Received: from localhost (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id 3D07D633153 for ; Mon, 20 Apr 2009 12:36:51 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 07873-03 for ; Mon, 20 Apr 2009 12:36:48 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from exprod7og106.obsmtp.com (exprod7og106.obsmtp.com [64.18.2.165]) by mail.postgresql.org (Postfix) with SMTP id E57CC632268 for ; Mon, 20 Apr 2009 12:36:45 -0300 (ADT) Received: from source ([72.14.220.153]) by exprod7ob106.postini.com ([64.18.6.12]) with SMTP ID DSNKSeyWjGFtO2nrY4d0FrJ5637F4O//bIDl@postini.com; Mon, 20 Apr 2009 08:36:46 PDT Received: by fg-out-1718.google.com with SMTP id l26so255621fgb.13 for ; Mon, 20 Apr 2009 08:36:43 -0700 (PDT) Received: by 10.86.61.13 with SMTP id j13mr4042261fga.65.1240241803586; Mon, 20 Apr 2009 08:36:43 -0700 (PDT) Received: from oxford.xeocode.com.enterprisedb.com ([82.16.16.210]) by mx.google.com with ESMTPS id d6sm2557575fga.28.2009.04.20.08.36.42 (version=TLSv1/SSLv3 cipher=RC4-MD5); Mon, 20 Apr 2009 08:36:43 -0700 (PDT) To: Tom Lane Cc: KaiGai Kohei , Heikki Linnakangas , KaiGai Kohei , pgsql-hackers@postgresql.org Subject: Re: [PATCH] unalias of ACL_SELECT_FOR_UPDATE In-Reply-To: <6167.1240239593@sss.pgh.pa.us> (Tom Lane's message of "Mon\, 20 Apr 2009 10\:59\:53 -0400") User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.1 (gnu/linux) X-Draft-From: ("nnimap+imap.gmail.com:HACKERS" 59593) References: <49E809F6.8070008@ak.jp.nec.com> <49E9D5B6.9050406@enterprisedb.com> <49EA7E4D.6060109@kaigai.gr.jp> <49EAD5A6.4010601@enterprisedb.com> <49EADF16.3050400@kaigai.gr.jp> <12899.1240152674@sss.pgh.pa.us> <49EBC588.4090807@ak.jp.nec.com> <49EC0B94.6070107@enterprisedb.com> <49EC198F.6090604@ak.jp.nec.com> <5233.1240236841@sss.pgh.pa.us> <4136ffa0904200748k67a6058bue08c233a745317bc@mail.gmail.com> <6167.1240239593@sss.pgh.pa.us> From: Gregory Stark Organization: EnterpriseDB Date: Mon, 20 Apr 2009 16:36:49 +0100 Message-ID: <87myab49ri.fsf@oxford.xeocode.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200904/1045 X-Sequence-Number: 137148 Tom Lane writes: > Greg Stark writes: >> I think we're talking at cross purposes here. I think Kai Gai's >> descriptions make sense if you start with a different set of >> assumptions. The idea behind SELinux is that each individual object is >> access controlled and each user has credentials which grant access to >> specific operations on specific objects. As I understand it part of >> the goal is to eliminate situations where "setuid" or other forms of >> privilege escalation is required. > > Well, if so, the idea is a miserable failure. SELinux has just as many > setuid programs as any other Unix, and absolutely zero hope of removing > them. I am not going to take the idea of "remove setuid" seriously when > they haven't been able to accomplish it anywhere else. But can you remove privileges from users to make these programs ineffective? So even if you obtain root privileges you're missing the SE privilege which the program expects to use? -- Gregory Stark EnterpriseDB http://www.enterprisedb.com Ask me about EnterpriseDB's 24x7 Postgres support!