Re: Adding support for SE-Linux security - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Adding support for SE-Linux security
Date
Msg-id 7340.1260309110@sss.pgh.pa.us
Whole thread Raw
In response to Re: Adding support for SE-Linux security  (Peter Eisentraut <peter_e@gmx.net>)
Responses Re: Adding support for SE-Linux security  ("David P. Quigley" <dpquigl@tycho.nsa.gov>)
List pgsql-hackers
Peter Eisentraut <peter_e@gmx.net> writes:
> PGACE wasn't a plugin system.  It was an API inside the core code.  If
> it had been a plugin system, this would have been much easier, because
> the plugin itself could have been developed independently.

Well, it should certainly have used function pointers or something to
allow better pluggability, but that would have been a trivial change.
I don't believe that doing so would have made development any easier.
The real problem in all this is to answer the question "do we have the
right hooks in the right places?".  Whether the hooks lead to function
pointers or hard-wired calls doesn't enter into that.  Moreover, since
we can confidently say that all the early answers will be "no", it would
be a serious mistake to try to develop the plugin independently.
Having to keep two independent sets of source code in sync would waste
a lot of effort every time you realized you needed to adjust the hook
definitions.  Once you'd gotten to a releasable state maybe you could
assume the hook definitions would become stable, but right now I have no
confidence in that at all.
        regards, tom lane


pgsql-hackers by date:

Previous
From: "David P. Quigley"
Date:
Subject: Re: Adding support for SE-Linux security
Next
From: "Kevin Grittner"
Date:
Subject: Re: tsearch parser inefficiency if text includes urls or emails - new version