Re: [refpolicy] [RFC] Security policy reworks for SE-PostgreSQL

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Joshua Brindle wrote:
>> Again, I would like to get the reworks merged in this timing.
>> (In addition, it also makes RUBIX happy on Fedora 11 or later.)
>>
> 
> Fedora 11 is already frozen, new object classes shouldn't be working their way
> in to that, so we have a release cycle to adjust the permissions to match the
> implementation, both on the upstream sepostgres side and the RUBIX side before
> pushing those in to refpolicy.

Hmm... It would seem that I need to provide a development purpose
security policy package in the meanwhile.

The next development cycle in PostgreSQL will be open soon:
  http://wiki.postgresql.org/wiki/CommitFest_2009-First

I'll propose the newer design for the commit fest, but also continue
to maintain the current design on Fedora as far as the security policy
keeps existing object classes and permissions.

I believe the current design should be switched to the newer one
at some point in the future. In my hope, it should be done on
Fedora 12.

> Once some implementation starts and the security model settles it may be a
> different story, I just don't think it is appropriate to merge them at this
> point. (In particular I want to see if the new proposed object classes and perms
> will really work for RUBIX, and I want to see how much of the patch the upstream
> postgres project will take for the next release).

I also would like Andy to report whether the RUBIX with newer design and
security policy performs well, or not.
The development purpose security policy which contains newer object classes
and permissions will be available soon.

> As it stands we are going to have 3 selinux aware databases floating around
> using slightly different object classes and permissions, which is not ideal.

Agreed.

> Having all those in upstream refpolicy means it is harder to change them and the
> unused permissions are going to sit there causing confusion (even worse, they'll
> be unused by 2 of the 3 systems but still in use by the previous version of
> sepostgres).

I think the current design should be deprecated in the lifespan of distribution
if the upstream refpolicy once gets newer design.
In finally, I believe only 2 of the system can share the design.

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.