Andrew Dunstan <andrew@dunslane.net> writes:
> On 4/1/21 8:32 AM, Dave Page wrote:
>> It seems to me that sepgsql should also log the denial, but flag that
>> permissive mode is on.
> +1 for doing what selinux does if possible.
+1. If selinux itself is doing that, it's hard to see a reason why
we should not; and I concur that the info is useful.
regards, tom lane
