Message-ID: <551C3257.4000305@pgmasters.net>
Date: Wed, 01 Apr 2015 14:00:55 -0400
From: David Steele <david@pgmasters.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: Abhijit Menon-Sen <ams@2ndQuadrant.com>
CC: Stephen Frost <sfrost@snowman.net>, =?UTF-8?B?w4FsdmFybyBIZXJyZXJh?=
 <alvherre@2ndquadrant.com>, Fujii Masao <masao.fujii@gmail.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: Auditing extension for PostgreSQL (Take 2)
References: <54E005CC.1060605@pgmasters.net>
 <20150217153402.GQ6717@tamriel.snowman.net> <54EB4E56.7050102@pgmasters.net>
 <54ECA551.8060306@pgmasters.net> <20150323053146.GA1919@toroid.org>
 <55104204.80008@pgmasters.net>
In-Reply-To: <55104204.80008@pgmasters.net>
OpenPGP: id=2624538721DAF9D5FDF4952A9FCDF424A2739CF3
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="rl7In8h2eJMiVt65MPAiOfVMs9A3f68sA"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--rl7In8h2eJMiVt65MPAiOfVMs9A3f68sA
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 3/23/15 12:40 PM, David Steele wrote:
> On 3/23/15 1:31 AM, Abhijit Menon-Sen wrote:
>> I'm experimenting with a few approaches to do this without reintroduci=
ng
>> switch statements to test every command. That will require core change=
s,
>> but I think we can find an acceptable arrangement. I'll post a proof o=
f
>> concept in a few days.

Any progress on the POC?  I'm interested in trying to get the ROLE class
back in before the Commitfest winds up, but not very happy with my
current string-matching options.

>>> + * Takes an AuditEvent and, if it log_check(), writes it to the audi=
t
>>> log.
>>
>> I don't think log_check is the most useful name, because this sentence=

>> doesn't tell me what the function may do. Similarly, I would prefer to=

>> have log_acl_check be renamed acl_grants_audit or similar. (These are
>> all static functions anyway, I don't think a log_ prefix is needed.)
>=20
> log_check() has become somewhat vestigial at this point since it is onl=
y
> called from one place - I've been considering removing it and merging
> into log_audit_event().  For the moment I've improved the comments.

log_check() got rolled into log_audit_event().

> I like acl_grants_audit() and agree that it's a clearer name.  I'll
> incorporate that into the next version and apply the same scheme to the=

> other ACL functionsas well as do a general review of naming.

I ended up going with audit_on_acl, audit_on_relation, etc. and reworked
some of the other function names.

I attached the v6 patch to my previous email, or you can find it on the
CF page.

--=20
- David Steele
david@pgmasters.net


--rl7In8h2eJMiVt65MPAiOfVMs9A3f68sA
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVHDJXAAoJEIA2uIJQ5SFAYDsQAJSbECmcRachsbelxgwOd1pO
NFD9t+/8CaRshM/RAhyu6/XW5LOc0xphBlTx6s7e9v9dA3luhoMyHu2L6gJXRrHF
TUk3LoLWNnHkJizGttIL0No/0daFArjACqEhNFcreJWDOD0mivkeP6JAxgSkvgTB
+vQhknixKN3bzgQ1r+7vjVHRTg0wjo0imTtE+9XygobGUIHJfZKrA06HACMtd0qi
wnM6or6Dn7460cYCgrAuzAfjhzH0nnf84ptBpwxlX9ztEj7WIlqyjKz8TXcb2Ym9
SGQaqViqjACh9rtRq8/o3t5i97deyJcKDGNBD8egsKhnRehlK8v41wDUFB3AGbib
Fcu+n0PJPg8y2IxIpGDOREd1t7/iepB+PZEbfWz1IOY1XDLfg2oYZc4PwHVQ4PuF
YaDZxk8dJzRVse/48T+NnSgR55/2AqhpdEeUBMHmsRuxoUHXwD+Pmpw7QG8wH3ru
LRPmfVbjnYYO8wWK2hlxnetIC01EkfjlU50dcMzO1KIcvT/8x0o5e7QIT4RBAdG6
hIT2WCRpoHT2X11AEO9tJ05i64reqLlz3tENlJNeD7uFDkX27JVW9eqjehgODBdh
kydTfFCiekv6yaW7oBlwtwj3UP1QZHHEZXV+9Xt7ANhSDKPu7V4whBFrTVSekaT7
z20kKSMLK+ZutnRvE5No
=0kS8
-----END PGP SIGNATURE-----

--rl7In8h2eJMiVt65MPAiOfVMs9A3f68sA--