Re: sepgsql contrib module

(2011/01/24 12:49), Robert Haas wrote:
> On Sun, Jan 23, 2011 at 9:56 PM, Robert Haas<robertmhaas(at)gmail(dot)com> wrote:
>> On Sun, Jan 23, 2011 at 8:53 PM, Robert Haas<robertmhaas(at)gmail(dot)com> wrote:
>>> 2011/1/21 KaiGai Kohei<kaigai(at)ak(dot)jp(dot)nec(dot)com>:
>>>> The attached patch is a revised version.
>>>
>>> I've committed this. Cleanup coming...
>>
>> Yikes. On further examination, exec_object_restorecon() is pretty
>> bogus. Surely you need some calls to quote_literal_cstr() in there
>> someplace.
>
Are you concerning about the object name being supplied to
selabel_lookup_raw() in exec_object_restorecon()?
I also think this quoting you suggested is reasonable.

>> And how about using getObjectDescriptionOids() for the
>> error message, instead of the entirely bogus construction that's there
>> now?
>
It seems to me a good idea. I'll try to revise corresponding code.

> Also, shouldn't a bunch of these messages end in ": %m"?
>
When these messages are because of unexpected operating system errors,
such as fails in communication with selinux, the "%m" will give us good
suggestions.

I'll submit these fixes within a few days, please wait for a while.

Thanks,
--
KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>