Re: [RFC] Security design of SE-PostgreSQL (2/3)

[Russell Coker <russell@coker.com.au>]

On Friday 16 February 2007 16:35, KaiGai Kohei <kaigai@kaigai.gr.jp> wrote:
> 2. about Loadable module
>
> PostgreSQL allowed to load dynamic link library.
> It has a possibility to mess up the access control of SE-PostgreSQL no need
> to say, so we have to restrict loading them by the security policy.
>
> I have an idea to add the following access vector for the purpose.
>   1. allow (context of client)   (context of database)  
> database:load_module;
> 2. allow (context of database) (context of shlib 
> file) database:associate;

Who will be loading such modules?  Only the DBA or regular users too?

In the above access control design you control which databases a user may load 
modules for and which modules may be associated with a given database.  But 
you don't control which modules a user may load.  Is it possible that modules 
A and B may be loaded into a database but only user C will be permitted to 
load module A?

Do modules have parameters?  Or is there only one way that a module can be 
used?

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.