Re: add a MAC check for TRUNCATE - Mailing list pgsql-hackers

From Tom Lane
Subject Re: add a MAC check for TRUNCATE
Date
Msg-id 20576.1567784855@sss.pgh.pa.us
Whole thread Raw
In response to Re: add a MAC check for TRUNCATE  (Yuli Khodorkovskiy <yuli.khodorkovskiy@crunchydata.com>)
Responses Re: add a MAC check for TRUNCATE
Re: add a MAC check for TRUNCATE
List pgsql-hackers
Yuli Khodorkovskiy <yuli.khodorkovskiy@crunchydata.com> writes:
> Ah, now I remember why I didn't add regressions to the original patch.
> As stated at the top of the thread, the "db_table: { truncate }"
> permission does not currently exist in refpolicy. A workaround would
> be to add the policy with CIL, but that adds unneeded complexity to
> the regressions. I think the correct path forward is:

> 1) Get the sepgsql changes in without policy/regressions
> 2) Send a patch to refpolicy for the new permission
> 3) Once Redhat updates the selinux-policy-targeted RPM to include the
> new permissions, I will send an update to the sepgsql regressions and
> policy.

That's going to be a problem.  I do not think it will be acceptable
to commit tests that fail on less-than-bleeding-edge SELinux.

            regards, tom lane



pgsql-hackers by date:

Previous
From: Yuli Khodorkovskiy
Date:
Subject: Re: add a MAC check for TRUNCATE
Next
From: Stephen Frost
Date:
Subject: Re: add a MAC check for TRUNCATE