Horton

Re: sepgsql logging

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andrew Dunstan <andrew@dunslane.net>
Cc: Dave Page <dpage@pgadmin.org>, pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2021-04-01T14:23:10Z
Lists: pgsql-hackers 
Andrew Dunstan <andrew@dunslane.net> writes:
> On 4/1/21 8:32 AM, Dave Page wrote:
>> It seems to me that sepgsql should also log the denial, but flag that
>> permissive mode is on.

> +1 for doing what selinux does if possible.

+1.  If selinux itself is doing that, it's hard to see a reason why
we should not; and I concur that the info is useful.

			regards, tom lane

Commits

  1. Include permissive/enforcing state in sepgsql log messages.