From: | Kohei KaiGai <kaigai(at)kaigai(dot)gr(dot)jp> |
---|---|
To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
Cc: | Yeb Havinga <yebhavinga(at)gmail(dot)com>, PgHacker <pgsql-hackers(at)postgresql(dot)org>, Joshua Brindle <jbrindle(at)tresys(dot)com> |
Subject: | Re: [v9.2] Add GUC sepgsql.client_label |
Date: | 2012-03-12 15:13:52 |
Message-ID: | CADyhKSWRVVvfwCdHOV+980bwcZ24AMvmqfTqZbpNUONiVLPx_g@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
2012/3/12 Robert Haas <robertmhaas(at)gmail(dot)com>:
> On Mon, Mar 12, 2012 at 10:58 AM, Kohei KaiGai <kaigai(at)kaigai(dot)gr(dot)jp> wrote:
>> It is a practical reason. In case when httpd open the connection to PG and
>> set a suitable security label according to the given credential prior to launch
>> of user application, then keep this connection for upcoming request, it is
>> worthwhile to reset security label of the client.
>
> But wait a minute - how is that any good? That allows the client to
> pretty trivially circumvent the security restriction that we were
> trying to impose by doing sepgsql_setcon() in the first place. It
> doesn't matter how convenient it is if it's flagrantly insecure.
>
> Am I missing something here?
>
It is a practical reason. If we would not support the reset feature,
the application has to know the security label of itself, as a target
label to be reverted. However, I'm not certain the status of script-
language binding of libselinux feature to obtain the self label,
although it is supported on Perl, Ruby and PHP (with extension
by myself) at least.
It seems to me a reasonable cost to track the original label to
eliminate a restriction of application side that tries to revert
the security label once switched.
Thanks,
--
KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>
From | Date | Subject | |
---|---|---|---|
Next Message | Kevin Grittner | 2012-03-12 15:41:20 | Partitioning triggers doc patch |
Previous Message | Alvaro Herrera | 2012-03-12 15:11:38 | Re: psql COPY vs. ON_ERROR_ROLLBACK, multi-command strings |