[PATCH] database audit integration (Re: Some ideas in SE-PostgreSQL enhancement)

Hello, I'm a developer of SE-PostgreSQL which is an enhancement of database security using SELinux. It enables to apply the security policy of the operating system on accesses to database objects also. It makes an access control decision and audit messages, but these are not written out to system audit mechanism. I believe our preferable behavior is the system audit collects all the audit messages come from SELinux, not a logfile of PostgreSQL. Currently, the audit-libs has an interface to write a message come from userspace avc, but some of parameter is not suitable for the reference monitor in database management system. This patch adds a new interface as follows: int audit_log_database_message(int audit_fd, int type, const char *message, const char *hostname, const char *addr, const char *dbuser); It is differ from audit_log_user_avc_message() in the point of a new parameter of dbuser, instead of tty and uid. I don't think these are meaningful information for DBMS, but we would like to record what database user invokes this audit record. Please any comments. Thanks, KaiGai Kohei wrote: -- OSS Platform Development Division, NEC KaiGai Kohei <kaigai(a)ak.jp.nec.com&gt;