Horton

Re: 8.4 release planning

Joshua Brindle <method@manicmethod.com>

View thread View on postgr.es
From: Joshua Brindle <method@manicmethod.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Josh Berkus <josh@agliodbs.com>, Gregory Stark <stark@enterprisedb.com>, Robert Haas <robertmhaas@gmail.com>, Simon Riggs <simon@2ndQuadrant.com>, Ron Mayer <rm_pg@cheapcomplexdevices.com>, "Joshua D. Drake" <jd@commandprompt.com>, Merlin Moncure <mmoncure@gmail.com>, "Jonah H. Harris" <jonah.harris@gmail.com>, Bruce Momjian <bruce@momjian.us>, Bernd Helmle <mailings@oopsware.de>, Peter Eisentraut <peter_e@gmx.net>, pgsql-hackers@postgresql.org
Date: 2009-01-27T20:00:39Z
Lists: pgsql-hackers 
Stephen Frost wrote:
> * Joshua Brindle (method@manicmethod.com) wrote:
>> They are separate. If you look at the patches you'll see a pgace part, 
>> this is where the core interfaces to the security backends, and you'll 
>> see a rowacl backend and an sepgsql backend.
> 
> Right, guess it wasn't clear to me that the PGACE bits for row-level
> access control could be used independently of SELinux (and maybe even on
> systems that don't have SELinux..?).
> 

Sure, if you look at pgaceHooks.c you'll see:

bool
pgaceExecScan(Scan *scan, Relation rel, TupleTableSlot *slot)
{
         /* Hardwired DAC checks */
         if (!rowaclExecScan(scan, rel, slot))
                 return false;

         switch (pgace_feature)
         {
#ifdef HAVE_SELINUX
         case PGACE_FEATURE_SELINUX:
                 if (sepgsqlIsEnabled())
                         return sepgsqlExecScan(scan, rel, slot);
                 break;
#endif
         default:
                 break;
         }
         return true;
}

Notice the rowacl call outside of the HAVE_SELINUX ifdefs