Horton

Re: add a MAC check for TRUNCATE

Alvaro Herrera <alvherre@2ndquadrant.com>

View thread View on postgr.es
From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Yuli Khodorkovskiy <yuli.khodorkovskiy@crunchydata.com>
Cc: Joe Conway <mail@joeconway.com>, Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>, Kohei KaiGai <kaigai@heterodb.com>, pgsql-hackers@lists.postgresql.org, Joshua Brindle <joshua.brindle@crunchydata.com>, Mike P <mike.palmiotto@crunchydata.com>
Date: 2019-09-25T21:49:15Z
Lists: pgsql-hackers 
On 2019-Sep-25, Yuli Khodorkovskiy wrote:

> Hi Alvaro,
> 
> I have attached the updated patches which should rebase.

Great, thanks.

> Since all existing DAC checks should have MAC, should these patches be
> considered a bug fix and therefore back patched?

I don't know the answer to that.  My impression from earlier discussion
is that this was seen as a non-backpatchable change, but I defer to Joe
on that as committer.  If it were up to me, the ultimate question would
be: would such a change adversely affect existing running systems?

Thanks,

-- 
Álvaro Herrera                https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

Commits

  1. Update sepgsql to add mandatory access control for TRUNCATE

  2. Add object TRUNCATE hook

  3. postgres_fdw: Fix error message for PREPARE TRANSACTION.