Re: [ANN] SE-PostgreSQL 8.2.3-1.0 alpha release

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Stephen Smalley wrote:
> On Thu, 2007-03-08 at 22:33 +0900, KaiGai Kohei wrote:
>> Christopher J. PeBenito wrote:
>>> On Mon, 2007-03-05 at 23:41 +0900, KaiGai Kohei wrote:
>>>> The attached patch adds new object classes, access vectors and
>>>> booleans related to database.
>>>> SE-PostgreSQL uses them to manage the various kinds of database
>>>> objects such as tables, columns, tuples and so on.
>>>>
>>>> The most of security policies are provided as a binary security
>>>> policy within RPM package. But it requires the definition of new
>>>> object classes, access vectors and booleans in the base policy.
>>>>
>>>> Please apply it.
>>> Is the code on a path to being merged upstream?  I'm hesitant to apply
>>> class changes until the code is on a plan to be merged.
>> Pushing to the upstreamed PostgreSQL is one of the next activities.
>> No need to say, I'm targeting it to be merged as a part of PostgreSQL.
>>
>> I'll submit a patch to add new object classes again after discussion
>> in the pgsql-hackers list. But I'm desiring the object class numbers
>> are fixed earlier. (currently, I uses 60 - 65 to represent them)
> 
> Where do things stand wrt dynamic userspace object class and permission
> discovery?  It would be nice to avoid further spread of hardcoded
> classes and permissions in applications if we can avoid it.

See, http://sepgsql.googlecode.com/svn/trunk/src/include/security/sepgsql_internal.h
When I started to develop, 'context' class has the maximum number of object
class, so I defined 'SECCLASS_DATABASE' next to it.
# But it will conflict with 'dccp_socket' class now... :-(

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.