Received: from localhost (unknown [200.46.208.211]) by mail.postgresql.org (Postfix) with ESMTP id 535EC63837F for ; Mon, 20 Apr 2009 08:17:02 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024) with ESMTP id 89522-01-9 for ; Mon, 20 Apr 2009 08:16:53 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from exprod7og123.obsmtp.com (exprod7og123.obsmtp.com [64.18.2.24]) by mail.postgresql.org (Postfix) with SMTP id B6FBF634428 for ; Mon, 20 Apr 2009 02:43:53 -0300 (ADT) Received: from source ([209.85.219.164]) by exprod7ob123.postini.com ([64.18.6.12]) with SMTP ID DSNKSewLmFXPomYm1PcgXD81VBGizG1pffJP@postini.com; Sun, 19 Apr 2009 22:43:54 PDT Received: by ewy8 with SMTP id 8so1721402ewy.38 for ; Sun, 19 Apr 2009 22:43:51 -0700 (PDT) Received: by 10.210.68.17 with SMTP id q17mr5416345eba.7.1240206231019; Sun, 19 Apr 2009 22:43:51 -0700 (PDT) Received: from ?80.223.212.7? (dsl-hkibrasgw2-fed4df00-7.dhcp.inet.fi [80.223.212.7]) by mx.google.com with ESMTPS id 24sm1686822eyx.43.2009.04.19.22.43.49 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sun, 19 Apr 2009 22:43:50 -0700 (PDT) Message-ID: <49EC0B94.6070107@enterprisedb.com> Date: Mon, 20 Apr 2009 08:43:48 +0300 From: Heikki Linnakangas Organization: EnterpriseDB User-Agent: Mozilla-Thunderbird 2.0.0.19 (X11/20090103) MIME-Version: 1.0 To: KaiGai Kohei CC: Tom Lane , KaiGai Kohei , pgsql-hackers@postgresql.org Subject: Re: [PATCH] unalias of ACL_SELECT_FOR_UPDATE References: <49E809F6.8070008@ak.jp.nec.com> <49E8133A.7090601@enterprisedb.com> <49E81EA1.2060202@ak.jp.nec.com> <20069.1239977115@sss.pgh.pa.us> <49E91AE4.9020404@kaigai.gr.jp> <49E974AD.3020602@enterprisedb.com> <13982.1240056219@sss.pgh.pa.us> <49E9D5B6.9050406@enterprisedb.com> <49EA7E4D.6060109@kaigai.gr.jp> <49EAD5A6.4010601@enterprisedb.com> <49EADF16.3050400@kaigai.gr.jp> <12899.1240152674@sss.pgh.pa.us> <49EBC588.4090807@ak.jp.nec.com> In-Reply-To: <49EBC588.4090807@ak.jp.nec.com> Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200904/1033 X-Sequence-Number: 137136 KaiGai Kohei wrote: > Tom Lane wrote: >> KaiGai Kohei writes: >>> The vanilla access control mechanism switches the current userid, and it enables >>> to run SELECT FOR SHARE without ACL_UPDATE, but SELinux's security model does not >>> have a concept of ownership. >> Should I not read that as "SELinux's security model is so impoverished >> that it cannot be useful for monitoring SQL behavior"? If you don't >> understand current user and ownership, it's hopeless. Trying to >> distinguish SELECT FOR UPDATE instead of that is a workaround that is >> only going to fix one symptom (if it even works for this, which I doubt). >> There will be many more. > > It is a difference between two security designs, characteristics and > philosophies, not a competitive merit and demerit. > SELinux makes its decision based on the security policy and the security > context of client and objects accessed. Here, user identifier and object > ownership don't appear. > Meanwhile, the vanilla PostgreSQL makes its decision based on the user > identifier and database ACLs of objects accessed. It does not use the > security context, needless to say. Can't you have a SE-PostgreSQL policy like "disallow ACL_UPDATE on table X for user Y, except when current user is owner of X"? -- Heikki Linnakangas EnterpriseDB http://www.enterprisedb.com