Re: [RFC] SELinux and PostgreSQL

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Because the SMTP server of my office was not allowed to deliver
SELinux-list, I posted it again from my house.
I'm sorry if you received same message twice.

> Hi,
> > 	First question, how will this interact with the current "privileges"
> > mechanism in PostgreSQL (GRANT and REVOKE commands)?

It's similar to the relationship between DAC and MAC on filesystem.
The mechanism I'm suggesting works purely an additional access control.
Thus any users's operations must be granted on PostgreSQL ACL and allowed
on SELinux security policy.

> > Second, will there be a "user space security server" or will these
> > object classes be included in the kernel policy?

The meaning is a bit unclear for me.
I intend to implement some libselinux functions into PostgreSQL
to enhance security functionality, and those functions referes
the kernel policy which will contain some new object classes.
Is is appropriate for the answer?

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.