Skip site navigation (1) Skip section navigation (2)

Re: 8.4 release planning

From: "Jonah H(dot) Harris" <jonah(dot)harris(at)gmail(dot)com>
To: Peter Eisentraut <peter_e(at)gmx(dot)net>
Cc: Greg Smith <gsmith(at)gregsmith(dot)com>, Chad Sellers <csellers(at)tresys(dot)com>, Ron Mayer <rm_pg(at)cheapcomplexdevices(dot)com>, Joshua Brindle <method(at)manicmethod(dot)com>, Devrim GÜNDÜZ <devrim(at)gunduz(dot)org>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Stephen Frost <sfrost(at)snowman(dot)net>, Gregory Stark <stark(at)enterprisedb(dot)com>, Robert Haas <robertmhaas(at)gmail(dot)com>, Simon Riggs <simon(at)2ndquadrant(dot)com>, Josh Berkus <josh(at)agliodbs(dot)com>, "Joshua D(dot) Drake" <jd(at)commandprompt(dot)com>, Merlin Moncure <mmoncure(at)gmail(dot)com>, Bruce Momjian <bruce(at)momjian(dot)us>, Bernd Helmle <mailings(at)oopsware(dot)de>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: 8.4 release planning
Date: 2009-01-28 13:41:35
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-hackers
On Wed, Jan 28, 2009 at 4:28 AM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:

> Greg Smith wrote:
>> PostgreSQL advocacy point, one of the questions Tom asked about a bit
>> upthread is still a bit hazy here.  There are commercial database offerings
>> selling into the "trusted" space already.  While the use-cases you describe
>> make perfect sense, I don't think it's clear to everyone yet if there's a
>> unique draw to a PostgreSQL + selinux solution that the class of customers
>> you're talking about would prefer it to purchasing one of those products.
>>  Is the cost savings the main driver here, or is there something else about
>> a secure LAPP stack that makes it particularly compelling?
> According to the data available to me, it is a combination of doing it
> better than the other guys (e.g., a SELinux type interface instead of
> something handcrafted) and the usual cost savings.

I don't know about better, but I would definitely say that it's a more
integrated (with the OS) solution.  Can you get Oracle to use SELinux
policies?  Sure.  But it would take a combination of Label Security, Fine
Grained Access Control tweaks, custom C functions, and custom policies to
handle the access control.  And, it would cost a helluva lot of money.

In short, this would make Postgres quite a bit more appetizing to those who
need this functionality, those who prefer SELinux-based policies, and those
who don't have the time/money to do it in systems like Oracle.  How many
people is that?  Based on my consulting experience and questions from
DoD/DoE people specifically, I think the number of people needing this
feature is fairly small right now.  But, it wouldn't hurt us to have it.

Just to make it clear, this feature wouldn't make Postgres a "trusted"
database in any certification sense.  So, using that term would likely cause
confusion and get people who used it thinking it had an EAL certification
into trouble.

Jonah H. Harris, Senior DBA

In response to

pgsql-hackers by date

Next:From: Magnus HaganderDate: 2009-01-28 13:55:56
Subject: Re: 8.4 release planning
Previous:From: KaiGai KoheiDate: 2009-01-28 13:28:11
Subject: Re: How to get SE-PostgreSQL acceptable

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group