Re: [HACKERS] security hooks on object creation

2010-11-25 Thread Robert Haas
2010/11/25 KaiGai Kohei : > The attached patch is a revised patch. > > - The utils/hooks.h was renamed to catalog/objectaccess.h > - Numeric in the tail of InvokeObjectAccessHook0() has gone. > - Fixed bug in ATExecAddColumn; it gave AttributeRelationId >  to the hook instead of RelationRelationId.

Re: [HACKERS] security hooks on object creation

2010-11-24 Thread KaiGai Kohei
The attached patch is a revised patch. - The utils/hooks.h was renamed to catalog/objectaccess.h - Numeric in the tail of InvokeObjectAccessHook0() has gone. - Fixed bug in ATExecAddColumn; it gave AttributeRelationId to the hook instead of RelationRelationId. In addition, I found that we didn'

Re: [HACKERS] security hooks on object creation

2010-11-23 Thread Robert Haas
2010/11/23 KaiGai Kohei : >> What >> I'm not quite sure about is where to put the definitions you've added >> to a new file utils/hooks.h; I don't feel that's a very appropriate >> location.  It's tempting to put them in utils/acl.h just because this >> is vaguely access-control related and that he

Re: [HACKERS] security hooks on object creation

2010-11-23 Thread KaiGai Kohei
Thanks for your reviewing, and sorry for the late reply. I've not been available for a few days. (2010/11/22 12:11), Robert Haas wrote: > 2010/11/12 KaiGai Kohei: >> (2010/11/12 19:34), KaiGai Kohei wrote: >>> I revised my patch according to the prior suggestions. >>> >> I'm sorry. I revised my pa

Re: [HACKERS] security hooks on object creation

2010-11-21 Thread Robert Haas
2010/11/12 KaiGai Kohei : > (2010/11/12 19:34), KaiGai Kohei wrote: >> I revised my patch according to the prior suggestions. >> > I'm sorry. I revised my patch, but not attached. > > Please see this attached one. I'm satisfied with this approach, although I intend to change InvokeObjectAccessHook

Re: [HACKERS] security hooks on object creation

2010-11-12 Thread KaiGai Kohei
(2010/11/12 19:34), KaiGai Kohei wrote: > I revised my patch according to the prior suggestions. > I'm sorry. I revised my patch, but not attached. Please see this attached one. Thanks, > Invocation of the hooks is encapsulated within macro, not function: > >+ #define InvokeObjectAccessHoo

Re: [HACKERS] security hooks on object creation

2010-11-12 Thread KaiGai Kohei
I revised my patch according to the prior suggestions. Invocation of the hooks is encapsulated within macro, not function: + #define InvokeObjectAccessHook0(access,classId,objectId,subId)\ + do {\ + if (object_a

Re: [HACKERS] security hooks on object creation

2010-11-10 Thread KaiGai Kohei
(2010/11/11 3:00), Robert Haas wrote: On Wed, Nov 10, 2010 at 8:33 AM, KaiGai Kohei wrote: (2010/11/10 13:06), Robert Haas wrote: In this patch, we put InvokeObjectAccessHook0 on the following functions. - heap_create_with_catalog() for relations/attributes - ATExecAddColumn() for attributes

Re: [HACKERS] security hooks on object creation

2010-11-10 Thread Robert Haas
On Wed, Nov 10, 2010 at 8:33 AM, KaiGai Kohei wrote: > (2010/11/10 13:06), Robert Haas wrote: >>> >>> In this patch, we put InvokeObjectAccessHook0 on the following functions. >>> >>> - heap_create_with_catalog() for relations/attributes >>> - ATExecAddColumn() for attributes >>> - NamespaceCreate

Re: [HACKERS] security hooks on object creation

2010-11-10 Thread KaiGai Kohei
(2010/11/10 13:06), Robert Haas wrote: In this patch, we put InvokeObjectAccessHook0 on the following functions. - heap_create_with_catalog() for relations/attributes - ATExecAddColumn() for attributes - NamespaceCreate() for schemas - ProcedureCreate() for aggregates/functions - TypeCreate() an

Re: [HACKERS] security hooks on object creation

2010-11-09 Thread Robert Haas
2010/11/9 KaiGai Kohei : > The attached patch provides plugin modules a hook just after object > creation time. In typical use cases, it enables to assign default > security labels on object creation by the external security providers. > > As Robert suggested before, it provides a generic purpose m

Re: [HACKERS] security hooks on object creation

2010-11-09 Thread Itagaki Takahiro
2010/11/9 KaiGai Kohei : > The attached patch provides plugin modules a hook just after object > creation time. In typical use cases, it enables to assign default > security labels on object creation by the external security providers. It looks like "DDL Trigger" on other database products. Do we

Re: [HACKERS] security hooks on object creation

2010-11-09 Thread KaiGai Kohei
(2010/11/09 20:34), Itagaki Takahiro wrote: 2010/11/9 KaiGai Kohei: The attached patch provides plugin modules a hook just after object creation time. In typical use cases, it enables to assign default security labels on object creation by the external security providers. It looks like "DDL Tr

[HACKERS] security hooks on object creation

2010-11-09 Thread KaiGai Kohei
The attached patch provides plugin modules a hook just after object creation time. In typical use cases, it enables to assign default security labels on object creation by the external security providers. As Robert suggested before, it provides a generic purpose main hook. It takes an enum of Obje