From: Andrew Dunstan <andrew@dunslane.net>
To: Josh Berkus <josh@agliodbs.com>
Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Treat <xzilla@users.sourceforge.net>
Cc: Garick Hamlin <ghamlin@isc.upenn.edu>
Cc: pgsql-patches@postgresql.org
Subject: Re: [PATCHES] Solaris ident authentication using unix domain sockets
Date: Tue, 08 Jul 2008 13:34:01 -0400
Message-ID: <4873A509.7050202@dunslane.net> (raw)
In-Reply-To: <200807080935.33186.josh@agliodbs.com>
References: <20080703165936.E80B312A5FFF@mx2.hub.org>
<4870001C.6060402@dunslane.net>
<23040.1215319905@sss.pgh.pa.us>
<200807080935.33186.josh@agliodbs.com>
Josh Berkus wrote:
> Tom,
>
>
>> Indeed. If the Solaris folk feel that getupeercred() is insecure,
>> they had better explain why their kernel is that broken. This is
>> entirely unrelated to the known shortcomings of the "ident" IP
>> protocol.
>>
>
> The Solaris security & kernel folks do, actually. However, there's no
> question that TRUST is inherently insecure, and that's what people are going
> to use if they can't get IDENT to work.
>
>
I think I'd pose a slightly different question from Tom. Do the Solaris
devs think that their getupeercred() is more insecure than the more or
less equivalent calls that we are doing on Linux and *BSD for example? I
suspect they probably don't ;-)
cheers
andrew
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-patches@postgresql.org
Cc: andrew@dunslane.net, josh@agliodbs.com, tgl@sss.pgh.pa.us, xzilla@users.sourceforge.net, ghamlin@isc.upenn.edu
Subject: Re: [PATCHES] Solaris ident authentication using unix domain sockets
In-Reply-To: <4873A509.7050202@dunslane.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox