From: KaiGai Kohei <kaigai@kaigai.gr.jp>
To: Greg Stark <gsstark@mit.edu>
Cc: KaiGai Kohei <kaigai@ak.jp.nec.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: robertmhaas@gmail.com
Cc: pgsql-hackers@postgresql.org
Subject: Re: Reworks for Access Control facilities (r2363)
Date: Sat, 17 Oct 2009 13:37:34 +0900
Message-ID: <4AD94A0E.4010408@kaigai.gr.jp> (raw)
In-Reply-To: <407d949e0910160945x6bb99198xb3c23b9554669361@mail.gmail.com>
References: <4AC5A14F.6050306@ak.jp.nec.com>
<20091012024604.GW17756@tamriel.snowman.net>
<4AD54082.9050001@ak.jp.nec.com>
<10495.1255627322@sss.pgh.pa.us>
<4AD7CCDD.1070402@ak.jp.nec.com>
<407d949e0910160945x6bb99198xb3c23b9554669361@mail.gmail.com>
Greg Stark wrote:
> 2009/10/16 KaiGai Kohei <kaigai@ak.jp.nec.com>:
>> . In addition, I already tried to put SE-PG hooks
>> within pg_xxx_aclchecks() in this CF, but it was failed due to the
>> differences in the security models.
>
> I thought the last discussion ended with a pretty strong conclusion
> that we didn't want differences in the security models.
It is not a fact. Because the SE-PG patch is a bit large to review,
I got a suggestion to implement a part of permissions checks which
can be invoked from the pg_xxx_aclcheck() without any breaks for
SELinux's security model, at the first step.
In other word, I tried to implement only union part of the security
models.
> The first step is to add hooks which don't change the security model
> at all, just allow people to control the existing checks from their SE
> configuration. Only as a second step we would look into making
> incremental changes to the postgres security model to add support for
> privileges SE users might expect to find, eventually possibly
> including per-row permissions.
I already did it on the first CF...
However, most of permission checks had gone at the first step.
It was commented it is same as checks nothing.
Thanks,
--
KaiGai Kohei <kaigai@kaigai.gr.jp>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: kaigai@kaigai.gr.jp, gsstark@mit.edu, kaigai@ak.jp.nec.com, tgl@sss.pgh.pa.us, sfrost@snowman.net, robertmhaas@gmail.com
Subject: Re: Reworks for Access Control facilities (r2363)
In-Reply-To: <4AD94A0E.4010408@kaigai.gr.jp>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox