Re: Adding support for SE-Linux security

On Mon, Dec 07, 2009 at 01:09:59PM -0300, Alvaro Herrera wrote:
> > Given the extreme patience and diligence exhibited by KaiGai, I
> > hesitate to say this, but it seems to me that this would be
> > critically important for the long term success of this feature.  I
> > have no idea how much work it would be to make the interface to the
> > external security system pluggable, but if it's at all feasible, I
> > think it should be done.
>
> This is how the code was developed initially -- the patch was called
> PGACE and SELinux was but the first implementation on top of it.

I find it astonishing that after SE-PgSQL was implemented on top of a
pluggable system (PGACE) and this system was removed at request of the
"community" [1] that at this late phase people are suggesting it needs
to be added back again. Havn't the goalposts been moved enough times?

[1] http://archives.postgresql.org/pgsql-hackers/2009-01/msg02295.php

(It seems we've gone from a patch that had been around for years
solving actual people's problems to a patch which does barely anything
and we don't know whether it solves anybodies problem).

Have a nice day,
--
Martijn van Oosterhout   <kleptog@svana.org>   http://svana.org/kleptog/
> Please line up in a tree and maintain the heap invariant while
> boarding. Thank you for flying nlogn airlines.