Re: Proposal of SE-PostgreSQL patches (for CommitFest:Sep)

Bruce Momjian wrote:
> Robert Haas wrote:
>>> The objection comes down to this: it's an extremely large, invasive,
>>> and probably performance-losing patch, which apparently will be of use
>>> to only a rather small set of people. It's not unreasonable to discuss
>>> just how large that set might be while we debate whether to accept the
>>> patch.
>> Significant loss of performance for people who are not using the
>> feature seems like it ought to be considered a non-starter. "Not
>> using MAC" needs to be a fast-path.
>
> Right now all of SE-PostgreSQL is a compile-time option so I assume the
> slowdown is only for compile-enabled builds.

Yes, we need '--enable-selinux' to activate all of SE-PostgreSQL features.

In addition, these are invoked via security hooks which are declared
as inline functions. So, I think it does not give us additional loss of
performances when you don't add the compile time option explicitly.

Thanks,
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>