Joe Conway

SECCOMP ("SECure COMPuting with filters") is a Linux kernel syscall filtering mechanism which allows reduction of the kernel attack surface by preventing (or at least audit logging) normally unused syscalls. Recent security best-practices recommend, and certain highly security-conscious organizations are beginning to require, that SECCOMP be used to the extent possible. The major web browsers, container runtime engines, and systemd are all examples of software that already support SECCOMP.

This talk covers SECCOMP applied to PostgreSQL via 2 different methods -- namely top-down using systemd, and at the session level using a PostgreSQL extension called pgseccomp. The two methods will be explained and compared. We will also discuss how and why the two methods might be used in conjunction. Finally, a process to determine the list of expected/legitimate PostgreSQL kernel syscalls is described.

The latest and greatest version of PostgreSQL is PostgreSQL 11.

This talk will start off with some history of the community and a description of the development process including some metrics trends. It will then cover a high level overview of the features which will be part of PostgreSQL 11, and prognosticate a bit about the future of PostgreSQL.

Community * History * Development Process PostgreSQL 11 * Patches committed 12 and Beyond * Actively worked items * Under active discussion

A crash course to get you up and running with PostgreSQL. We will cover:

• Installation from binaries and source
• Cluster initialization, startup, and session management
• Basic configuration - postgresql.conf and pg_hba.conf
• psql use/hints
• SQL syntax and quoting
• Data types