Horton

Re: add a MAC check for TRUNCATE

Joe Conway <mail@joeconway.com>

View thread View on postgr.es
From: Joe Conway <mail@joeconway.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Yuli Khodorkovskiy <yuli.khodorkovskiy@crunchydata.com>, Stephen Frost <sfrost@snowman.net>, Kohei KaiGai <kaigai@heterodb.com>, pgsql-hackers@lists.postgresql.org, Joshua Brindle <joshua.brindle@crunchydata.com>, Mike P <mike.palmiotto@crunchydata.com>
Date: 2019-09-07T01:09:36Z
Lists: pgsql-hackers 
On 9/6/19 8:07 PM, Tom Lane wrote:
> Joe Conway <mail@joeconway.com> writes:
>> On 9/6/19 2:18 PM, Tom Lane wrote:
>>> sepgsql hasn't worked on RHEL6 in a long time, if ever; it requires
>>> a newer version of libselinux than what ships in RHEL6.  So I'm not
>>> concerned about that.  We do need to worry about RHEL7, and whatever
>>> is the oldest version of Fedora that is running the sepgsql tests
>>> in the buildfarm.
> 
>> I could be wrong, but as far as I know rhinoceros is the only buildfarm
>> animal running sepgsql tests.
> 
> It seems reasonable to define RHEL7 as the oldest SELinux version we
> still care about.  But it'd be a good idea for somebody to be running
> a fairly bleeding-edge Fedora animal with sepgsql enabled, so we get
> coverage of the other end of the scale.


Yeah -- I was planning to eventually register a RHEL8 animal, but I
should probably do one for Fedora as well. I'll bump the priority for
that on my personal TODO.

Joe
-- 
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development

Commits

  1. Update sepgsql to add mandatory access control for TRUNCATE

  2. Add object TRUNCATE hook

  3. postgres_fdw: Fix error message for PREPARE TRANSACTION.