Horton

Re: add a MAC check for TRUNCATE

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Joe Conway <mail@joeconway.com>
Cc: Yuli Khodorkovskiy <yuli.khodorkovskiy@crunchydata.com>, Stephen Frost <sfrost@snowman.net>, Kohei KaiGai <kaigai@heterodb.com>, pgsql-hackers@lists.postgresql.org, Joshua Brindle <joshua.brindle@crunchydata.com>, Mike P <mike.palmiotto@crunchydata.com>
Date: 2019-09-07T00:07:27Z
Lists: pgsql-hackers 
Joe Conway <mail@joeconway.com> writes:
> On 9/6/19 2:18 PM, Tom Lane wrote:
>> sepgsql hasn't worked on RHEL6 in a long time, if ever; it requires
>> a newer version of libselinux than what ships in RHEL6.  So I'm not
>> concerned about that.  We do need to worry about RHEL7, and whatever
>> is the oldest version of Fedora that is running the sepgsql tests
>> in the buildfarm.

> I could be wrong, but as far as I know rhinoceros is the only buildfarm
> animal running sepgsql tests.

It seems reasonable to define RHEL7 as the oldest SELinux version we
still care about.  But it'd be a good idea for somebody to be running
a fairly bleeding-edge Fedora animal with sepgsql enabled, so we get
coverage of the other end of the scale.

			regards, tom lane

Commits

  1. Update sepgsql to add mandatory access control for TRUNCATE

  2. Add object TRUNCATE hook

  3. postgres_fdw: Fix error message for PREPARE TRANSACTION.