| From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
|---|---|
| To: | Magnus Hagander <magnus(at)hagander(dot)net> |
| Cc: | Bruce Momjian <bruce(at)momjian(dot)us>, Stephen Frost <sfrost(at)snowman(dot)net>, Chad Sellers <csellers(at)tresys(dot)com>, "David P(dot) Quigley" <dpquigl(at)tycho(dot)nsa(dot)gov>, Josh Berkus <josh(at)agliodbs(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>, jd <jd(at)commandprompt(dot)com>, David Fetter <david(at)fetter(dot)org>, Itagaki Takahiro <itagaki(dot)takahiro(at)oss(dot)ntt(dot)co(dot)jp>, KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Adding support for SE-Linux security |
| Date: | 2009-12-09 11:49:52 |
| Message-ID: | 603c8f070912090349j7e126805n71de01784554af0d@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Wed, Dec 9, 2009 at 1:44 AM, Magnus Hagander <magnus(at)hagander(dot)net> wrote:
> 2009/12/9 Bruce Momjian <bruce(at)momjian(dot)us>:
>> I frankly think the patch should be thought of as the SE-Linux-specific
>> directory files, which KaiGai can maintain, and the other parts, which I
>> think I can handle.
>
> I think that's a horribly bad idea.
Me, too. The ECPG comparison is apt, except that this code is far
more deeply integrated into core. The idea that the SE-Linux
directory files can be maintained separately from the "other parts"
does not seem realistic to me. The problems that are going to occur
here are things like: somebody wants to rearrange some part of the
permissions checking for some reason. So they move a bunch of code
around and break SE-PostgreSQL. Someone has to review that patch and
understand the danger it causes. That's going to require
understanding both the SE-PostgreSQL-specific files and the other
parts, and the relationship between the two of them.
...Robert
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Robert Haas | 2009-12-09 11:57:10 | Re: EXPLAIN BUFFERS |
| Previous Message | Joachim Wieland | 2009-12-09 10:43:19 | Re: Listen / Notify - what to do when the queue is full |