From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
---|---|
To: | Yuli Khodorkovskiy <yuli(dot)khodorkovskiy(at)crunchydata(dot)com> |
Cc: | Stephen Frost <sfrost(at)snowman(dot)net>, Kohei KaiGai <kaigai(at)heterodb(dot)com>, pgsql-hackers(at)lists(dot)postgresql(dot)org |
Subject: | Re: add a MAC check for TRUNCATE |
Date: | 2019-09-06 15:47:35 |
Message-ID: | 20576.1567784855@sss.pgh.pa.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Yuli Khodorkovskiy <yuli(dot)khodorkovskiy(at)crunchydata(dot)com> writes:
> Ah, now I remember why I didn't add regressions to the original patch.
> As stated at the top of the thread, the "db_table: { truncate }"
> permission does not currently exist in refpolicy. A workaround would
> be to add the policy with CIL, but that adds unneeded complexity to
> the regressions. I think the correct path forward is:
> 1) Get the sepgsql changes in without policy/regressions
> 2) Send a patch to refpolicy for the new permission
> 3) Once Redhat updates the selinux-policy-targeted RPM to include the
> new permissions, I will send an update to the sepgsql regressions and
> policy.
That's going to be a problem. I do not think it will be acceptable
to commit tests that fail on less-than-bleeding-edge SELinux.
regards, tom lane
From | Date | Subject | |
---|---|---|---|
Next Message | Stephen Frost | 2019-09-06 15:50:04 | Re: add a MAC check for TRUNCATE |
Previous Message | Yuli Khodorkovskiy | 2019-09-06 15:40:48 | Re: add a MAC check for TRUNCATE |