Greg Stark <gsstark@mit.edu> writes:
> The first step is to add hooks which don't change the security model
> at all, just allow people to control the existing checks from their SE
> configuration.
This is in fact what the presented patch is meant to do. The issue is
about whether the hook placement is sane/useful/extensible. The main
problem I've got with the design is that it doesn't appear to work for
privilege checks made by add-on modules.
regards, tom lane