Received: from maia.hub.org (maia-2.hub.org [200.46.204.251]) by mail.postgresql.org (Postfix) with ESMTP id 2F59F1337B82 for ; Thu, 10 Mar 2011 10:45:39 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.251]) (amavisd-maia, port 10024) with ESMTP id 39871-01 for ; Thu, 10 Mar 2011 14:45:31 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from omr3.networksolutionsemail.com (omr3.networksolutionsemail.com [205.178.146.53]) by mail.postgresql.org (Postfix) with ESMTP id D62E91337BA6 for ; Thu, 10 Mar 2011 10:45:30 -0400 (AST) Received: from cm-omr14 (mail.networksolutionsemail.com [205.178.146.50]) by omr3.networksolutionsemail.com (8.13.6/8.13.6) with ESMTP id p2AEjUoP027514 for ; Thu, 10 Mar 2011 09:45:30 -0500 X-Authenticated-IP: 205.178.146.50 Received: from [205.178.146.50] ([205.178.146.50:45102] helo=webmail41) by cm-omr14 (envelope-from ) (ecelerity 2.2.2.41 r(31179/31189)) with ESMTP id 16/53-15232-A04E87D4; Thu, 10 Mar 2011 09:45:30 -0500 Received: from 65.222.202.204 (mark@remingtondatabasesolutions.com [65.222.202.204]) by webmail41 (Netsol 11.2.30) with WEBMAIL id 21480; Thu, 10 Mar 2011 14:45:30 +0000 From: "Mark Johnson" To: "Jaime Casanova" , "H S" Cc: "admin" Importance: Normal Sensitivity: Normal Message-ID: X-Mailer: Network Solutions Webmail, Build 11.2.30 X-Originating-IP: [65.222.202.204] X-Forwarded-For: [(null)] Date: Thu, 10 Mar 2011 14:45:30 +0000 Subject: Re: Oracle Label Security/ Row Level Security on Postgresql MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--=_vm_0011_W682345751_21480_1299768330" X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-0.735 tagged_above=-10 required=5 tests=BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_NUMERIC_HELO=1.164 X-Spam-Level: X-Archive-Number: 201103/116 X-Sequence-Number: 36988 ----=_vm_0011_W682345751_21480_1299768330 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I am in the same boat, and I do not think SE-PG or the pending PG 9.1 wil= l do what we want. I don't see where it provides per-user row filtering o= r column filtering as is possible with Oracle (well, certain Oracle editi= ons and/or certain extra cost software). I think even in PG 9.1 you will = need to use views or application layer logic to simulate Oracle's VPD and= OLS. It's my understanding that if your business requires row level secu= rity, then in PG you actually need to install separate clusters. Please correct me if I am mistaken, but I think SE-PG allows us to establ= ish Mandatory Access Controls (MAC) for each operation for each object, s= uch as creating an operating system group to explicitly names all users w= ho can query table foo, and another group to define who can insert into f= oo. Of course it's more than just that, but no point giving too much deta= il here as people can read the docs. I think SE-PG is more like Trusted O= racle, which was abandoned by Oracle after version 7 because MAC simply d= idn't satisfy customer requirements. Trusted Oracle was replaced with a c= ombination of OLS and Data Vault, both sold as add-ons to the Enterprise = Edition. (According to the OLS and Data Vault presentations I have been t= o, neither product alone does all of what Trusted Oracle used to do, and = Trusted Oracle didn't do all of the things OLS and DV do today, so we wou= ld be incorrect to think its one-for-one swap). -Mark -----Original Message----- From: Jaime Casanova [mailto:jaime@2ndquadrant.com] Sent: Thursday, March 10, 2011 12:52 AM To: 'H S' Cc: 'admin' Subject: Re: [ADMIN] Oracle Label Security/ Row Level Security on Postgre= sql On Mon, Mar 7, 2011 at 10:00 AM, H S wrote: > > We would like to implemen= t Oracle Label Security or Row level security or associated concepts mech= anism on PostgreSQL. for pg <=3D 9.0 you can try: http://wiki.postgresql.= org/wiki/SEPostgreSQL part of this is now part of pg 9.1 (not yet release= d) as a contrib module -- Jaime Casanova www.2ndQuadrant.com Professional= PostgreSQL: Soporte y capacitaci=C3=B3n de PostgreSQL -- Sent via pgsql-= admin mailing list (pgsql-admin@postgresql.org) To make changes to your s= ubscription: http://www.postgresql.org/mailpref/pgsql-admin ----=_vm_0011_W682345751_21480_1299768330 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
 

I am in the same boat, and I do not think SE-PG or the pending PG 9.1 = will do what we want.  I don't see where it provides per-user row fi= ltering or column filtering as is possible with Oracle (well, certain Ora= cle editions and/or certain extra cost software).  I think even in P= G 9.1 you will need to use views or application layer logic to simulate O= racle's VPD and OLS.  It's my understanding that if your business re= quires row level security, then in PG you actually need to install separa= te clusters.

Please correct me if I am mistaken, but I think SE-PG allows us to est= ablish Mandatory Access Controls (MAC) for each operation for each object= , such as creating an operating system group to explicitly names all user= s who can query table foo, and another group to define who can inser= t into foo.  Of course it's more than just that, but no point giving= too much detail here as people can read the docs.  I think SE-PG is= more like Trusted Oracle, which was abandoned by Oracle after version 7 = because MAC simply didn't satisfy customer requirements.  Trusted Or= acle was replaced with a combination of OLS and Data Vault, both sold as = add-ons to the Enterprise Edition.  (According to the OLS and Data V= ault presentations I have been to, neither product alone does all of what= Trusted Oracle used to do, and Trusted Oracle didn't do all of the thing= s OLS and DV do today, so we would be incorrect to think its one-for-one = swap). 

-Mark

 

-----Original Message-----
= From: Jaime Casanova [mailto:jaime@2ndquadrant.com]
Sent: T= hursday, March 10, 2011 12:52 AM
To: 'H S'
Cc: 'admin= '
Subject: Re: [ADMIN] Oracle Label Security/ Row Level Securit= y on Postgresql

On Mon, Mar 7, 2011 at 10:00 AM, H S wrote: > > We would like to implement Oracle Label = Security or Row level security or associated concepts mechanism on Postgr= eSQL. for pg <=3D 9.0 you can try: http://wiki.postgresql.org/wiki/SEP= ostgreSQL part of this is now part of pg 9.1 (not yet released) as a cont= rib module -- Jaime Casanova         www.2ndQuad= rant.com Professional PostgreSQL: Soporte y capacitaci=C3=B3n de PostgreS= QL -- Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org) To m= ake changes to your subscription: http://www.postgresql.org/mailpref/pgsq= l-admin
----=_vm_0011_W682345751_21480_1299768330--