrote:
> I am in the same boat, and I do not think SE-PG or the pending PG 9.1 will do what we want. I don't see where it provides per-user row filtering or column filtering as is possible with Oracle (well, certain Oracle editions and/or certain extra cost software).
SE-PG had row-level filtering based off label, so if you gave every user
a label, that'd work (though that's not how it's typically done).
> I think even in PG 9.1 you will need to use views or application layer logic to simulate Oracle's VPD and OLS. It's my understanding that if your business requires row level security, then in PG you actually need to install separate clusters.
It's going to depend on exactly what you need/want to have segregated.
You need separate clusters if you want the list of users to be
different, since those are stored at the cluster level. PG 9.1 won't be
including any kind of RLS beyond 'traditional' function/view-based
custom implementations. It's good to hear more people asking about
this, however, as RLS is definitely something I'd like to see get in to
a release of PG in the future, and one of the definite push-backs is
lack of user demand.
> Please correct me if I am mistaken, but I think SE-PG allows us to establish Mandatory Access Controls (MAC) for each operation for each object, such as creating an operating system group to explicitly names all users who can query table foo, and another group to define who can insert into foo.
You don't need to define Unix groups.. It is label-based and is tied
into the kernel's ideas about what labels exist though. Certainly,
for PG, we would like to have both stand-alone RLS and RLS which is
backed by MAC/SELinux.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 197B) download
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-15 03:04 H S <aras_h1988@yahoo.com>
parent: Kevin Grittner <Kevin.Grittner@wicourts.gov>
0 siblings, 1 reply; 11+ messages in thread
From: H S @ 2011-03-15 03:04 UTC (permalink / raw)
To: Kevin Grittner <Kevin.Grittner@wicourts.gov>; +Cc: pgsql-admin
Kevin,
What did you mean by "OP"?
Did you look at veil?
http://veil.projects.postgresql.org/curdocs/index.html
(This was mentioned earlier, but the OP didn't respond to that.)
Thanks,
Sara
--- On Thu, 3/10/11, Kevin Grittner <Kevin.Grittner@wicourts.gov> wrote:
From: Kevin Grittner <Kevin.Grittner@wicourts.gov>
Subject: Re: [ADMIN] Oracle Label Security/ Row Level Security on Postgresql
To: "Jaime Casanova" <jaime@2ndquadrant.com>, "Mark Johnson" <mark@remingtondatabasesolutions.com>, "H S" <aras_h1988@yahoo.com>
Cc: "admin" <pgsql-admin@postgresql.org>
Date: Thursday, March 10, 2011, 6:24 PM
"Mark Johnson" <mark@remingtondatabasesolutions.com> wrote:
> I don't see where it provides per-user row filtering or column
> filtering
Did you look at veil?
http://veil.projects.postgresql.org/curdocs/index.html
(This was mentioned earlier, but the OP didn't respond to that.)
-Kevin
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: Oracle Label Security/ Row Level Security on Postgresql
@ 2011-03-15 03:42 Joshua D. Drake <jd@commandprompt.com>
parent: H S <aras_h1988@yahoo.com>
0 siblings, 0 replies; 11+ messages in thread
From: Joshua D. Drake @ 2011-03-15 03:42 UTC (permalink / raw)
To: H S <aras_h1988@yahoo.com>; +Cc: Kevin Grittner <Kevin.Grittner@wicourts.gov>; pgsql-admin
On Mon, 2011-03-14 at 20:04 -0700, H S wrote:
> Kevin,
>
> What did you mean by "OP"?
It means "Original Poster"
--
PostgreSQL.org Major Contributor
Command Prompt, Inc: http://www.commandprompt.com/ - 509.416.6579
Consulting, Training, Support, Custom Development, Engineering
http://twitter.com/cmdpromptinc | http://identi.ca/commandprompt
^ permalink raw reply [nested|flat] 11+ messages in thread
end of thread, other threads:[~2011-03-15 03:42 UTC | newest]
Thread overview: 11+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2011-03-07 15:00 Oracle Label Security/ Row Level Security on Postgresql H S <aras_h1988@yahoo.com>
2011-03-07 16:05 ` Re: Oracle Label Security/ Row Level Security on Postgresql bricklen <bricklen@gmail.com>
2011-03-10 05:52 ` Re: Oracle Label Security/ Row Level Security on Postgresql Jaime Casanova <jaime@2ndquadrant.com>
2011-03-10 11:35 ` Re: Oracle Label Security/ Row Level Security on Postgresql H S <aras_h1988@yahoo.com>
2011-03-07 16:04 Oracle Label Security/ Row Level Security on Postgresql H S <aras_h1988@yahoo.com>
2011-03-07 16:16 ` Kevin Grittner <Kevin.Grittner@wicourts.gov>
2011-03-10 14:45 Re: Oracle Label Security/ Row Level Security on Postgresql Mark Johnson <mark@remingtondatabasesolutions.com>
2011-03-10 14:54 ` Re: Oracle Label Security/ Row Level Security on Postgresql Kevin Grittner <Kevin.Grittner@wicourts.gov>
2011-03-15 03:04 ` Re: Oracle Label Security/ Row Level Security on Postgresql H S <aras_h1988@yahoo.com>
2011-03-15 03:42 ` Re: Oracle Label Security/ Row Level Security on Postgresql Joshua D. Drake <jd@commandprompt.com>
2011-03-10 15:06 ` Re: Oracle Label Security/ Row Level Security on Postgresql Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox