Message-ID: <52237D5A.9050209@2ndQuadrant.com>
Date: Sun, 01 Sep 2013 13:46:02 -0400
From: Greg Smith <greg@2ndQuadrant.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8;
 rv:17.0) Gecko/20130801 Thunderbird/17.0.8
MIME-Version: 1.0
To: Heikki Linnakangas <hlinnakangas@vmware.com>
CC: Josh Berkus <josh@agliodbs.com>, Tom Lane <tgl@sss.pgh.pa.us>,
 Stephen Frost <sfrost@snowman.net>,
 Kohei KaiGai <kaigai@kaigai.gr.jp>, "ktm@rice.edu" <ktm@rice.edu>,
 Alexander Korotkov <aekorotkov@gmail.com>,
 Oleg Bartunov <obartunov@gmail.com>,
 PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.4] row level security
References: 
 <CADyhKSWkHrPqbRsFK0LjPMOOTsbKGWOuN75GqYJrxCDO3CKWtA@mail.gmail.com>
 <CAPpHfdsgMrBnzu9um48O6kwY=_pRFuRrBrHqnA03fCAo8x3-Gg@mail.gmail.com>
 <CADyhKSUpcYKNm3rQRwCFqkTZfO3_ZrqYKjAqDxKeA6WeLezSbw@mail.gmail.com>
 <20130829142321.GA30496@aart.rice.edu>
 <CADyhKSUD7qdQeTndZ6mDpp05V6MnRBzQO1FmYBq1+Zp37oyRrg@mail.gmail.com>
 <WM!685df689dd4d8f8c5349d5ef7b8e285db1e99ea32d22ab5d35f3981c29eac19dbd725c9b5e0227def9d782de274d1354!@asav-3.01.com>
 <521F7DFB.8060602@agliodbs.com>
 <CADyhKSW_o2nVWFytdTY84DUXZSuZkD_EtY2d8wAjR18UruOXYQ@mail.gmail.com>
 <WM!fb94ecb91cd381e69d8e4773d3810f48e4e0ef000525cc806c4ee509f215ce1a39c8c2a1c3ffde72ba2ddb1a07ebcdc9!@asav-2.01.com>
 <5220D832.7090104@agliodbs.com> <20130830192729.GO2706@tamriel.snowman.net>
 <16798.1377891794@sss.pgh.pa.us>
 <WM!20618a88b943d2d51dde90beb5cb85eea4bacc1ee65b4bb73872fafa086f76aee8b9caf4e1c1a7e5865845cf76661b1b!@asav-3.01.com>
 <5220F928.7040503@agliodbs.com> <5223436B.1070406@vmware.com>
In-Reply-To: <5223436B.1070406@vmware.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 9/1/13 9:38 AM, Heikki Linnakangas wrote:
> To phrase it differently: We already have RLS. It's shipped as an
> extension called Veil. Now please explain what's wrong with that
> statement, if anything.

Veil was last updated for 9.1 to work against that version, so the first 
thing is that it's two versions back from being current.

The main improvement for a few now core features, compared to their 
external/extension predecessors, is that they go through a real review 
process.  I suspect a lot of the criticisms being lobbied against the 
core RLS feature would also hit Veil if it were evaluated to the same 
standard.

Regardless, I'm seeing a few review themes pop up from this thread:

-Comparison against the Veil feature set.
-Competitive review against industry expectations, AKA "checkbox" 
compliance.
-Confirm feature set is useful to government security clearance 
applications and multi-tenant applications.  There's also a secured web 
application use case that's popped up a few times too; KaiGai has used 
secured Apache installs for example.
-Summary of known covert channels, with documentation coverage.
-Assess odds of this implementation's future issues turning into 
security bugs.  My personal hotspot here is that I'd like minimal code 
exposure to people who don't use this feature at all.  Are there parts 
here that should be compile time enabled?

Of course those are all on top of the usual code quality review.  Did I 
miss any big themes on that list?

-- 
Greg Smith   2ndQuadrant US    greg@2ndQuadrant.com   Baltimore, MD
PostgreSQL Training, Services, and 24x7 Support www.2ndQuadrant.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers