Skip site navigation (1) Skip section navigation (2)

Re: How to get SE-PostgreSQL acceptable

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Gregory Stark <stark(at)enterprisedb(dot)com>, Joshua Brindle <method(at)manicmethod(dot)com>, KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>, Stephen Frost <sfrost(at)snowman(dot)net>, Peter Eisentraut <peter_e(at)gmx(dot)net>, KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>, PG Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: How to get SE-PostgreSQL acceptable
Date: 2009-01-29 05:03:18
Message-ID: 200901290503.n0T53Ip24938@momjian.us (view raw or flat)
Thread:
Lists: pgsql-hackers
Tom Lane wrote:
> Gregory Stark <stark(at)enterprisedb(dot)com> writes:
> > I don't think partitioning is really the same thing as row-level
> > security.
> 
> Of course not, but it seems to me that it can be used to accomplish most
> of the same practical use-cases.  The main gripe about doing it via
> partitioning is that the user's nose gets rubbed in the fact that there
> can't be an enormous number of different security classifications in the
> same table (since he has to explicitly make a partition for each one).
> But the proposed implementation of row-level security would poop out
> pretty darn quick for such a case, too, and frankly I'm not seeing an
> application that would demand it.

OK, putting on my crazy idea hat, if we split the primary and foreign
keys by partition, it would give us polyinstantiation:

	http://en.wikipedia.org/wiki/Polyinstantiation

because our unique indexes do not apply across partitions. 
Polyinstantiation is a desirable security feature and one that would be
tough to implement without partitions.

-- 
  Bruce Momjian  <bruce(at)momjian(dot)us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + If your life is a hard drive, Christ can be your backup. +

In response to

Responses

pgsql-hackers by date

Next:From: Bruce MomjianDate: 2009-01-29 05:19:30
Subject: Re: How to get SE-PostgreSQL acceptable
Previous:From: Robert HaasDate: 2009-01-29 04:42:11
Subject: Re: 8.4 release planning

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group