Re: [ANN] SE-PostgreSQL 8.2.3-1.0 alpha release

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Stephen Smalley wrote:
> On Thu, 2007-03-08 at 22:12 +0900, KaiGai Kohei wrote:
>> Joshua Brindle wrote:
>>> Casey Schaufler wrote:
>>>> --- KaiGai Kohei <kaigai@kaigai.gr.jp> wrote:
>>>>
>>>>  
>>>>  
>>>>> I think unique identification for all tuples are
>>>>> difficult, because we can
>>>>> create a table without Oid (object id) or primary
>>>>> key to identify a tuple
>>>>> from outside of the table...
>>>>>
>>>>> BTW, the string representations of security contexts
>>>>> are stored in a separate
>>>>> table named as 'pg_selinux', defined with Oid (which
>>>>> have 4-byte length).
>>>>> In SE-PostgreSQL, any tuples have Oid of pg_selinux
>>>>> as a security context.
>>>>> Thus, storage consumption is limited.
>>>>>     
>>>> How does this method compare to the schemes
>>>> used in the Oracle evaluated MLS DBMS?
>>>>
>>>>   
>>> IIRC Oracle basically has polyinstanciated tables (using views) to 
>>> implement MLS, which gives far less granularity and doesn't allow for 
>>> labeled rows or columns. KaiGai's work leverages all the security models 
>>> SELinux can use to allow for flexible policies. The technical decision 
>>> to use another table to store the oid of the context seems appropriate, 
>>> since that is how rdbms's operate in general.
>> I think the biggest difference is whether RDBMS utilizes the security
>> functionalities of operating system, or not.
>>
>> For example, SE-PostgreSQL obtains the security context of the client via
>> getpeercon(), and makes a decision with the security policy.
>> It enables to ensure a process with lower clearance cannot access secret
>> data, even if it is stored in database.
> 
> You also should be leveraging the OS in protecting SE-PostgreSQL from
> interference by the client and ensuring that it is unbypassable for
> accessing the database.  Are you just using the stock postgresql domain
> in the refpolicy at present?  Any analysis of that domain and whether it
> meets your needs adequately?  (side bar:  it seems to have a lot of
> capabilities presently)

The security policy included in sepostgresql rpm package uses stock
postgresql_t domin in the refpolicy, almost as is.

I have not analyzed them yet.
Indeed, we should pay more attention for accessing the database
files directly.

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.