Heikki Linnakangas <heikki.linnakangas@enterprisedb.com> writes:
> KaiGai Kohei wrote:
>> * ACL_SELECT_FOR_UPDATE has same value with ACL_UPDATE, so SE-PostgreSQL
>> checks db_table:{update} permission on SELECT ... FOR SHARE OF,
>> instead of db_table:{lock} permission.
>
> This again falls into the category of trying to have more fine-grained
> permissions than vanilla PostgreSQL has. Just give up on the lock permission,
> and let it check update permission instead. Yes, it can be annoying that you
> need update-permission to do SELECT FOR SHARE, but that's an existing problem
> and not in scope for this patch.
Would it make sense to instead of removing and deferring pieces bit by bit to
instead work the other way around? Extract just the part of the patch that
maps SELinux capabilities to Postgres privileges as a first patch? Then
discuss any other parts individually at a later date?
That might relieve critics of the sneaking suspicion that there may be some
semantic change that hasn't been identified and discussed and snuck through?
Some of them are probably good ideas but if they are they're probably good
ideas even for non-SE semantics too.
-- Gregory Stark EnterpriseDB http://www.enterprisedb.com Ask me about EnterpriseDB's PostGIS support!