(2010/12/30 9:34), Simon Riggs wrote:
> On Thu, 2010-12-30 at 09:26 +0900, KaiGai Kohei wrote:
>>> What happens if someone alters the configuration so that the sepgsql
>>> plugin is no longer installed. Does the hidden data become visible?
>> Yes. If sepgsql plugin is uninstalled, the hidden data become visible.
>> But no matter. Since only a person who is allowed to edit postgresql.conf
>> can uninstall it, we cannot uninstall it in run-time.
>> (An exception is loading a malicious module, but we will be able to
>> hook this operation in the future version.)
> IMHO all security labels should be invisible if the provider is not
> installed correctly.
Probably, it needs row-level granularity to control visibility of
each entries of pg_seclabel, because all the provider shares same
So, I don't think this mechanism is feasible right now.
> That at least prevents us from accidentally de-installing a module and
> having top secret data be widely available.
> If you have multiple providers configured, you need to be careful not to
> allow a provider that incorrectly implements the plugin API, so that
> prior plugins are no longer effective.
Yep. It is responsibility of DBA who tries to set up security providers.
DBA has to install only trustable or well-debugged modules (not limited
to security providers) to avoid troubles.
KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>
In response to
pgsql-hackers by date
|Next:||From: Jie Li||Date: 2010-12-30 01:54:10|
|Subject: Re: small table left outer join big table|
|Previous:||From: Simon Riggs||Date: 2010-12-30 00:34:36|
|Subject: Re: sepgsql contrib module|