Qapla: Policy compliance for database-backed systems
summary
Qapla is a DB-adapter reference monitor that enforces fine-grained, row-and-column policies by query rewriting: it replaces each table with a subquery containing the applicable stored SQL policies (WHERE clauses) so non-compliant app queries return only allowed subsets. Prototype is ~20,000 lines of C, tested on HotCRP (22 tables, 215 columns) with about 30 policies; integrating required changing ~150 lines of 52,000 LOC. Typical user actions add ~30–40 ms; a heavy review-assignment job (3,800 queries) rises from 1.5s to 6.5s.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:33Code walkthrough
- 2:50Inline checks
- 3:29Data leaks
- 3:46Open approach
- 4:44Goals
- 5:14Overview
- 7:33Threat model
- 9:56Single column policy
- 11:39Multiple column policy
- 13:32Outcome column policy
- 14:42Summary
- 17:58Implementation
- 19:04Evaluation
- 22:32Conclusion
- 28:26Additional constraints
related talks
18mExtracting Database Access-Control Policies from Web Applications
42mA blueprint for building a generic... (Ashwin Sidhalinganahalli, Fletcher Ramee)
28mThoth: Comprehensive Policy Compliance in Data Retrieval Systems
50mEffective PL/SQL Code Insight With PL/Scope–or another reason to put code in the dtb
35mHow to fight misconfiguration and bad intentions with Kubernetes admission policy
09mFlexible Authorization:Storing and Managing Rules in DB
54mSecuring Software by Construction
30mA Practical Guide To Kubernetes Policy as Code