On Mon, Feb 16, 2009 at 11:10:19AM +0900, KaiGai Kohei wrote: > At the previous discussion, two items were pointed out. > > The one is called as covert channel. When a tuple with PK is refered by > one or more tuples with FK, row-level control prevents to update or delete > the PK, even if the FK is invisible from users. It allows users to infer > existence of invisible FK.
One thing I keep missing in this discussion: the term "row-level security" in the above senstence in not the important part. Right now you can revoke SELECT permission on a table with a foreign key and it will still prevent UPDATEs and DELETEs of the primary key, allowing users to infer the existance of an invisible FK. This is the same "covert channel", so why is it a problem for SE-Postgres and not for normal Postgres? Is it because revoking permissions is not considered a security mechanism or something? I'm sure it's obvious, I'm just not seeing it. Have a nice day, -- Martijn van Oosterhout <klep...@svana.org> http://svana.org/kleptog/ > Please line up in a tree and maintain the heap invariant while > boarding. Thank you for flying nlogn airlines.
signature.asc
Description: Digital signature
