Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread KaiGai Kohei
(2010/05/28 5:25), Stephen Frost wrote: > * Tom Lane (t...@sss.pgh.pa.us) wrote: >> Stephen Frost writes: >>> Err, your question comes across to me like "if you added comments to >>> pg_depend, you'd only be able to use a given comment X for one object?". >>> Doesn't make alot of sense. :) >> >> W

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread KaiGai Kohei
(2010/05/28 5:11), Robert Haas wrote: > On Thu, May 27, 2010 at 4:01 PM, Tom Lane wrote: >> Stephen Frost writes: >>> * Tom Lane (t...@sss.pgh.pa.us) wrote: I'm not real sure that you want a dependency for a security label anyway --- wouldn't that mean each label could only be used for

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread KaiGai Kohei
(2010/05/28 4:12), Stephen Frost wrote: > KaiGai, > > * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> As we talked at the developer meeting on Ottawa, it needs to provide >> a capability to assign a short text identifier on database objects >> to support label based ESP (such as SELinux). >> So, I

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread Stephen Frost
* Tom Lane (t...@sss.pgh.pa.us) wrote: > Stephen Frost writes: > > Err, your question comes across to me like "if you added comments to > > pg_depend, you'd only be able to use a given comment X for one object?". > > Doesn't make alot of sense. :) > > Well, one of us is confused. I thought the i

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread Robert Haas
On Thu, May 27, 2010 at 4:01 PM, Tom Lane wrote: > Stephen Frost writes: >> * Tom Lane (t...@sss.pgh.pa.us) wrote: >>> I'm not real sure that you want a dependency for a security label anyway >>> --- wouldn't that mean each label could only be used for one object? > >> Err, your question comes ac

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread Tom Lane
Stephen Frost writes: > * Tom Lane (t...@sss.pgh.pa.us) wrote: >> I'm not real sure that you want a dependency for a security label anyway >> --- wouldn't that mean each label could only be used for one object? > Err, your question comes across to me like "if you added comments to > pg_depend, yo

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread Stephen Frost
* Tom Lane (t...@sss.pgh.pa.us) wrote: > Stephen Frost writes: > > I agree that we need to address this. I am kind of curious how this is > > handled for comments? It appears to be, but I don't see an entry in > > pg_depend when a comment is added to an object, yet the entry in > > pg_descriptio

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread Tom Lane
Stephen Frost writes: >> We also add a dependency between the labeled object and the security >> label itself. It also enables to clean up orphan labels automatically, >> without any new invention. > I agree that we need to address this. I am kind of curious how this is > handled for comments?

Re: [HACKERS] [RFC] Security label support

2010-05-27 Thread Stephen Frost
KaiGai, * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > As we talked at the developer meeting on Ottawa, it needs to provide > a capability to assign a short text identifier on database objects > to support label based ESP (such as SELinux). > So, I'd like to propose a few approaches to support sec