Re: security labels on databases are bad for dump & restore

From: Ted Toth <txtoth(at)gmail(dot)com>
To: Kohei KaiGai <kaigai(at)kaigai(dot)gr(dot)jp>
Cc: Robert Haas <robertmhaas(at)gmail(dot)com>, Adam Brightwell <adam(dot)brightwell(at)crunchydatasolutions(dot)com>, Andres Freund <andres(at)anarazel(dot)de>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>, Alvaro Herrera <alvherre(at)2ndquadrant(dot)com>
Subject: Re: security labels on databases are bad for dump & restore
Date: 2015-07-14 17:59:19
Message-ID: CAFPpqQEKZpVc==ftD6hse6i8UQj4Bk=X3tcfa88auWWhxm2mVA@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

So if I label a table with an SELinux context and the type of my
client connection does not have policy to be able to access the table
type will an AVC be generated and the access denied?

Ted

On Tue, Jul 14, 2015 at 12:53 PM, Kohei KaiGai <kaigai(at)kaigai(dot)gr(dot)jp> wrote:
> 2015-07-15 2:39 GMT+09:00 Ted Toth <txtoth(at)gmail(dot)com>:
>> That's exactly what I'm talking about like I said KaiGais branch was
>> never merged into the mainline so I do not believe that it is used at
>> all.
>>
> It depends on the definition of "integrated".
> The PostgreSQL core offers an infrastructure for label based security
> mechanism, not only selinux. Also, one extension module that is
> usually distributed with PosgreSQL bridges the world of database and
> the world of selinux (even though all the features I initially designed
> are not yet implemented). I like to say it is integrated.
>
>> On Tue, Jul 14, 2015 at 12:28 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
>>> On Tue, Jul 14, 2015 at 1:22 PM, Ted Toth <txtoth(at)gmail(dot)com> wrote:
>>>> I'm sort of new to this so maybe I'm missing something but since the
>>>> sepgsql SELinux userspace object manager was never integrated into
>>>> postgresql (AFAIK KaiGais branch was never merged into the mainline)
>>>> who uses these labels? What use are they?
>>>
>>> See contrib/sepgsql
>>>
>>> --
>>> Robert Haas
>>> EnterpriseDB: http://www.enterprisedb.com
>>> The Enterprise PostgreSQL Company
>
>
>
> --
> KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Sawada Masahiko 2015-07-14 18:07:50 Re: Freeze avoidance of very large table.
Previous Message Jeff Janes 2015-07-14 17:55:06 Re: Selectivity estimation for intarray with @@