Thread

1. [sepgsql] missing checks of process:transition on trusted procedure invocation

   Kohei Kaigai <kohei.kaigai@eu.nec.com> — 2011-04-04T15:01:51Z

   Sorry, I missed a permission check on invocation of trusted procedures.
   
   When client's label getting switched to Y from X, we needed to check
   process:transition permission between label X and label Y.
   It is same manner when OS launches a program with a special label to
   cause domain transition.
   
   The attached patch adds checks this permission when user tries to
   invoke a trusted procedure and switch security label of the client.
   In addition, it also adds a case of regression test of this problem.
   
   Thanks,
   --
   NEC Europe Ltd, SAP Global Competence Center
   KaiGai Kohei <kohei.kaigai@eu.nec.com>
   

2. Re: [sepgsql] missing checks of process:transition on trusted procedure invocation

   Robert Haas <robertmhaas@gmail.com> — 2011-04-04T17:26:12Z

   On Mon, Apr 4, 2011 at 11:01 AM, Kohei Kaigai <Kohei.Kaigai@eu.nec.com> wrote:
   > Sorry, I missed a permission check on invocation of trusted procedures.
   >
   > When client's label getting switched to Y from X, we needed to check
   > process:transition permission between label X and label Y.
   > It is same manner when OS launches a program with a special label to
   > cause domain transition.
   >
   > The attached patch adds checks this permission when user tries to
   > invoke a trusted procedure and switch security label of the client.
   > In addition, it also adds a case of regression test of this problem.
   
   Committed.
   
   -- 
   Robert Haas
   EnterpriseDB: http://www.enterprisedb.com
   The Enterprise PostgreSQL Company