Re: [PATCH] SE-PgSQL/tiny rev.2193

Joshua Brindle wrote:
> Peter Eisentraut wrote:
>>
>> When it comes to larger features, this development group has a great
>> deal of
>> experience in implementing existing specifications, even relatively
>> terrible
>> ones like SQL or ODBC or Oracle compatibility. But the expected
>> behavior has
>> to be written down somewhere, endorsed by someone with authority. It
>> can't
>> just be someone's idea. Especially for features that are so complex,
>> esoteric, invasive, and critical for security and performance.
>>
>
> Who do you consider has authority? The security community has as many
> opinions as any other. There are papers written on mandatory access
> controls in rdbms's but they are mostly about multi-level security,
> which SELinux has but primarily uses type enforcement. The SELinux
> community are all on board with KaiGai's object model (the object
> classes and permissions and how they are enforced), there has been
> quite a bit of discussion about them over the years. Trusted RUBIX
> integrated SELinux using the object classes that KaiGai made for
> SEPostgres.

Then document those in a reasonably formal sense. I don't think you can
just say that the implementation is the spec. I should have thought that
such a spec would actually appeal to the security community.

>
>> So I think if you want to get anywhere with this, scrap the code, and
>> start
>> writing a specification. One with references. And then let's
>> consider that
>> one.
>>
>
> Harsh.
>

Yeah, it is a bit. But we're being asked to swallow a fairly large lump,
so don't be surprised if we gag a bit.

I haven't followed the entire history of this patch set closely, but we
have over and over again emphasized the importance of getting community
buyin before you start coding a large feature, and this is a *very*
large feature. Reviewing the history briefly, it appears that KaiGai
prepared an initial set of patches before ever approaching the Postgres
community with it about 2 years ago. That is to some extent the source
of the friction, I suspect.

I'm also slightly surprised that some of the government and commercial
players in this space aren't speaking up much. I should have thought
this would generate some interest from players as disparate as RedHat
and the NSA.

cheers

andrew