db_schema object class (and others)

db_schema object class (and others)

[Andy Warner]

[-- Attachment #1: Type: text/plain, Size: 314 bytes --]


Back in March of 2009 there was discussion regarding adding new database 
object classes (e.g., db_schema) to policy. I have been keeping my eye 
open for them but have not seen them. Can anyone give me a status of 
this? If it has not be implemented, is there still interest if some 
picks it up?

Thanks,

Andy

[-- Attachment #2: Type: text/html, Size: 577 bytes --]

Re: db_schema object class (and others)

[KaiGai Kohei]

(2010/03/09 9:11), Andy Warner wrote:
> Back in March of 2009 there was discussion regarding adding new database 
> object classes (e.g., db_schema) to policy. I have been keeping my eye 
> open for them but have not seen them. Can anyone give me a status of 
> this? If it has not be implemented, is there still interest if some 
> picks it up?

Right now, we are waiting for SELinux feature to be gotten upstreamed to
PostgreSQL, because here is a risk that we are forced to change definition
of the object class and permissions. :(

I also think the following object classes are necessary:
 - db_catalog (specific to rubix, it is a layer between database and schema)
 - db_schema
 - db_sequence
 - db_view

Currently, I'm reworking existing access control stuff in PostgreSQL
for the upcoming v9.1 development cycle, because it does not have clear
interface between the core and security server like LSM, so the patch
had been too large to merge at one for two years.

Thanks,
-- 
KaiGai Kohei <kaigai@ak.jp.nec.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.