Alvaro Herrera wrote:
> > Would it make sense to instead of removing and deferring pieces bit by bit to
> > instead work the other way around? Extract just the part of the patch that
> > maps SELinux capabilities to Postgres privileges as a first patch? Then
> > discuss any other parts individually at a later date?
>
> I think that makes sense. Implement just a very basic core in a first
> patch, and start adding checks slowly, one patch each. We have talked
> about "incremental patches" in the past.
>
> We wouldn't get "unbreakable PostgreSQL" in a single commit, but we
> would at least start moving.
>
> The good thing about having started in the opposite direction is that by
> now we know that the foundation APIs are good enough to build the
> complete feature.
Well, we have been trying to go simplify the SE-PostgreSQL patch since
September, and while we have made progress, we still have work to do,
and at this point I think we have run out of time. I think we have
given it a fair shot, but I don't think it is going to make 8.4.
KaiGai-san, the only option I can offer is perhaps to list a URL for
your SE-PostgreSQL patch to be applied by people who want to use SE-PG.
-- Bruce Momjian <bruce@momjian.us> http://momjian.us EnterpriseDB
http://enterprisedb.com
+ If your life is a hard drive, Christ can be your backup. +