Re: [RFC] Security label support

Stephen Frost <sfrost(at)snowman(dot)net> writes:
> * Tom Lane (tgl(at)sss(dot)pgh(dot)pa(dot)us) wrote:
>> I'm not real sure that you want a dependency for a security label anyway
>> --- wouldn't that mean each label could only be used for one object?

> Err, your question comes across to me like "if you added comments to
> pg_depend, you'd only be able to use a given comment X for one object?".
> Doesn't make alot of sense. :)

Well, one of us is confused. I thought the idea was that the same
security label would apply to many different objects. If each object
has its own label, you're going to need an awfully large label cache
for performance to be sane.

> The structure for pg_seclabel we were talking about would be very
> similar to pg_description, eg:

> CREATE TABLE pg_seclabel (
> objoid oid not null,
> classoid oid not null,
> objsubid integer not null,
> label text
> );

> We could move label into another table (eg: pg_labels) and then give an
> OID to each label and then store the label's OID in pg_seclabel.

OK, but the notion that you would try to remove "orphan" pg_labels
entries seems entirely wrongheaded to me. The labels would be
long-lived objects.

regards, tom lane