BUGFIX:

- HeapInsert/HeapUpdate hooks called ReadBuffer without any locks.
- Unexpected behavior in SELECT ... INTO t2 FROM t1 statement.

sepostgresql-pgace-8.3RC2-2.patch

@@ -1875,8 +1875,8 @@ diff -rpNU3 base/src/backend/security/Makefile pgace/src/backend/security/Makefi
 +endif
 diff -rpNU3 base/src/backend/security/pgaceCommon.c pgace/src/backend/security/pgaceCommon.c
 --- base/src/backend/security/pgaceCommon.c	1970-01-01 09:00:00.000000000 +0900
-+++ pgace/src/backend/security/pgaceCommon.c	2007-11-26 15:04:25.000000000 +0900
-@@ -0,0 +1,707 @@
++++ pgace/src/backend/security/pgaceCommon.c	2008-01-22 14:28:47.000000000 +0900
+@@ -0,0 +1,713 @@
 +/*
 + * src/backend/security/pgaceCommon.c
 + *   Common part of PostgreSQL Access Control Extension
@@ -1892,10 +1892,12 @@ diff -rpNU3 base/src/backend/security/pgaceCommon.c pgace/src/backend/security/p
 +#include "catalog/pg_attribute.h"
 +#include "catalog/pg_largeobject.h"
 +#include "catalog/pg_security.h"
++#include "catalog/pg_type.h"
 +#include "executor/executor.h"
 +#include "miscadmin.h"
 +#include "nodes/makefuncs.h"
 +#include "nodes/parsenodes.h"
++#include "parser/parse_expr.h"
 +#include "security/pgace.h"
 +#include "utils/builtins.h"
 +#include "utils/fmgroids.h"
@@ -1921,8 +1923,12 @@ diff -rpNU3 base/src/backend/security/pgaceCommon.c pgace/src/backend/security/p
 +
 +		if (tle->resjunk)
 +			continue;
-+		if (!strcmp(tle->resname, SECURITY_SYSATTR_NAME))
++		if (!strcmp(tle->resname, SECURITY_SYSATTR_NAME)) {
++			if (exprType(tle->expr) != SECLABELOID)
++				elog(ERROR, "type mismatch in explicit labeling");
 +			tle->resjunk = true;
++			break;
++		}
 +	}
 +}
 +

sepostgresql-sepgsql-8.3RC2-2.patch

@@ -1229,8 +1229,8 @@ diff -rpNU3 pgace/src/backend/security/sepgsql/core.c sepgsql/src/backend/securi
 +}
 diff -rpNU3 pgace/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/security/sepgsql/hooks.c
 --- pgace/src/backend/security/sepgsql/hooks.c	1970-01-01 09:00:00.000000000 +0900
-+++ sepgsql/src/backend/security/sepgsql/hooks.c	2008-01-10 10:43:53.000000000 +0900
-@@ -0,0 +1,656 @@
++++ sepgsql/src/backend/security/sepgsql/hooks.c	2008-01-22 13:52:55.000000000 +0900
+@@ -0,0 +1,658 @@
 +/*
 + * src/backend/sepgsqlHooks.c
 + *   SE-PostgreSQL hooks
@@ -1263,6 +1263,7 @@ diff -rpNU3 pgace/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/secur
 +	HeapTuple oldtup;
 +
 +	buffer = ReadBuffer(rel, ItemPointerGetBlockNumber(tid));
++	LockBuffer(buffer, BUFFER_LOCK_SHARE);
 +
 +	dp = (PageHeader) BufferGetPage(buffer);
 +	lp = PageGetItemId(dp, ItemPointerGetOffsetNumber(tid));
@@ -1273,8 +1274,9 @@ diff -rpNU3 pgace/src/backend/security/sepgsql/hooks.c sepgsql/src/backend/secur
 +	tuple.t_len = ItemIdGetLength(lp);
 +	tuple.t_self = *tid;
 +	tuple.t_tableOid = RelationGetRelid(rel);
-+
 +	oldtup = heap_copytuple(&tuple);
++
++	LockBuffer(buffer, BUFFER_LOCK_UNLOCK);
 +	ReleaseBuffer(buffer);
 +
 +	return oldtup;

sepostgresql.init

@@ -9,7 +9,7 @@
 
 PGVERSION="8.3RC2"
 PGMAJORVERSION=`echo "$PGVERSION" | sed 's/^\([0-9]*\.[0-9a-z]*\).*$/\1/'`
-SEPGVERSION="2.52"
+SEPGVERSION="2.56"
 
 # source function library
 . /etc/rc.d/init.d/functions

sepostgresql.spec

@@ -13,7 +13,7 @@
 Summary: Security Enhanced PostgreSQL
 Name: sepostgresql
 Version: 8.3RC2
-Release: 2.52%{?sepgsql_extension}%{?dist}
+Release: 2.56%{?sepgsql_extension}%{?dist}
 License: BSD
 Group: Applications/Databases
 Url: http://code.google.com/p/sepgsql/
@@ -204,6 +204,10 @@ fi
 %attr(700,sepgsql,sepgsql) %dir %{_localstatedir}/lib/sepgsql/backups
 
 %changelog
+* Tue Jan 22 2008 <kaigai@kaigai.gr.jp> - sepostgresql-8.3RC2-2.56
+- BUGFIX: lack of locks when refering buffer pages at update/delete hooks
+- BUGFIX: explicit labeling using SELECT ... INTO statement.
+
 * Sun Jan 20 2008 <kaigai@kaigai.gr.jp> - sepostgresql-8.3RC2-2.52
 - shares /usr/lib/pgsql/*.so libraries, with original postgresql.
 

sepostgresql.te

@@ -1,4 +1,4 @@
-policy_module(sepostgresql, 2.52)
+policy_module(sepostgresql, 2.56)
 
 gen_require(`
 	all_userspace_class_perms