Re: How to get SE-PostgreSQL acceptable

From: Robert Haas <robertmhaas(at)gmail(dot)com>
To: KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Joshua Brindle <method(at)manicmethod(dot)com>, Ron Mayer <rm_pg(at)cheapcomplexdevices(dot)com>, Stephen Frost <sfrost(at)snowman(dot)net>, KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>, Peter Eisentraut <peter_e(at)gmx(dot)net>, PG Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: How to get SE-PostgreSQL acceptable
Date: 2009-01-29 03:52:43
Message-ID: 603c8f070901281952h6b1d842erc045dae203ad1e80@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Wed, Jan 28, 2009 at 10:15 PM, KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com> wrote:
> It seems to me reference-counter is more preferable than boolean,
> at least. But it makes performance pain on writer access when it
> is expanded to row-level security.

A reference counter will never work. You could easily end up
serializing all access to the database around the row-level lock on
one popular security context. That is a performance problem two or
three orders of magnitude worse than anything that has been suggested
so far in connection with this feature, and probably six orders of
magnitude worse than the problem you're trying to solve (pg_security,
or whatever we want to call it, getting too big).

For the record, I think Tom's concern in this area is largely
off-base, especially in light of the fact that Joshua Brindle and
Kaigai both agree that churn is not likely to be large. I think we
need some kind of plausible way to clean out the table, but I don't
think it needs to be fully automated or super-efficient, just
something that someone could do if they felt the need.

...Robert

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Stephen Frost 2009-01-29 04:07:04 Re: Column-Level Privileges
Previous Message Andrew Dunstan 2009-01-29 03:44:54 Re: 8.4 release planning