Re: [ANN] SE-PostgreSQL 8.2.3-1.0 alpha release

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Stephen Smalley wrote:
> Ok, you'll need to figure out the optimal approach there, as you need
> low runtime overhead for the actual permission checks.  They would be
> changing from having the form:
> 	rc = avc_has_perm(ssid, tsid, SECCLASS_DATABASE,
> DATABASE__ACCESS, ...);
> to having a form like:
> 	rc = pgres_has_perm(ssid, tsid, PGRES_DATABASE_ACCESS, ...);
> where pgres_has_perm() could do something like:
> 	rc = index2policy(PGRES_DATABASE_ACCESS, &tclass, &perms);
> 	if (rc) return rc;
> 	rc = avc_has_perm(ssid, tsid, tclass, perms, ...);
> 
> So you'd have a postgres-private index value for each distinct
> permission check it performs, mapped to a (class, perms) pair by the
> index2policy() function, using a lookup table generated once during
> startup from the string names using the libselinux functions (and
> revalidated upon policy reload notification).

If having an index2policy table is going to be a common usage model for 
userspace object managers then perhaps support for it should be included 
in libselinux.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.