Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-10-05 Thread KaiGai Kohei
Stephen Frost wrote: > * Robert Haas (robertmh...@gmail.com) wrote: >> So what's the status of this patch currently? > > I'll be reviewing the updates shortly. After that, I'd like a committer > to review it. Do you think this version also should rework an invocation of pg_namespace_aclcheck() n

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-10-05 Thread Stephen Frost
* Robert Haas (robertmh...@gmail.com) wrote: > So what's the status of this patch currently? I'll be reviewing the updates shortly. After that, I'd like a committer to review it. Thanks, Stephen signature.asc Description: Digital signature

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-10-05 Thread Robert Haas
On Wed, Sep 30, 2009 at 11:17 PM, Stephen Frost wrote: > * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> Stephen Frost wrote: >> > Thanks.  To make sure it gets picked up, you might respond to Tom's >> > message above with this same email.  Just a thought. >> >> The following message was my reply.

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread Stephen Frost
* KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > Stephen Frost wrote: > > Thanks. To make sure it gets picked up, you might respond to Tom's > > message above with this same email. Just a thought. > > The following message was my reply. > http://archives.postgresql.org/pgsql-hackers/2009-08/msg0

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread KaiGai Kohei
Stephen Frost wrote: > KaiGai, > > * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> The attached patch eliminates permission checks in FindConversion() >> and EnableDisableRule(), because these are nonsense or redundant. >> >> It is an separated issue from the ac_*() routines. >> For now, we decide

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread KaiGai Kohei
Stephen Frost wrote: >>> I know it doesn't hide existence of major database objects. Depending >>> on the situation, there might be other information that could be leaked. >>> I realize that's not the case here, but I still want to catch and >>> document any behavioral changes, even if it's clear

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread Stephen Frost
KaiGai, * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > Yes, it is reasonable both of MAC/DAC to handle temporary schema as > an exception of access controls on schemas. Great. > > I know it doesn't hide existence of major database objects. Depending > > on the situation, there might be other in

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread KaiGai Kohei
Stephen Frost wrote: > * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> Stephen Frost wrote: >>> The scenario you outline could happen without SE-PG, couldn't it? >>> Specifically, if a user makes a connection, creates a temporary table, >>> and then their rights to create temporary tables are revok

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread Stephen Frost
KaiGai, * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > The attached patch eliminates permission checks in FindConversion() > and EnableDisableRule(), because these are nonsense or redundant. > > It is an separated issue from the ac_*() routines. > For now, we decided not to touch these stuffs in

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-30 Thread Stephen Frost
* KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > Stephen Frost wrote: > > The scenario you outline could happen without SE-PG, couldn't it? > > Specifically, if a user makes a connection, creates a temporary table, > > and then their rights to create temporary tables are revoked? What > > should hap

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-29 Thread KaiGai Kohei
> I don't find the comment regarding what happened with FindConversion to > be nearly descriptive enough. Can you elaborate on why the check wasn't > necessary and has now been removed? If it really isn't needed, why have > that function at all? >>> http://archives.postgresql.org/

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-29 Thread KaiGai Kohei
Stephen Frost wrote: > * KaiGai Kohei (kai...@kaigai.gr.jp) wrote: >> Stephen Frost wrote: You might also provide a specific example of where and why this check matters. I'm not entirely convinced it's necessary or makes sense, to be honest.. >> By the default, it is 100% correct to

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-29 Thread Stephen Frost
* KaiGai Kohei (kai...@kaigai.gr.jp) wrote: > Stephen Frost wrote: > >> You might also provide a specific example of where and why this check > >> matters. I'm not entirely convinced it's necessary or makes sense, to > >> be honest.. > > By the default, it is 100% correct to omit checks here. >

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-29 Thread Robert Haas
On Tue, Sep 29, 2009 at 6:54 AM, Stephen Frost wrote: > * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> Could you post any review comments, even if it is not comprehensive yet? > > In general, you don't need to preface your comments with 'MEMO:'.  I > would encourage removing that.  You might use

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-29 Thread KaiGai Kohei
Stephen, thanks for your comments. Stephen Frost wrote: >> * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> >> Could you post any review comments, even if it is not comprehensive yet? >> >> In general, you don't need to preface your comments with 'MEMO:'. I >> would encourage removing that. You m

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-29 Thread Stephen Frost
* KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > Could you post any review comments, even if it is not comprehensive yet? In general, you don't need to preface your comments with 'MEMO:'. I would encourage removing that. You might use 'FIXME:' instead, if it is something which needs to be correcte

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-28 Thread KaiGai Kohei
Stephen Frost wrote: > * KaiGai Kohei (kai...@ak.jp.nec.com) wrote: >> BTW, I raised a few issues. Do you have any opinions? > > Certainly, though they're my opinions and I don't know if the committers > will agree, but I suspect they will. Thanks for your comments. >> * deployment of the source

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-28 Thread Stephen Frost
* KaiGai Kohei (kai...@ak.jp.nec.com) wrote: > BTW, I raised a few issues. Do you have any opinions? Certainly, though they're my opinions and I don't know if the committers will agree, but I suspect they will. > * deployment of the source code > > The current patch implements all the access con

Re: [HACKERS] [PATCH] Reworks for Access Control facilities (r2311)

2009-09-27 Thread Robert Haas
2009/9/24 KaiGai Kohei : > I noticed that the previous patch (r2311) fails to apply on the CVS HEAD. > The attached patch is only rebased to the latest CVS HEAD, without any > other changes. Stephen, Are you planning to post a review for this? We are 12 days into the CommitFest so we need to giv