Re: [RFC] SELinux and PostgreSQL (draft v2)

[Joshua Brindle <method@gentoo.org>]

Richard Hally wrote:
> KaiGai Kohei wrote:
>   
>> In recent days, I'm making a plan to enhance PostgreSQL with SELinux.
>> I posted the first draft of this plan a few days ago, and I got many
>> response. Thanks for your comments so much.
>> (Especially, Joshua and Russell)
>>
>> The followings are the revised and summarized plan (draft v2).
>> I'm welcoming any comments to improve the project.
>>
>>     
>
> Please help me understand why this addition is needed.
> Would it be more appropriate to extend the existing roles and privileges
> mechanism that already exists in PostgreSQL rather than adding all this
> additional burden to the kernel object classes and access vector cache?
> I can understand the need to extend access control the columns and rows
> but most of the higher level controls already exist.
>
> Thank you for your help,
> Richard Hally
>
>   
It extends a proven MAC system to the database and allows us to have
centralized policies and use the already existing process labels. It
also allows the flexibility of SELinux (both mechanism and policy) to be
applied to the database without modifying the database server down the
line.

You can do privilege separation in the database system via process
labels instead of only by dbms role. This is analogous to using fine
grained types to break up root privileges.

Also, at some point (hopefully soon) we should be moving userspace
object class decision making to a userspace security server that can
provide answers to userspace object managers without the policy being in
unswappable kernel memory.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.