Received: from maia.hub.org (maia-5.hub.org [200.46.204.29]) by mail.postgresql.org (Postfix) with ESMTP id 7CC4F1337BA8 for ; Thu, 10 Mar 2011 11:06:10 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024) with ESMTP id 33013-03 for ; Thu, 10 Mar 2011 15:06:02 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from tamriel.snowman.net (tamriel.snowman.net [72.66.115.51]) by mail.postgresql.org (Postfix) with ESMTP id 0A1DB1337B82 for ; Thu, 10 Mar 2011 11:05:59 -0400 (AST) Received: by tamriel.snowman.net (Postfix, from userid 1000) id 39C1D22981; Thu, 10 Mar 2011 10:06:00 -0500 (EST) Date: Thu, 10 Mar 2011 10:06:00 -0500 From: Stephen Frost To: Mark Johnson Cc: Jaime Casanova , H S , admin Subject: Re: Oracle Label Security/ Row Level Security on Postgresql Message-ID: <20110310150600.GO4116@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="HOW7O7gYNUCJ0BRN" Content-Disposition: inline In-Reply-To: X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/2.6.32-5-amd64 (x86_64) X-Uptime: 10:00:04 up 35 days, 23:30, 11 users, load average: 0.02, 0.05, 0.00 User-Agent: Mutt/1.5.20 (2009-06-14) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.91 tagged_above=-10 required=5 tests=BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01 X-Spam-Level: X-Archive-Number: 201103/118 X-Sequence-Number: 36990 --HOW7O7gYNUCJ0BRN Content-Type: text/plain; charset=us-ascii Content-Disposition: inline * Mark Johnson (mark@remingtondatabasesolutions.com) wrote: > I am in the same boat, and I do not think SE-PG or the pending PG 9.1 will do what we want. I don't see where it provides per-user row filtering or column filtering as is possible with Oracle (well, certain Oracle editions and/or certain extra cost software). SE-PG had row-level filtering based off label, so if you gave every user a label, that'd work (though that's not how it's typically done). > I think even in PG 9.1 you will need to use views or application layer logic to simulate Oracle's VPD and OLS. It's my understanding that if your business requires row level security, then in PG you actually need to install separate clusters. It's going to depend on exactly what you need/want to have segregated. You need separate clusters if you want the list of users to be different, since those are stored at the cluster level. PG 9.1 won't be including any kind of RLS beyond 'traditional' function/view-based custom implementations. It's good to hear more people asking about this, however, as RLS is definitely something I'd like to see get in to a release of PG in the future, and one of the definite push-backs is lack of user demand. > Please correct me if I am mistaken, but I think SE-PG allows us to establish Mandatory Access Controls (MAC) for each operation for each object, such as creating an operating system group to explicitly names all users who can query table foo, and another group to define who can insert into foo. You don't need to define Unix groups.. It is label-based and is tied into the kernel's ideas about what labels exist though. Certainly, for PG, we would like to have both stand-alone RLS and RLS which is backed by MAC/SELinux. Thanks, Stephen --HOW7O7gYNUCJ0BRN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAk146NgACgkQrzgMPqB3kijSBgCfbWVggIhsmCHUH8tCcC6/seb1 5CsAniCvG2v8z9YsxqMJZXKaC1H18UVJ =seUF -----END PGP SIGNATURE----- --HOW7O7gYNUCJ0BRN--