security label support, part.2

diff --git a/doc/src/sgml/ref/allfiles.sgml b/doc/src/sgml/ref/allfiles.sgml
index 7518c84..6f46356 100644
--- a/doc/src/sgml/ref/allfiles.sgml
+++ b/doc/src/sgml/ref/allfiles.sgml
@@ -132,6 +132,7 @@ Complete list of usable sgml source files in this directory.
 <!entity rollbackPrepared   system "rollback_prepared.sgml">
 <!entity rollbackTo         system "rollback_to.sgml">
 <!entity savepoint          system "savepoint.sgml">
+<!entity securityLabel      system "seclabel.sgml">
 <!entity select             system "select.sgml">
 <!entity selectInto         system "select_into.sgml">
 <!entity set                system "set.sgml">
diff --git a/doc/src/sgml/ref/seclabel.sgml b/doc/src/sgml/ref/seclabel.sgml
new file mode 100644
index 0000000..9215255
--- /dev/null
+++ b/doc/src/sgml/ref/seclabel.sgml
@@ -0,0 +1,123 @@
+<refentry id="SQL-SECURITY-LABEL">
+ <refmeta>
+  <refentrytitle>SECURITY LABEL</refentrytitle>
+  <manvolnum>7</manvolnum>
+  <refmiscinfo>SQL - Language Statements</refmiscinfo>
+ </refmeta>
+
+ <refnamediv>
+  <refname>SECURITY LABEL</refname>
+  <refpurpose>relabel the security label of an object</refpurpose>
+ </refnamediv>
+
+ <indexterm zone="sql-security-label">
+  <primary>SECURITY LABEL</primary>
+ </indexterm>
+
+ <refsynopsisdiv>
+<synopsis>
+SECURITY LABEL [ FOR '<replaceable class="PARAMETER">esp_tag</replaceable>' ] ON
+{
+  TABLE <replaceable class="PARAMETER">object_name</replaceable> |
+  COLUMN <replaceable class="PARAMETER">table_name</replaceable>.<replaceable class="PARAMETER">column_name</replaceable> |
+  SEQUENCE <replaceable class="PARAMETER">object_name</replaceable> |
+  VIEW <replaceable class="PARAMETER">object_name</replaceable>
+} IS '<replaceable class="PARAMETER">security_label</replaceable>';
+</synopsis>
+ </refsynopsisdiv>
+
+ <refsect1>
+  <title>Description</title>
+
+  <para>
+   <command>SECURITY LABEL</command> relabels a security label of a database object.
+  </para>
+
+  <para>
+   We can assign individual security labels on a certain database object for
+   each security providers, using <command>SECURITY LABEL</command> command.
+  </para>
+  <para>
+   Security labels are automatically assigned when the object is created,
+   and also automatically dropped when the object is dropped.
+  </para>
+
+ </refsect1>
+
+ <refsect1>
+  <title>Parameters</title>
+  <variablelist>
+   <varlistentry>
+    <term><replaceable class="parameter">object_name</replaceable></term>
+    <term><replaceable class="parameter">table_name</replaceable></term>
+    <term><replaceable class="parameter">table_name.column_name</replaceable></term>
+    <listitem>
+     <para>
+      The name of the object to be relabeled.  Names of tables, columns,
+      sequences and views can be schema-qualified.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">security_label</replaceable></term>
+    <listitem>
+     <para>
+      The new security label as a string literal.
+     </para>
+     <para>
+      It shall be validated by one of the label based security features,
+      in addition to its permission checks relabeling on the specified
+      database objects.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">esp_tag</replaceable></term>
+    <listitem>
+     <para>
+      The identifier string of external security provider.
+     </para>
+     <para>
+      When we install just one provider, we can omit this clause because
+      it is obvious which provider shall handle the given security label.
+      Elsewhere, when we install two or more providers concurrently,
+      we need to identify a certain external security provider.
+     </para>
+    </listitem>
+   </varlistentry>
+  </variablelist>
+ </refsect1>
+
+ <refsect1>
+  <title>Notes</title>
+  <para>
+   This feature requires one label based mandatory access control feature
+   to be installed at least, because a security label is specific for
+   each providers, so it has to be validated when we relabel it.
+  </para>
+ </refsect1>
+
+ <refsect1>
+  <title>Examples</title>
+
+  <para>
+   Relabel a security label on the table to '<literal>system_u:object_r:sepgsql_table_t:s0</literal>'.
+
+<programlisting>
+SECURITY LABEL FOR 'selinux' ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';
+</programlisting>
+  </para>
+ </refsect1>
+
+ <refsect1>
+  <title>Compatibility</title>
+  <para>
+   There is no <command>SECURITY LABEL</command> command in the SQL standard.
+  </para>
+ </refsect1>
+</refentry>
+
+
+
diff --git a/doc/src/sgml/reference.sgml b/doc/src/sgml/reference.sgml
index c33d883..1448f47 100644
--- a/doc/src/sgml/reference.sgml
+++ b/doc/src/sgml/reference.sgml
@@ -160,6 +160,7 @@
    &rollbackPrepared;
    &rollbackTo;
    &savepoint;
+   &securityLabel;
    &select;
    &selectInto;
    &set;
diff --git a/src/backend/commands/seclabel.c b/src/backend/commands/seclabel.c
index 5f914fa..0947376 100644
--- a/src/backend/commands/seclabel.c
+++ b/src/backend/commands/seclabel.c
@@ -15,10 +15,18 @@
 #include "catalog/catalog.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
+#include "catalog/namespace.h"
+#include "catalog/pg_inherits_fn.h"
 #include "catalog/pg_seclabel.h"
 #include "commands/seclabel.h"
+#include "miscadmin.h"
+#include "parser/parse_clause.h"
+#include "storage/lmgr.h"
+#include "utils/acl.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
+#include "utils/lsyscache.h"
+#include "utils/memutils.h"
 #include "utils/rel.h"
 #include "utils/tqual.h"
 
@@ -269,3 +277,249 @@ DeleteSecurityLabel(const ObjectAddress *object)
 
 	DeleteLocalSecLabel(object);
 }
+
+/*
+ * External security provider hook
+ */
+static List *esp_relabel_hook_list = NIL;
+
+typedef struct
+{
+	const char				   *tag;
+	check_object_relabel_type	hook;
+} esp_relabel_hook_entry;
+
+void
+register_object_relabel_hook(const char *tag,
+							 check_object_relabel_type hook)
+{
+	esp_relabel_hook_entry *entry;
+	MemoryContext			oldcxt;
+
+	if (!process_shared_preload_libraries_in_progress)
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("unavailable to register security hooks now")));
+
+	oldcxt = MemoryContextSwitchTo(TopMemoryContext);
+
+	entry = palloc(sizeof(esp_relabel_hook_entry));
+	entry->tag = pstrdup(tag);
+	entry->hook = hook;
+
+	esp_relabel_hook_list = lappend(esp_relabel_hook_list, entry);
+
+	MemoryContextSwitchTo(oldcxt);
+}
+
+/*
+ * ExecRelationSecLabel
+ *
+ * It relabels relabel/attribute
+ *
+ */
+static void
+ExecRelationSecLabel(ObjectType objtype, List *nameList,
+					 const char *seclabel,
+					 esp_relabel_hook_entry *esp_entry)
+{
+	List	   *relname = nameList;
+	char	   *attname = NULL;
+	RangeVar   *rel;
+	Oid			relOid;
+	List	   *child_oids;
+	List	   *child_numparents;
+	ListCell   *lo, *li;
+
+	if (objtype == OBJECT_COLUMN)
+	{
+		int		nnames = list_length(nameList);
+
+		if (nnames < 2)
+			elog(ERROR, "must specify relation and attribute");
+
+		attname = strVal(lfirst(list_tail(nameList)));
+		relname = list_truncate(list_copy(nameList), nnames - 1);
+	}
+
+	/*
+	 * Resolve the specified relation
+	 */
+	rel = makeRangeVarFromNameList(relname);
+	relOid = RangeVarGetRelid(rel, false);
+
+	/*
+	 * Build a list of inherited relations, if exists.
+	 * Note that 'child_oids' contains relOid.
+	 */
+	child_oids = find_all_inheritors(relOid,
+									 AccessExclusiveLock,
+									 &child_numparents);
+
+	/*
+	 * Relabel each tables being listed
+	 */
+	forboth (lo, child_oids, li, child_numparents)
+	{
+		ObjectAddress	object;
+		Oid				tableOid = lfirst_oid(lo);
+		Oid				namespaceOid = get_rel_namespace(tableOid);
+		int				expected_parents = lfirst_int(li);
+		AttrNumber		attnum = InvalidAttrNumber;
+
+		switch (objtype)
+		{
+			case OBJECT_TABLE:
+				Assert(attname == NULL);
+				if (get_rel_relkind(tableOid) != RELKIND_RELATION)
+					ereport(ERROR,
+							(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+							 errmsg("\"%s\" is not a table",
+									get_rel_name(tableOid))));
+				break;
+
+			case OBJECT_SEQUENCE:
+				Assert(attname == NULL);
+				if (get_rel_relkind(tableOid) != RELKIND_SEQUENCE)
+					ereport(ERROR,
+							(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+							 errmsg("\"%s\" is not a sequence",
+									get_rel_name(tableOid))));
+				break;
+
+			case OBJECT_VIEW:
+				Assert(attname == NULL);
+				if (get_rel_relkind(tableOid) != RELKIND_VIEW)
+					ereport(ERROR,
+                            (errcode(ERRCODE_WRONG_OBJECT_TYPE),
+							 errmsg("\"%s\" is not a view",
+									get_rel_name(tableOid))));
+				break;
+
+			case OBJECT_COLUMN:
+				Assert(attname != NULL);
+				if (get_rel_relkind(tableOid) != RELKIND_RELATION)
+					ereport(ERROR,
+							(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+							 errmsg("\"%s\" is not a table",
+									get_rel_name(tableOid))));
+				break;
+
+			default:
+				elog(ERROR, "unexpected object type %d", (int)objtype);
+				break;
+		}
+
+		/*
+		 * Resolve the column name, if necessary
+		 */
+		if (attname)
+		{
+			attnum = get_attnum(tableOid, attname);
+			if (attnum == InvalidAttrNumber)
+				ereport(ERROR,
+						(errcode(ERRCODE_UNDEFINED_COLUMN),
+						 errmsg("column \"%s\" of relation \"%s\" does not exist",
+								attname, get_rel_name(tableOid))));
+		}
+
+		/*
+		 * Prevent relabeling system catalogs
+		 */
+		if (!allowSystemTableMods &&
+			(IsSystemNamespace(namespaceOid) || IsToastNamespace(namespaceOid)))
+			ereport(ERROR,
+					(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+					 errmsg("permission denied: \"%s\" is a system catalog",
+							get_rel_name(tableOid))));
+		/*
+		 * Permission checks
+		 */
+		if (!pg_class_ownercheck(tableOid, GetUserId()))
+			aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_CLASS,
+						   get_rel_name(tableOid));
+
+		object.classId	= RelationRelationId;
+		object.objectId = tableOid;
+		object.objectSubId = attnum;
+
+		(*esp_entry->hook)(&object, seclabel, expected_parents);
+
+		/*
+		 * Do actual relabeling
+		 */
+		SetSecurityLabel(&object, esp_entry->tag, seclabel);
+	}
+}
+
+/*
+ * ExecSecLabelStmt
+ *
+ * SECURITY LABEL [FOR <esp>] ON <class> <name> IS <new label>
+ *
+ */
+void
+ExecSecLabelStmt(SecLabelStmt *stmt)
+{
+	esp_relabel_hook_entry	   *esp_entry = NULL;
+	ListCell				   *l;
+
+	/*
+	 * SECURITY LABEL statement needs one or more label based security
+	 * features are available at least.
+	 */
+	if (esp_relabel_hook_list == NIL)
+	{
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("no label based security is available")));
+	}
+
+	/*
+	 * when just one label based security is available, we can omit
+	 * FOR <esp> clause because it is obvious which ESP module handle
+	 * it. But, we have to specify the tag when multiple label based
+	 * securities are available.
+	 */
+	if (!stmt->tag)
+	{
+		if (list_length(esp_relabel_hook_list) > 1)
+			ereport(ERROR,
+					(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+					 errmsg("multiple label based securities are available")));
+
+		esp_entry = linitial(esp_relabel_hook_list);
+	}
+	else
+	{
+		foreach (l, esp_relabel_hook_list)
+		{
+			esp_entry = lfirst(l);
+
+			if (strcmp(stmt->tag, esp_entry->tag) == 0)
+				goto found;
+		}
+		ereport(ERROR,
+				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+				 errmsg("no label based security for the tag: '%s'",
+						stmt->tag)));
+	}
+found:
+
+	switch (stmt->objtype)
+	{
+		case OBJECT_TABLE:
+		case OBJECT_COLUMN:
+		case OBJECT_SEQUENCE:
+		case OBJECT_VIEW:
+			ExecRelationSecLabel(stmt->objtype,
+								 stmt->objname,
+								 stmt->seclabel,
+								 esp_entry);
+			break;
+
+		default:
+			elog(ERROR, "unrecognized object type: %d", (int)stmt->objtype);
+			break;
+	}
+}
diff --git a/src/backend/nodes/copyfuncs.c b/src/backend/nodes/copyfuncs.c
index 9af1217..92d786a 100644
--- a/src/backend/nodes/copyfuncs.c
+++ b/src/backend/nodes/copyfuncs.c
@@ -2605,6 +2605,20 @@ _copyCommentStmt(CommentStmt *from)
 	return newnode;
 }
 
+static SecLabelStmt *
+_copySecLabelStmt(SecLabelStmt *from)
+{
+	SecLabelStmt *newnode = makeNode(SecLabelStmt);
+
+	COPY_SCALAR_FIELD(objtype);
+	COPY_NODE_FIELD(objname);
+	COPY_NODE_FIELD(objargs);
+	COPY_STRING_FIELD(tag);
+	COPY_STRING_FIELD(seclabel);
+
+	return newnode;
+}
+
 static FetchStmt *
 _copyFetchStmt(FetchStmt *from)
 {
@@ -3955,6 +3969,9 @@ copyObject(void *from)
 		case T_CommentStmt:
 			retval = _copyCommentStmt(from);
 			break;
+		case T_SecLabelStmt:
+			retval = _copySecLabelStmt(from);
+			break;
 		case T_FetchStmt:
 			retval = _copyFetchStmt(from);
 			break;
diff --git a/src/backend/nodes/equalfuncs.c b/src/backend/nodes/equalfuncs.c
index 70b3c62..1b84a55 100644
--- a/src/backend/nodes/equalfuncs.c
+++ b/src/backend/nodes/equalfuncs.c
@@ -1163,6 +1163,18 @@ _equalCommentStmt(CommentStmt *a, CommentStmt *b)
 }
 
 static bool
+_equalSecLabelStmt(SecLabelStmt *a, SecLabelStmt *b)
+{
+	COMPARE_SCALAR_FIELD(objtype);
+	COMPARE_NODE_FIELD(objname);
+	COMPARE_NODE_FIELD(objargs);
+	COMPARE_STRING_FIELD(tag);
+	COMPARE_STRING_FIELD(seclabel);
+
+	return true;
+}
+
+static bool
 _equalFetchStmt(FetchStmt *a, FetchStmt *b)
 {
 	COMPARE_SCALAR_FIELD(direction);
@@ -2622,6 +2634,9 @@ equal(void *a, void *b)
 		case T_CommentStmt:
 			retval = _equalCommentStmt(a, b);
 			break;
+		case T_SecLabelStmt:
+			retval = _equalSecLabelStmt(a, b);
+			break;
 		case T_FetchStmt:
 			retval = _equalFetchStmt(a, b);
 			break;
diff --git a/src/backend/parser/gram.y b/src/backend/parser/gram.y
index 1722036..0a92027 100644
--- a/src/backend/parser/gram.y
+++ b/src/backend/parser/gram.y
@@ -204,7 +204,7 @@ static TypeName *TableFuncTypeName(List *columns);
 		CreateFunctionStmt AlterFunctionStmt ReindexStmt RemoveAggrStmt
 		RemoveFuncStmt RemoveOperStmt RenameStmt RevokeStmt RevokeRoleStmt
 		RuleActionStmt RuleActionStmtOrEmpty RuleStmt
-		SelectStmt TransactionStmt TruncateStmt
+		SecLabelStmt SelectStmt TransactionStmt TruncateStmt
 		UnlistenStmt UpdateStmt VacuumStmt
 		VariableResetStmt VariableSetStmt VariableShowStmt
 		ViewStmt CheckPointStmt CreateConversionStmt
@@ -422,6 +422,8 @@ static TypeName *TableFuncTypeName(List *columns);
 %type <str>		OptTableSpace OptConsTableSpace OptTableSpaceOwner
 %type <list>	opt_check_option
 
+%type <str>		label_item opt_esp
+
 %type <target>	xml_attribute_el
 %type <list>	xml_attribute_list xml_attributes
 %type <node>	xml_root_version opt_xml_root_standalone
@@ -498,7 +500,7 @@ static TypeName *TableFuncTypeName(List *columns);
 
 	KEY
 
-	LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
+	LABEL LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
 	LEAST LEFT LEVEL LIKE LIMIT LISTEN LOAD LOCAL LOCALTIME LOCALTIMESTAMP
 	LOCATION LOCK_P LOGIN_P
 
@@ -736,6 +738,7 @@ stmt :
 			| RevokeStmt
 			| RevokeRoleStmt
 			| RuleStmt
+			| SecLabelStmt
 			| SelectStmt
 			| TransactionStmt
 			| TruncateStmt
@@ -4324,6 +4327,61 @@ comment_text:
 			| NULL_P							{ $$ = NULL; }
 		;
 
+
+/*****************************************************************************
+ *
+ * ALTER THING name SECURITY LABEL TO label
+ *
+ *****************************************************************************/
+
+SecLabelStmt: SECURITY LABEL opt_esp ON TABLE any_name IS label_item
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+
+					n->objtype = OBJECT_TABLE;
+					n->objname = $6;
+					n->tag = $3;
+					n->seclabel = $8;
+					$$ = (Node *)n;
+				}
+			| SECURITY LABEL opt_esp ON COLUMN any_name IS label_item
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+
+					n->objtype = OBJECT_COLUMN;
+					n->objname = $6;
+					n->tag = $3;
+					n->seclabel = $8;
+					$$ = (Node *)n;
+				}
+			| SECURITY LABEL opt_esp ON SEQUENCE any_name IS label_item
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+
+					n->objtype = OBJECT_SEQUENCE;
+					n->objname = $6;
+					n->tag = $3;
+					n->seclabel = $8;
+					$$ = (Node *)n;
+				}
+			| SECURITY LABEL opt_esp ON VIEW any_name IS label_item
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+
+					n->objtype = OBJECT_VIEW;
+					n->objname = $6;
+					n->tag = $3;
+					n->seclabel = $8;
+					$$ = (Node *)n;
+				}
+		;
+
+label_item:		Sconst			{ $$ = $1; }
+
+opt_esp:	FOR Sconst		{ $$ = $2; }
+			| /* empty */		{ $$ = NULL; }
+		;
+
 /*****************************************************************************
  *
  *		QUERY:
@@ -10954,6 +11012,7 @@ unreserved_keyword:
 			| INVOKER
 			| ISOLATION
 			| KEY
+			| LABEL
 			| LANGUAGE
 			| LARGE_P
 			| LAST_P
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 1815539..2d3324d 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -218,6 +218,7 @@ check_xact_readonly(Node *parsetree)
 		case T_AlterUserMappingStmt:
 		case T_DropUserMappingStmt:
 		case T_AlterTableSpaceOptionsStmt:
+		case T_SecLabelStmt:
 			PreventCommandIfReadOnly(CreateCommandTag(parsetree));
 			break;
 		default:
@@ -662,6 +663,10 @@ standard_ProcessUtility(Node *parsetree,
 			CommentObject((CommentStmt *) parsetree);
 			break;
 
+		case T_SecLabelStmt:
+			ExecSecLabelStmt((SecLabelStmt *) parsetree);
+			break;
+
 		case T_CopyStmt:
 			{
 				uint64		processed;
@@ -1591,6 +1596,10 @@ CreateCommandTag(Node *parsetree)
 			tag = "COMMENT";
 			break;
 
+		case T_SecLabelStmt:
+			tag = "SECURITY LABEL";
+			break;
+
 		case T_CopyStmt:
 			tag = "COPY";
 			break;
@@ -2313,6 +2322,10 @@ GetCommandLogLevel(Node *parsetree)
 			lev = LOGSTMT_DDL;
 			break;
 
+		case T_SecLabelStmt:
+			lev = LOGSTMT_DDL;
+			break;
+
 		case T_CopyStmt:
 			if (((CopyStmt *) parsetree)->is_from)
 				lev = LOGSTMT_MOD;
diff --git a/src/include/commands/seclabel.h b/src/include/commands/seclabel.h
index b69fc07..088180f 100644
--- a/src/include/commands/seclabel.h
+++ b/src/include/commands/seclabel.h
@@ -10,6 +10,8 @@
 #define SECLABEL_H
 
 #include "catalog/dependency.h"
+#include "nodes/primnodes.h"
+#include "nodes/parsenodes.h"
 
 /*
  * Internal APIs
@@ -21,5 +23,15 @@ extern void  SetSecurityLabel(const ObjectAddress *object,
 							  const char *seclabel);
 extern void  DeleteSecurityLabel(const ObjectAddress *object);
 
-#endif	/* SECLABEL_H */
+/*
+ * Statement and ESP hook support
+ */
+extern void ExecSecLabelStmt(SecLabelStmt *stmt);
 
+typedef void (*check_object_relabel_type)(const ObjectAddress *object,
+										  const char *seclabel,
+										  int expected_parents);
+extern void register_object_relabel_hook(const char *tag,
+										 check_object_relabel_type hook);
+
+#endif	/* SECLABEL_H */
diff --git a/src/include/nodes/nodes.h b/src/include/nodes/nodes.h
index a5f5df5..bad1520 100644
--- a/src/include/nodes/nodes.h
+++ b/src/include/nodes/nodes.h
@@ -347,6 +347,7 @@ typedef enum NodeTag
 	T_AlterUserMappingStmt,
 	T_DropUserMappingStmt,
 	T_AlterTableSpaceOptionsStmt,
+	T_SecLabelStmt,
 
 	/*
 	 * TAGS FOR PARSE TREE NODES (parsenodes.h)
diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h
index fec8d3c..2cf6798 100644
--- a/src/include/nodes/parsenodes.h
+++ b/src/include/nodes/parsenodes.h
@@ -1846,6 +1846,20 @@ typedef struct CommentStmt
 } CommentStmt;
 
 /* ----------------------
+ *				SECURITY LABEL Statemetn
+ * ----------------------
+ */
+typedef struct SecLabelStmt
+{
+	NodeTag		type;
+	ObjectType	objtype;		/* Object's type */
+	List	   *objname;		/* Qualified name of the object */
+	List	   *objargs;		/* Arguments if needed (eg, for functions) */
+	char	   *tag;			/* Identifier of ESP, if specified */
+	char	   *seclabel;		/* New security label to be assigned */
+} SecLabelStmt;
+
+/* ----------------------
  *		Declare Cursor Statement
  *
  * Note: the "query" field of DeclareCursorStmt is only used in the raw grammar
diff --git a/src/include/parser/kwlist.h b/src/include/parser/kwlist.h
index 49d4b6c..13c88a1 100644
--- a/src/include/parser/kwlist.h
+++ b/src/include/parser/kwlist.h
@@ -208,6 +208,7 @@ PG_KEYWORD("isnull", ISNULL, TYPE_FUNC_NAME_KEYWORD)
 PG_KEYWORD("isolation", ISOLATION, UNRESERVED_KEYWORD)
 PG_KEYWORD("join", JOIN, TYPE_FUNC_NAME_KEYWORD)
 PG_KEYWORD("key", KEY, UNRESERVED_KEYWORD)
+PG_KEYWORD("label", LABEL, UNRESERVED_KEYWORD)
 PG_KEYWORD("language", LANGUAGE, UNRESERVED_KEYWORD)
 PG_KEYWORD("large", LARGE_P, UNRESERVED_KEYWORD)
 PG_KEYWORD("last", LAST_P, UNRESERVED_KEYWORD)

diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml
index d2710db..e19cad6 100644
--- a/doc/src/sgml/catalogs.sgml
+++ b/doc/src/sgml/catalogs.sgml
@@ -209,6 +209,11 @@
      </row>
 
      <row>
+      <entry><link linkend="catalog-pg-seclabel"><structname>pg_seclabel</structname></link></entry>
+      <entry>security labels on local database objects</entry>
+     </row>
+
+     <row>
       <entry><link linkend="catalog-pg-shdepend"><structname>pg_shdepend</structname></link></entry>
       <entry>dependencies on shared objects</entry>
      </row>
@@ -4204,6 +4209,91 @@
   </table>
  </sect1>
 
+ <sect1 id="catalog-pg-seclabel">
+  <title><structname>pg_seclabel</structname></title>
+
+  <indexterm zone="catalog-pg-seclabel">
+   <primary>pg_seclabel</primary>
+  </indexterm>
+
+  <para>
+   The catalog <structname>pg_seclabel</structname> stores the security
+   label of database objects. This information allows external security
+   providers to apply label based mandatory access controls.
+  </para>
+
+  <para>
+   When external security providers with label based mandatory access
+   control are installed, its security label shall be assigned on
+   creation of database obejcts.
+   (Please note that only relations are supported right now.)
+  </para>
+  <para>
+   The security labels shall be automatically cleaned up when the database
+   object being labeled is dropped.
+  </para>
+  <para>
+   See also <link linkend="sql-security-label"><command>SECURITY LABEL</command></link>,
+   which provides a functionality to relabel a certain database object,
+   as long as user has enough privileges.
+  </para>
+
+  <table>
+   <title><structname>pg_seclabel</structname> Columns</title>
+
+   <tgroup cols="4">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Type</entry>
+      <entry>References</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><structfield>reloid</structfield></entry>
+      <entry><type>oid</type></entry>
+      <entry><literal><link linkend="catalog-pg-class"><structname>pg_class</structname></link>.oid</literal></entry>
+      <entry>The OID of the system catalog this object appears in</entry>
+     </row>
+
+     <row>
+      <entry><structfield>objoid</structfield></entry>
+      <entry><type>oid</type></entry>
+      <entry>any OID column</entry>
+      <entry>The OID of the object this security label assigned on</entry>
+     </row>
+
+     <row>
+      <entry><structfield>subid</structfield></entry>
+      <entry><type>int4</type></entry>
+      <entry></entry>
+      <entry>For a security label on a table column, this is the column number
+       (the <structfield>objoid</structfield> and <structfield>classoid</structfield>
+       refer to the table itself).  For all other object types, this column is
+       zero
+      </entry>
+     </row>
+
+     <row>
+      <entry><structfield>tag</structfield></entry>
+      <entry><type>text</type></entry>
+      <entry></entry>
+      <entry>identifier of external security provider</entry>
+     </row>
+
+     <row>
+      <entry><structfield>label</structfield></entry>
+      <entry><type>text</type></entry>
+      <entry></entry>
+      <entry>security label in text format</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
 
  <sect1 id="catalog-pg-shdepend">
   <title><structname>pg_shdepend</structname></title>
diff --git a/src/backend/catalog/Makefile b/src/backend/catalog/Makefile
index 82f761d..362b153 100644
--- a/src/backend/catalog/Makefile
+++ b/src/backend/catalog/Makefile
@@ -37,7 +37,7 @@ POSTGRES_BKI_SRCS = $(addprefix $(top_srcdir)/src/include/catalog/,\
 	pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
 	pg_ts_parser.h pg_ts_template.h \
 	pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
-	pg_default_acl.h \
+	pg_default_acl.h pg_seclabel.h \
 	toasting.h indexing.h \
     )
 
diff --git a/src/backend/catalog/dependency.c b/src/backend/catalog/dependency.c
index 12b5d85..b171f01 100644
--- a/src/backend/catalog/dependency.c
+++ b/src/backend/catalog/dependency.c
@@ -57,6 +57,7 @@
 #include "commands/defrem.h"
 #include "commands/proclang.h"
 #include "commands/schemacmds.h"
+#include "commands/seclabel.h"
 #include "commands/tablespace.h"
 #include "commands/trigger.h"
 #include "commands/typecmds.h"
@@ -1010,6 +1011,13 @@ deleteOneObject(const ObjectAddress *object, Relation depRel)
 	DeleteComments(object->objectId, object->classId, object->objectSubId);
 
 	/*
+	 * Delete any security labels associated with this object. (This is also
+	 * a convenient place to do it instead of having every object type know
+	 * to do it.)
+	 */
+	DeleteSecurityLabel(object);
+
+	/*
 	 * CommandCounterIncrement here to ensure that preceding changes are all
 	 * visible to the next deletion step.
 	 */
diff --git a/src/backend/commands/Makefile b/src/backend/commands/Makefile
index a2cc786..17ce32b 100644
--- a/src/backend/commands/Makefile
+++ b/src/backend/commands/Makefile
@@ -17,7 +17,7 @@ OBJS = aggregatecmds.o alter.o analyze.o async.o cluster.o comment.o  \
 	dbcommands.o define.o discard.o explain.o foreigncmds.o functioncmds.o \
 	indexcmds.o lockcmds.o operatorcmds.o opclasscmds.o \
 	portalcmds.o prepare.o proclang.o \
-	schemacmds.o sequence.o tablecmds.o tablespace.o trigger.o \
+	schemacmds.o seclabel.o sequence.o tablecmds.o tablespace.o trigger.o \
 	tsearchcmds.o typecmds.o user.o vacuum.o vacuumlazy.o \
 	variable.o view.o
 
diff --git a/src/backend/commands/seclabel.c b/src/backend/commands/seclabel.c
new file mode 100644
index 0000000..5f914fa
--- /dev/null
+++ b/src/backend/commands/seclabel.c
@@ -0,0 +1,271 @@
+/* -------------------------------------------------------------------------
+ *
+ * seclabel.c
+ *    routines to support security label feature.
+ *
+ * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * -------------------------------------------------------------------------
+ */
+#include "postgres.h"
+
+#include "access/genam.h"
+#include "access/heapam.h"
+#include "catalog/catalog.h"
+#include "catalog/dependency.h"
+#include "catalog/indexing.h"
+#include "catalog/pg_seclabel.h"
+#include "commands/seclabel.h"
+#include "utils/builtins.h"
+#include "utils/fmgroids.h"
+#include "utils/rel.h"
+#include "utils/tqual.h"
+
+/*
+ * GetLocalSecLabel
+ *
+ * It tries to look up a security label entry for the given OID of the
+ * relation, object itself and sub identifier (if needed) from the
+ * pg_seclabel system catalog.
+ * It returns NULL, if no valid entry. Elsewhere, it returns a security
+ * label of the specified object.
+ */
+static char *
+GetLocalSecLabel(const ObjectAddress *object, const char *tag)
+{
+	Relation	pg_seclabel;
+	ScanKeyData	keys[4];
+	SysScanDesc	scan;
+	HeapTuple	tuple;
+	Datum		datum;
+	bool		isnull;
+	char	   *seclabel = NULL;
+
+	ScanKeyInit(&keys[0],
+				Anum_pg_seclabel_reloid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->classId));
+	ScanKeyInit(&keys[1],
+				Anum_pg_seclabel_objoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->objectId));
+	ScanKeyInit(&keys[2],
+				Anum_pg_seclabel_subid,
+				BTEqualStrategyNumber, F_INT4EQ,
+				Int32GetDatum(object->objectSubId));
+	ScanKeyInit(&keys[3],
+				Anum_pg_seclabel_tag,
+				BTEqualStrategyNumber, F_TEXTEQ,
+				CStringGetTextDatum(tag));
+
+	pg_seclabel = heap_open(SecLabelRelationId, AccessShareLock);
+
+	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+							  SnapshotNow, 4, keys);
+
+	tuple = systable_getnext(scan);
+	if (HeapTupleIsValid(tuple))
+	{
+		datum = heap_getattr(tuple, Anum_pg_seclabel_label,
+							 RelationGetDescr(pg_seclabel), &isnull);
+		if (!isnull)
+			seclabel = TextDatumGetCString(datum);
+	}
+	systable_endscan(scan);
+
+	heap_close(pg_seclabel, AccessShareLock);
+
+	return seclabel;
+}
+
+/*
+ * SetLocalSecLabel
+ *
+ * It tries to insert/update/delete a security label for the given OID
+ * of the relation, object itself and sub identifier (if needed) on the
+ * pg_seclabel system catalog.
+ * If given 'new_label' is NULL, it tries to delete the specified entry.
+ * Elsewhere, it tries to insert (if no specified entry now) or update
+ * security label of the specified entry.
+ */
+static void
+SetLocalSecLabel(const ObjectAddress *object,
+				 const char *tag, const char *seclabel)
+{
+	Relation	pg_seclabel;
+	ScanKeyData	keys[4];
+	SysScanDesc	scan;
+	HeapTuple	oldtup;
+	HeapTuple	newtup = NULL;
+	Datum		values[Natts_pg_seclabel];
+	bool		nulls[Natts_pg_seclabel];
+	bool		replaces[Natts_pg_seclabel];
+
+	ScanKeyInit(&keys[0],
+				Anum_pg_seclabel_reloid,
+				BTEqualStrategyNumber, F_OIDEQ,
+                ObjectIdGetDatum(object->classId));
+	ScanKeyInit(&keys[1],
+				Anum_pg_seclabel_objoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->objectId));
+	ScanKeyInit(&keys[2],
+				Anum_pg_seclabel_subid,
+				BTEqualStrategyNumber, F_INT4EQ,
+				Int32GetDatum(object->objectSubId));
+	ScanKeyInit(&keys[3],
+				Anum_pg_seclabel_tag,
+				BTEqualStrategyNumber, F_TEXTEQ,
+				CStringGetTextDatum(tag));
+
+	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+
+	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+							  SnapshotNow, 4, keys);
+
+	oldtup = systable_getnext(scan);
+	if (HeapTupleIsValid(oldtup))
+	{
+		if (seclabel != NULL)
+		{
+			/*
+			 * update the specified security label entry
+			 */
+			memset(nulls, false, sizeof(nulls));
+			memset(replaces, false, sizeof(replaces));
+
+			replaces[Anum_pg_seclabel_label - 1] = true;
+			values[Anum_pg_seclabel_label - 1]
+				= CStringGetTextDatum(seclabel);
+
+			newtup = heap_modify_tuple(oldtup, RelationGetDescr(pg_seclabel),
+									   values, nulls, replaces);
+			simple_heap_update(pg_seclabel, &oldtup->t_self, newtup);
+
+			CatalogUpdateIndexes(pg_seclabel, newtup);
+
+			heap_freetuple(newtup);
+		}
+		else
+		{
+			/*
+			 * when seclabel = NULL, it means to remove the matched
+			 * entry from pg_seclabel.
+			 */
+			simple_heap_delete(pg_seclabel, &oldtup->t_self);
+		}
+	}
+	else if (seclabel != NULL)
+	{
+		/*
+		 * insert a new security label entry
+		 */
+		memset(nulls, false, sizeof(nulls));
+		values[Anum_pg_seclabel_reloid - 1] = ObjectIdGetDatum(object->classId);
+		values[Anum_pg_seclabel_objoid - 1] = ObjectIdGetDatum(object->objectId);
+		values[Anum_pg_seclabel_subid - 1] = Int32GetDatum(object->objectSubId);
+		values[Anum_pg_seclabel_tag - 1] = CStringGetTextDatum(tag);
+		values[Anum_pg_seclabel_label - 1] = CStringGetTextDatum(seclabel);
+
+		newtup = heap_form_tuple(RelationGetDescr(pg_seclabel),
+								 values, nulls);
+		simple_heap_insert(pg_seclabel, newtup);
+
+		CatalogUpdateIndexes(pg_seclabel, newtup);
+
+		heap_freetuple(newtup);
+	}
+	systable_endscan(scan);
+		
+	heap_close(pg_seclabel, RowExclusiveLock);
+}
+
+/*
+ * DeleteLocalSecLabel
+ *
+ * It tries to delete entries of security labels for the given OID
+ * of the relation, object itself and sub identifier (if needed) on
+ * the pg_seclabel system catalog.
+ * If given 'objectSubId' is 0, all security labels matching with
+ * classId and objectId will be removed.
+ */
+static void
+DeleteLocalSecLabel(const ObjectAddress *object)
+{
+	Relation	pg_seclabel;
+	ScanKeyData	keys[3];
+	SysScanDesc	scan;
+	HeapTuple	oldtup;
+	int			nkeys = 0;
+
+	ScanKeyInit(&keys[nkeys++],
+				Anum_pg_seclabel_reloid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->classId));
+	ScanKeyInit(&keys[nkeys++],
+				Anum_pg_seclabel_objoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->objectId));
+	if (object->objectSubId != 0)
+	{
+		ScanKeyInit(&keys[nkeys++],
+					Anum_pg_seclabel_subid,
+					BTEqualStrategyNumber, F_INT4EQ,
+					Int32GetDatum(object->objectSubId));
+	}
+
+	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+
+	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+							  SnapshotNow, nkeys, keys);
+	while (HeapTupleIsValid(oldtup = systable_getnext(scan)))
+	{
+		simple_heap_delete(pg_seclabel, &oldtup->t_self);
+	}
+	systable_endscan(scan);
+
+	heap_close(pg_seclabel, RowExclusiveLock);
+}
+
+/*
+ * GetSecurityLabel
+ *
+ * An internal API to get a security label of the specified object.
+ */
+char *
+GetSecurityLabel(const ObjectAddress *object, const char *tag)
+{
+	Assert(!IsSharedRelation(object->classId));
+
+	return GetLocalSecLabel(object, tag);
+}
+
+/*
+ * SetSecurityLabel
+ *
+ * An internal API to set a security label of the specified object.
+ */
+void
+SetSecurityLabel(const ObjectAddress *object,
+				 const char *tag, const char *seclabel)
+{
+	Assert(!IsSharedRelation(object->classId));
+
+	SetLocalSecLabel(object, tag, seclabel);
+}
+
+/*
+ * DeleteSecurityLabel
+ *
+ * An internal API to delete all the security labels of the specified object.
+ */
+void
+DeleteSecurityLabel(const ObjectAddress *object)
+{
+	/* Right now, nothing to do for the shared relation */
+	if (IsSharedRelation(object->classId))
+		return;
+
+	DeleteLocalSecLabel(object);
+}
diff --git a/src/include/catalog/indexing.h b/src/include/catalog/indexing.h
index 4f437fd..a297402 100644
--- a/src/include/catalog/indexing.h
+++ b/src/include/catalog/indexing.h
@@ -281,6 +281,9 @@ DECLARE_UNIQUE_INDEX(pg_default_acl_oid_index, 828, on pg_default_acl using btre
 DECLARE_UNIQUE_INDEX(pg_db_role_setting_databaseid_rol_index, 2965, on pg_db_role_setting using btree(setdatabase oid_ops, setrole oid_ops));
 #define DbRoleSettingDatidRolidIndexId	2965
 
+DECLARE_UNIQUE_INDEX(pg_seclabel_object_index, 3038, on pg_seclabel using btree(reloid oid_ops, objoid oid_ops, subid int4_ops, tag text_ops));
+#define SecLabelObjectIndexId				3038
+
 /* last step of initialization script: build the indexes declared above */
 BUILD_INDICES
 
diff --git a/src/include/catalog/pg_seclabel.h b/src/include/catalog/pg_seclabel.h
new file mode 100644
index 0000000..7c1255c
--- /dev/null
+++ b/src/include/catalog/pg_seclabel.h
@@ -0,0 +1,43 @@
+/* -------------------------------------------------------------------------
+ *
+ * pg_seclabel.h
+ *    definition of the system "security label" relation (pg_seclabel)
+ *
+ * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * -------------------------------------------------------------------------
+ */
+#ifndef PG_SECLABEL_H
+#define PG_SECLABEL_H
+
+#include "catalog/genbki.h"
+
+/* ----------------
+ *		pg_seclabel definition.  cpp turns this into
+ *		typedef struct FormData_pg_seclabel
+ * ----------------
+ */
+#define SecLabelRelationId		3037
+
+CATALOG(pg_seclabel,3037) BKI_WITHOUT_OIDS
+{
+	Oid			reloid;		/* OID of table containing the object */
+	Oid			objoid;		/* OID of the object itself */
+	int4		subid;		/* column number, or 0 if not used */
+	text		tag;		/* identifier of external security provider */
+	text		label;		/* security label of the object */
+} FormData_pg_seclabel;
+
+/* ----------------
+ *		compiler constants for pg_seclabel
+ * ----------------
+ */
+#define Natts_pg_seclabel			5
+#define Anum_pg_seclabel_reloid		1
+#define Anum_pg_seclabel_objoid		2
+#define Anum_pg_seclabel_subid		3
+#define Anum_pg_seclabel_tag		4
+#define Anum_pg_seclabel_label		5
+
+#endif	/* PG_SECLABEL_H */
diff --git a/src/include/catalog/toasting.h b/src/include/catalog/toasting.h
index fb6f678..fa47938 100644
--- a/src/include/catalog/toasting.h
+++ b/src/include/catalog/toasting.h
@@ -45,6 +45,7 @@ DECLARE_TOAST(pg_constraint, 2832, 2833);
 DECLARE_TOAST(pg_description, 2834, 2835);
 DECLARE_TOAST(pg_proc, 2836, 2837);
 DECLARE_TOAST(pg_rewrite, 2838, 2839);
+DECLARE_TOAST(pg_seclabel, 3039, 3040);
 DECLARE_TOAST(pg_statistic, 2840, 2841);
 DECLARE_TOAST(pg_trigger, 2336, 2337);
 
diff --git a/src/include/commands/seclabel.h b/src/include/commands/seclabel.h
new file mode 100644
index 0000000..b69fc07
--- /dev/null
+++ b/src/include/commands/seclabel.h
@@ -0,0 +1,25 @@
+/*
+ * seclabel.h
+ *
+ * Prototypes for functions in commands/seclabel.c
+ *
+ * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ */
+#ifndef SECLABEL_H
+#define SECLABEL_H
+
+#include "catalog/dependency.h"
+
+/*
+ * Internal APIs
+ */
+extern char *GetSecurityLabel(const ObjectAddress *object,
+							  const char *tag);
+extern void  SetSecurityLabel(const ObjectAddress *object,
+							  const char *tag,
+							  const char *seclabel);
+extern void  DeleteSecurityLabel(const ObjectAddress *object);
+
+#endif	/* SECLABEL_H */
+
diff --git a/src/test/regress/expected/sanity_check.out b/src/test/regress/expected/sanity_check.out
index 1d9e110..9596b0b 100644
--- a/src/test/regress/expected/sanity_check.out
+++ b/src/test/regress/expected/sanity_check.out
@@ -114,6 +114,7 @@ SELECT relname, relhasindex
  pg_pltemplate           | t
  pg_proc                 | t
  pg_rewrite              | t
+ pg_seclabel             | t
  pg_shdepend             | t
  pg_shdescription        | t
  pg_statistic            | t
@@ -153,7 +154,7 @@ SELECT relname, relhasindex
  timetz_tbl              | f
  tinterval_tbl           | f
  varchar_tbl             | f
-(142 rows)
+(143 rows)
 
 --
 -- another sanity check: every system catalog that has OIDs should have

*** a/doc/src/sgml/catalogs.sgml
--- b/doc/src/sgml/catalogs.sgml
***************
*** 209,214 ****
--- 209,219 ----
       </row>
  
       <row>
+       <entry><link linkend="catalog-pg-seclabel"><structname>pg_seclabel</structname></link></entry>
+       <entry>security labels on local database objects</entry>
+      </row>
+ 
+      <row>
        <entry><link linkend="catalog-pg-shdepend"><structname>pg_shdepend</structname></link></entry>
        <entry>dependencies on shared objects</entry>
       </row>
***************
*** 4220,4225 ****
--- 4225,4315 ----
    </table>
   </sect1>
  
+  <sect1 id="catalog-pg-seclabel">
+   <title><structname>pg_seclabel</structname></title>
+ 
+   <indexterm zone="catalog-pg-seclabel">
+    <primary>pg_seclabel</primary>
+   </indexterm>
+ 
+   <para>
+    The catalog <structname>pg_seclabel</structname> stores the security
+    label of database objects. This information allows external security
+    providers to apply label based mandatory access controls.
+   </para>
+ 
+   <para>
+    When external security providers with label based mandatory access
+    control are installed, its security label shall be assigned on
+    creation of database obejcts.
+    (Please note that only relations are supported right now.)
+   </para>
+   <para>
+    The security labels shall be automatically cleaned up when the database
+    object being labeled is dropped.
+   </para>
+   <para>
+    See also <link linkend="sql-security-label"><command>SECURITY LABEL</command></link>,
+    which provides a functionality to relabel a certain database object,
+    as long as user has enough privileges.
+   </para>
+ 
+   <table>
+    <title><structname>pg_seclabel</structname> Columns</title>
+ 
+    <tgroup cols="4">
+     <thead>
+      <row>
+       <entry>Name</entry>
+       <entry>Type</entry>
+       <entry>References</entry>
+       <entry>Description</entry>
+      </row>
+     </thead>
+ 
+     <tbody>
+      <row>
+       <entry><structfield>reloid</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry><literal><link linkend="catalog-pg-class"><structname>pg_class</structname></link>.oid</literal></entry>
+       <entry>The OID of the system catalog this object appears in</entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>objoid</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry>any OID column</entry>
+       <entry>The OID of the object this security label assigned on</entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>subid</structfield></entry>
+       <entry><type>int4</type></entry>
+       <entry></entry>
+       <entry>For a security label on a table column, this is the column number
+        (the <structfield>objoid</structfield> and <structfield>classoid</structfield>
+        refer to the table itself).  For all other object types, this column is
+        zero
+       </entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>tag</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry></entry>
+       <entry>identifier of external security provider</entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>label</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry></entry>
+       <entry>security label in text format</entry>
+      </row>
+     </tbody>
+    </tgroup>
+   </table>
+  </sect1>
  
   <sect1 id="catalog-pg-shdepend">
    <title><structname>pg_shdepend</structname></title>
*** /dev/null
--- b/doc/src/sgml/esp.sgml
***************
*** 0 ****
--- 1,249 ----
+ <chapter id="esp">
+  <title>External Security Provider</title>
+  <para>
+   External security provider (ESP) is a plugin which makes access control
+   decision based on its security model and policy.
+  </para>
+  <para>
+   <productname>PostgreSQL</productname> version 9.1 or later provides a set of
+   facilities to enhance access control features using ESP, in addition to the
+   default database privilege mechanism introduced
+   as the <xref linkend="user-manag">.
+  </para>
+  <para>
+   This chapter introduces brief overview of ESP concept and corresponding
+   features, but it does not introduce details of individual ESP plugins.
+   If you need to know something about a certain ESP plugin, please reference
+   documentation of the plugin.
+  </para>
+ 
+  <sect1 id="esp-overview">
+   <title>Overview</title>
+   <para>
+    The ESP concept was designed to integrate various kind of security
+    models into <productname>PostgreSQL</productname>.
+ 
+    It allows third-party modules to perform as security provider which
+    makes access control decision on accesses to database objects;
+    such as tables, functions and so on.
+ 
+    Please note that it never replaces anything in the default database
+    privilege mechanism. It just installs additional access control stuffs.
+   </para>
+   <para>
+    Access control is a mechanism that decides what actions are allowed
+    or denied on a pair of certain user and object to be referenced,
+    then applies the decision on any requests come from clients.
+   </para>
+   <para>
+    The default database privilege mechanism makes its access control
+    decision based on the authenticated user identifier and permissions
+    of database objects to be referenced.
+   </para>
+   <para>
+    Here are some cases that we hope to make and apply access control
+    decisions based on a different basis from the default one.
+ 
+    For example, one significant goal of ESP is integration of mandatory
+    access control that only allows security administrator to set up
+    access rights of database objects, unlike the default one which
+    allows owner of them to set up their access rights.
+   </para>
+   <para>
+    At the implementation level, <productname>PostgreSQL</productname> 9.1
+    or later provides a series of security hooks which are put on strategic
+    points of core routines; such as a routine that checks permissions of
+    tables and columns for the supplied DML statement.
+   </para>
+   <para>
+    ESP modules shall be invoked via the security hooks, then it can make
+    its access control decision based on the security model and supplied
+    information about user's request; such as OID of tables to be referenced.
+   </para>
+   <para>
+    Expected behaviors are depending on every security hooks.
+ 
+    One hook may assume ESP raises an error, if access control violation.
+    One other hook may assume ESP returns a bool value which informs the
+    caller routine whether its decision was 'allowed' or 'denied'.
+   </para>
+   <para>
+    These hooks shall be filled up when we load plugins.
+ 
+    Administrator can add a configuration of
+    <literal>shared_preload_libraries</literal> on which we specify a few
+    plugins to be loaded on starting up the server process, as follows:
+ 
+ <programlisting>
+ shared_preload_libraries = 'sepgsql'    # (change requires restart)
+ </programlisting>
+ 
+    You should never use <literal>local_preload_libraries</literal> instead,
+    even if the plugin is well verified without any vulnerabilities, because
+    it can be overridden by GUC variable settings passed in startup packet.
+   </para>
+   <para>
+    Please note that ESP framework has quite-limited coverage of access control
+    compared to the default database privilege mechanism right now.
+    In this release, it only hooks on execution of DML, a part of DDL and
+    post client authentication process.
+   </para>
+  </sect1>
+ 
+  <sect1 id="esp-mac">
+   <title>Mandatory Access Control</title>
+   <para>
+    It is a major of ESP to support mandatory access control (MAC) policy
+    in <productname>PostgreSQL</productname>.
+   </para>
+   <para>
+    Unlike discretionary access control (DAC), only a security administrator
+    is allowed to control centralized MAC policy and access rights on
+    individual objects; it means any other users don't have ability to change
+    the access rights on database objects, even if they have ownership of the
+    object.
+   </para>
+   <para>
+    This characteristic enables to confine classified information in certain
+    domains, even if owner of data tries to leak it somewhere, because the
+    owner cannot change its access rights as he like.
+   </para>
+   <para>
+    Here is a a traditional rule for instance. It prevents people who can
+    read both of classified and unclassified data object to write unclassified
+    data object. It means infomation moves only single direction; from
+    unclassified to classified. Since this rule is applied to everybody,
+    noboby can leak classified information into unclassified ones, even if
+    a malicious internal tries to do.
+   </para>
+   <para>
+    MAC is designed to tackle such a strict security requirement.
+   </para>
+ 
+   <sect2 id="esp-mac-label">
+    <title>Security Label</title>
+    <para>
+     In the default database privileges, <command>GRANT</command> and
+     <command>REVOKE</command> commands allow superusers and owner of the
+     database obejcts to set up access permissions, then it makes access
+     control decision based on these properties.
+    </para>
+    <para>
+     On the other hand, MAC model also has a property that characterizes
+     database objects from the viewpoint of MAC. A typical MAC feature uses
+     security label to identify the objects. It is a short text with a format
+     according to the security model.
+    </para>
+    <para>
+     The following examples are security label in SELinux.
+     It contains all the needed properties to make access control decision
+     from the viewpoint of SELinux, like a pair of access permissions and
+     owner identifier of the database object.
+ <synopsis>
+ dbadm_u:system_r:postgresql_t:s0
+ 
+ system_u:object_r:sepgsql_table_t:s0:c0
+ </synopsis>
+    </para>
+    <para>
+     It also means MAC model cannot make its access control decision on accesses
+     to database objects without security labels. So, we need to assign a certain
+     security label on database objects to be referenced.
+    </para>
+    <para>
+     In addition, MAC model also represents privilege set of user as a security
+     label, instead of user identifier. Mostly, security label of the users are
+     assigned according to the result of authentication.
+    </para>
+    <para>
+     In other words, MAC mechanism is something like a function which returns
+     a binary state ('allowed' or 'denied') for the supplied actions and
+     security labels of user and object to be referenced.
+    </para>
+    <para>
+     DAC mechanism (ie; the default database privilege mechanism) is also like
+     a function which returns a binary state for the supplied actions, user
+     identifier and permissions on the object to be referenced, so they are not
+     fundamentally difference.
+    </para>
+   </sect2>
+   <sect2 id="esp-mac-label-manage">
+    <title>Management of security label</title>
+    <para>
+     As we introduced above, MAC mechanism needs both of user and object to be
+     labeled, to make its access control decision.
+    </para>
+    <para>
+     For database objects, <productname>PostgreSQL</productname> provides
+     a facility that enables to assign a security label on them.
+ 
+     When an ESP plugin of MAC is installed, it shall assign a default security
+     label of a new database object on its creation time.
+ 
+     In addition, user can relabel security label of database objects using
+     <xref linkend="SQL-SECURITY-LABEL"> command later, as long as this
+     operation is allowed by security mechanisms.
+    </para>
+    <para>
+     The following example creates a new table <literal>tbl</literal> on the
+     system with <productname>SELinux</productname> support using ESP.
+ <screen>
+ postgres=> CREATE TABLE tbl (x int, y text);
+ CREATE TABLE
+ postgres=> SELECT * FROM pg_seclabel WHERE objoid = 'tbl'::regclass and subid=0;
+  reloid | objoid | subid |   tag   |                label
+ --------+--------+-------+---------+--------------------------------------
+    1259 |  24600 |     0 | selinux | system_u:object_r:sepgsql_table_t:s0
+ (1 row)
+ </screen>
+     It shows us that <literal>system_u:object_r:sepgsql_table_t:s0</literal>
+     was assigned on the creation time of table <literal>tbl</literal>.
+ <screen>
+ postgres=> SECURITY LABEL ON TABLE tbl IS 'system_u:object_r:sepgsql_ro_table_t:s0';
+ SECURITY LABEL
+ postgres=> SELECT * FROM pg_seclabel WHERE objoid = 'tbl'::regclass and subid=0;
+  reloid | objoid | subid |   tag   |                  label
+ --------+--------+-------+---------+-----------------------------------------
+    1259 |  24600 |     0 | selinux | system_u:object_r:sepgsql_ro_table_t:s0
+ (1 row)
+ </screen>
+     It also shows us <command>SECURITY LABEL</command> command allows to relabel
+     the table to <literal>system_u:object_r:sepgsql_ro_table_t:s0</literal>.
+    </para>
+    <para>
+     The
+     <link linkend="catalog-pg-seclabel">
+      <structname>pg_seclabel</structname>
+     </link>
+     is a system catalog to store
+     security labels, and ESP plugins shall reference the catalog to fetch
+     them on making its access control decisions.
+    </para>
+    <para>
+     On the other hand, the way to assign a security label of user is depending
+     on the type of ESP plugin.
+ 
+     Perhaps, one plugin may associates a security label with authenticated
+     database user, and other plugin assigns a security label which is retrieved
+     from the peer process using system API.
+ 
+     So, <productname>PostgreSQL</productname> does not constrain ESP plugins
+     a certain way to retrive security label of users.
+     It provides a hook just after the database authentication, ESP plugin can
+     assign a security label on the current session with its own way.
+    </para>
+    <para>
+     When we backup and restore databases, security labels are also properties
+     of database objects to be handled correctly.
+ 
+     The <command>pg_dump</command> and <command>pg_dumpall</command> support
+     <literal>--security-label</literal> option that enables to include
+     security label of the database objects into archives.
+ 
+     And the <command>pg_restore</command> also supports
+     <literal>--no-security-label</literal> option that enables to ignore
+     security labels, even if the archives contains labels.
+    </para>
+   </sect2>
+  </sect1>
+ </chapter>
*** a/doc/src/sgml/external-projects.sgml
--- b/doc/src/sgml/external-projects.sgml
***************
*** 250,254 ****
--- 250,266 ----
     <application><ulink url="http://www.pgadmin.org/">pgAdmin III</ulink></>, 
     and there are several commercially available ones as well.
    </para>
+ 
+   <para>
+    The <xref linkend="esp"> introduces how <productname>PostgreSQL</>
+    integrate additional security features using external security
+    providers.
+ 
+    <application><ulink url="http://code.google.com/p/sepgsql/">
+      SE-PostgreSQL
+    </ulink></application> is an external security provider which
+    applies mandatory access control based on the centralized
+    security policy of operation system.
+   </para>
   </sect1>
  </appendix>
*** a/doc/src/sgml/filelist.sgml
--- b/doc/src/sgml/filelist.sgml
***************
*** 46,51 ****
--- 46,52 ----
  <!entity runtime       SYSTEM "runtime.sgml">
  <!entity config        SYSTEM "config.sgml">
  <!entity user-manag    SYSTEM "user-manag.sgml">
+ <!entity esp           SYSTEM "esp.sgml">
  <!entity wal           SYSTEM "wal.sgml">
  
  <!-- programmer's guide -->
*** a/doc/src/sgml/postgres.sgml
--- b/doc/src/sgml/postgres.sgml
***************
*** 150,155 ****
--- 150,156 ----
    &config;
    &client-auth;
    &user-manag;
+   &esp;
    &manage-ag;
    &charset;
    &maintenance;
*** a/doc/src/sgml/ref/allfiles.sgml
--- b/doc/src/sgml/ref/allfiles.sgml
***************
*** 132,137 **** Complete list of usable sgml source files in this directory.
--- 132,138 ----
  <!entity rollbackPrepared   system "rollback_prepared.sgml">
  <!entity rollbackTo         system "rollback_to.sgml">
  <!entity savepoint          system "savepoint.sgml">
+ <!entity securityLabel      system "seclabel.sgml">
  <!entity select             system "select.sgml">
  <!entity selectInto         system "select_into.sgml">
  <!entity set                system "set.sgml">
*** a/doc/src/sgml/ref/pg_dump.sgml
--- b/doc/src/sgml/ref/pg_dump.sgml
***************
*** 778,783 **** PostgreSQL documentation
--- 778,793 ----
         </para>
        </listitem>
       </varlistentry>
+ 
+      <varlistentry>
+       <term><option>--security-label</option></term>
+       <listitem>
+        <para>
+         With this option, it also outputs security labels of database
+         objects to be dumped, if labeled.
+        </para>
+       </listitem>
+      </varlistentry>
      </variablelist>
     </para>
   </refsect1>
*** a/doc/src/sgml/ref/pg_dumpall.sgml
--- b/doc/src/sgml/ref/pg_dumpall.sgml
***************
*** 493,498 **** PostgreSQL documentation
--- 493,507 ----
         </para>
        </listitem>
       </varlistentry>
+      <varlistentry>
+       <term><option>--security-label</option></term>
+       <listitem>
+        <para>
+         With this option, it also outputs security labels of database
+         objects to be dumped, if labeled.
+        </para>
+       </listitem>
+      </varlistentry>
     </variablelist>
    </para>
   </refsect1>
*** a/doc/src/sgml/ref/pg_restore.sgml
--- b/doc/src/sgml/ref/pg_restore.sgml
***************
*** 329,334 ****
--- 329,347 ----
       </varlistentry>
  
       <varlistentry>
+       <term><option>--no-security-label</option></term>
+       <listitem>
+        <para>
+         Do not output commands to relabel database objects,
+         even if the archive contains them.
+         With this option, all objects will be created with a default
+         security label, or without any labels if no label based
+         security feature is not installed.
+        </para>
+       </listitem>
+      </varlistentry>
+ 
+      <varlistentry>
        <term><option>-P <replaceable class="parameter">function-name(argtype [, ...])</replaceable></option></term>
        <term><option>--function=<replaceable class="parameter">function-name(argtype [, ...])</replaceable></option></term>
        <listitem>
*** /dev/null
--- b/doc/src/sgml/ref/seclabel.sgml
***************
*** 0 ****
--- 1,123 ----
+ <refentry id="SQL-SECURITY-LABEL">
+  <refmeta>
+   <refentrytitle>SECURITY LABEL</refentrytitle>
+   <manvolnum>7</manvolnum>
+   <refmiscinfo>SQL - Language Statements</refmiscinfo>
+  </refmeta>
+ 
+  <refnamediv>
+   <refname>SECURITY LABEL</refname>
+   <refpurpose>relabel the security label of an object</refpurpose>
+  </refnamediv>
+ 
+  <indexterm zone="sql-security-label">
+   <primary>SECURITY LABEL</primary>
+  </indexterm>
+ 
+  <refsynopsisdiv>
+ <synopsis>
+ SECURITY LABEL [ FOR '<replaceable class="PARAMETER">esp_tag</replaceable>' ] ON
+ {
+   TABLE <replaceable class="PARAMETER">object_name</replaceable> |
+   COLUMN <replaceable class="PARAMETER">table_name</replaceable>.<replaceable class="PARAMETER">column_name</replaceable> |
+   SEQUENCE <replaceable class="PARAMETER">object_name</replaceable> |
+   VIEW <replaceable class="PARAMETER">object_name</replaceable>
+ } IS '<replaceable class="PARAMETER">security_label</replaceable>';
+ </synopsis>
+  </refsynopsisdiv>
+ 
+  <refsect1>
+   <title>Description</title>
+ 
+   <para>
+    <command>SECURITY LABEL</command> relabels a security label of a database object.
+   </para>
+ 
+   <para>
+    We can assign individual security labels on a certain database object for
+    each security providers, using <command>SECURITY LABEL</command> command.
+   </para>
+   <para>
+    Security labels are automatically assigned when the object is created,
+    and also automatically dropped when the object is dropped.
+   </para>
+ 
+  </refsect1>
+ 
+  <refsect1>
+   <title>Parameters</title>
+   <variablelist>
+    <varlistentry>
+     <term><replaceable class="parameter">object_name</replaceable></term>
+     <term><replaceable class="parameter">table_name</replaceable></term>
+     <term><replaceable class="parameter">table_name.column_name</replaceable></term>
+     <listitem>
+      <para>
+       The name of the object to be relabeled.  Names of tables, columns,
+       sequences and views can be schema-qualified.
+      </para>
+     </listitem>
+    </varlistentry>
+ 
+    <varlistentry>
+     <term><replaceable class="parameter">security_label</replaceable></term>
+     <listitem>
+      <para>
+       The new security label as a string literal.
+      </para>
+      <para>
+       It shall be validated by one of the label based security features,
+       in addition to its permission checks relabeling on the specified
+       database objects.
+      </para>
+     </listitem>
+    </varlistentry>
+ 
+    <varlistentry>
+     <term><replaceable class="parameter">esp_tag</replaceable></term>
+     <listitem>
+      <para>
+       The identifier string of external security provider.
+      </para>
+      <para>
+       When we install just one provider, we can omit this clause because
+       it is obvious which provider shall handle the given security label.
+       Elsewhere, when we install two or more providers concurrently,
+       we need to identify a certain external security provider.
+      </para>
+     </listitem>
+    </varlistentry>
+   </variablelist>
+  </refsect1>
+ 
+  <refsect1>
+   <title>Notes</title>
+   <para>
+    This feature requires one label based mandatory access control feature
+    to be installed at least, because a security label is specific for
+    each providers, so it has to be validated when we relabel it.
+   </para>
+  </refsect1>
+ 
+  <refsect1>
+   <title>Examples</title>
+ 
+   <para>
+    Relabel a security label on the table to '<literal>system_u:object_r:sepgsql_table_t:s0</literal>'.
+ 
+ <programlisting>
+ SECURITY LABEL FOR 'selinux' ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';
+ </programlisting>
+   </para>
+  </refsect1>
+ 
+  <refsect1>
+   <title>Compatibility</title>
+   <para>
+    There is no <command>SECURITY LABEL</command> command in the SQL standard.
+   </para>
+  </refsect1>
+ </refentry>
+ 
+ 
+ 
*** a/doc/src/sgml/reference.sgml
--- b/doc/src/sgml/reference.sgml
***************
*** 160,165 ****
--- 160,166 ----
     &rollbackPrepared;
     &rollbackTo;
     &savepoint;
+    &securityLabel;
     &select;
     &selectInto;
     &set;
*** a/src/backend/catalog/Makefile
--- b/src/backend/catalog/Makefile
***************
*** 38,44 **** POSTGRES_BKI_SRCS = $(addprefix $(top_srcdir)/src/include/catalog/,\
  	pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
  	pg_ts_parser.h pg_ts_template.h \
  	pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
! 	pg_default_acl.h \
  	toasting.h indexing.h \
      )
  
--- 38,44 ----
  	pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
  	pg_ts_parser.h pg_ts_template.h \
  	pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
! 	pg_default_acl.h pg_seclabel.h \
  	toasting.h indexing.h \
      )
  
*** a/src/backend/catalog/dependency.c
--- b/src/backend/catalog/dependency.c
***************
*** 57,62 ****
--- 57,63 ----
  #include "commands/defrem.h"
  #include "commands/proclang.h"
  #include "commands/schemacmds.h"
+ #include "commands/seclabel.h"
  #include "commands/tablespace.h"
  #include "commands/trigger.h"
  #include "commands/typecmds.h"
***************
*** 1010,1015 **** deleteOneObject(const ObjectAddress *object, Relation depRel)
--- 1011,1023 ----
  	DeleteComments(object->objectId, object->classId, object->objectSubId);
  
  	/*
+ 	 * Delete any security labels associated with this object. (This is also
+ 	 * a convenient place to do it instead of having every object type know
+ 	 * to do it.)
+ 	 */
+ 	DeleteSecurityLabel(object);
+ 
+ 	/*
  	 * CommandCounterIncrement here to ensure that preceding changes are all
  	 * visible to the next deletion step.
  	 */
*** a/src/backend/commands/Makefile
--- b/src/backend/commands/Makefile
***************
*** 17,23 **** OBJS = aggregatecmds.o alter.o analyze.o async.o cluster.o comment.o  \
  	dbcommands.o define.o discard.o explain.o foreigncmds.o functioncmds.o \
  	indexcmds.o lockcmds.o operatorcmds.o opclasscmds.o \
  	portalcmds.o prepare.o proclang.o \
! 	schemacmds.o sequence.o tablecmds.o tablespace.o trigger.o \
  	tsearchcmds.o typecmds.o user.o vacuum.o vacuumlazy.o \
  	variable.o view.o
  
--- 17,23 ----
  	dbcommands.o define.o discard.o explain.o foreigncmds.o functioncmds.o \
  	indexcmds.o lockcmds.o operatorcmds.o opclasscmds.o \
  	portalcmds.o prepare.o proclang.o \
! 	schemacmds.o seclabel.o sequence.o tablecmds.o tablespace.o trigger.o \
  	tsearchcmds.o typecmds.o user.o vacuum.o vacuumlazy.o \
  	variable.o view.o
  
*** /dev/null
--- b/src/backend/commands/seclabel.c
***************
*** 0 ****
--- 1,416 ----
+ /* -------------------------------------------------------------------------
+  *
+  * seclabel.c
+  *    routines to support security label feature.
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  *
+  * -------------------------------------------------------------------------
+  */
+ #include "postgres.h"
+ 
+ #include "access/genam.h"
+ #include "access/heapam.h"
+ #include "catalog/catalog.h"
+ #include "catalog/indexing.h"
+ #include "catalog/pg_seclabel.h"
+ #include "commands/seclabel.h"
+ #include "miscadmin.h"
+ #include "utils/acl.h"
+ #include "utils/builtins.h"
+ #include "utils/fmgroids.h"
+ #include "utils/lsyscache.h"
+ #include "utils/memutils.h"
+ #include "utils/tqual.h"
+ 
+ /*
+  * GetSecurityLabel
+  *
+  * It tries to look up a security label entry for the given OID of
+  * the catalog, object itself and sub identifier (if needed) from
+  * the pg_selabel system catalog.
+  * It can return NULL, if no valid entry. Elsewhere, it returns
+  * a security label of the specified database object.
+  */
+ char *
+ GetSecurityLabel(const ObjectAddress *object, const char *tag)
+ {
+ 	Relation	pg_seclabel;
+ 	ScanKeyData	keys[4];
+ 	SysScanDesc	scan;
+ 	HeapTuple	tuple;
+ 	Datum		datum;
+ 	bool		isnull;
+ 	char	   *seclabel = NULL;
+ 
+ 	Assert(!IsSharedRelation(object->classId));
+ 
+ 	ScanKeyInit(&keys[0],
+ 				Anum_pg_seclabel_reloid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->classId));
+ 	ScanKeyInit(&keys[1],
+ 				Anum_pg_seclabel_objoid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->objectId));
+ 	ScanKeyInit(&keys[2],
+ 				Anum_pg_seclabel_subid,
+ 				BTEqualStrategyNumber, F_INT4EQ,
+ 				Int32GetDatum(object->objectSubId));
+ 	ScanKeyInit(&keys[3],
+ 				Anum_pg_seclabel_tag,
+ 				BTEqualStrategyNumber, F_TEXTEQ,
+ 				CStringGetTextDatum(tag));
+ 
+ 	pg_seclabel = heap_open(SecLabelRelationId, AccessShareLock);
+ 
+ 	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+ 							  SnapshotNow, 4, keys);
+ 
+ 	tuple = systable_getnext(scan);
+ 	if (HeapTupleIsValid(tuple))
+ 	{
+ 		datum = heap_getattr(tuple, Anum_pg_seclabel_label,
+ 							 RelationGetDescr(pg_seclabel), &isnull);
+ 		if (!isnull)
+ 			seclabel = TextDatumGetCString(datum);
+ 	}
+ 	systable_endscan(scan);
+ 
+ 	heap_close(pg_seclabel, AccessShareLock);
+ 
+ 	return seclabel;
+ }
+ 
+ /*
+  * SetSecurityLabel
+  *
+  * It tries to insert/update/delete a security label for the given OID
+  * of the catalog, object itself and sub identifier (if needed) on the
+  * pg_seclabel system catalog.
+  * If given 'seclabel' is NULL, it tries to delete the specified entry.
+  * Elsewhere, it tries to insert (if no specified entry now) or updata
+  * security label of the specified entry.
+  */
+ void
+ SetSecurityLabel(const ObjectAddress *object,
+ 				 const char *tag, const char *seclabel)
+ {
+ 	Relation	pg_seclabel;
+ 	ScanKeyData	keys[4];
+ 	SysScanDesc	scan;
+ 	HeapTuple	oldtup;
+ 	HeapTuple	newtup = NULL;
+ 	Datum		values[Natts_pg_seclabel];
+ 	bool		nulls[Natts_pg_seclabel];
+ 	bool		replaces[Natts_pg_seclabel];
+ 
+ 	Assert(!IsSharedRelation(object->classId));
+ 
+ 	ScanKeyInit(&keys[0],
+ 				Anum_pg_seclabel_reloid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+                 ObjectIdGetDatum(object->classId));
+ 	ScanKeyInit(&keys[1],
+ 				Anum_pg_seclabel_objoid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->objectId));
+ 	ScanKeyInit(&keys[2],
+ 				Anum_pg_seclabel_subid,
+ 				BTEqualStrategyNumber, F_INT4EQ,
+ 				Int32GetDatum(object->objectSubId));
+ 	ScanKeyInit(&keys[3],
+ 				Anum_pg_seclabel_tag,
+ 				BTEqualStrategyNumber, F_TEXTEQ,
+ 				CStringGetTextDatum(tag));
+ 
+ 	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+ 
+ 	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+ 							  SnapshotNow, 4, keys);
+ 
+ 	oldtup = systable_getnext(scan);
+ 	if (HeapTupleIsValid(oldtup))
+ 	{
+ 		if (seclabel != NULL)
+ 		{
+ 			/*
+ 			 * update the specified security label entry
+ 			 */
+ 			memset(nulls, false, sizeof(nulls));
+ 			memset(replaces, false, sizeof(replaces));
+ 
+ 			replaces[Anum_pg_seclabel_label - 1] = true;
+ 			values[Anum_pg_seclabel_label - 1]
+ 				= CStringGetTextDatum(seclabel);
+ 
+ 			newtup = heap_modify_tuple(oldtup, RelationGetDescr(pg_seclabel),
+ 									   values, nulls, replaces);
+ 			simple_heap_update(pg_seclabel, &oldtup->t_self, newtup);
+ 
+ 			CatalogUpdateIndexes(pg_seclabel, newtup);
+ 
+ 			heap_freetuple(newtup);
+ 		}
+ 		else
+ 		{
+ 			/*
+ 			 * when seclabel = NULL, it means to remove the matched
+ 			 * entry from pg_seclabel.
+ 			 */
+ 			simple_heap_delete(pg_seclabel, &oldtup->t_self);
+ 		}
+ 	}
+ 	else if (seclabel != NULL)
+ 	{
+ 		/*
+ 		 * insert a new security label entry
+ 		 */
+ 		memset(nulls, false, sizeof(nulls));
+ 		values[Anum_pg_seclabel_reloid - 1] = ObjectIdGetDatum(object->classId);
+ 		values[Anum_pg_seclabel_objoid - 1] = ObjectIdGetDatum(object->objectId);
+ 		values[Anum_pg_seclabel_subid - 1] = Int32GetDatum(object->objectSubId);
+ 		values[Anum_pg_seclabel_tag - 1] = CStringGetTextDatum(tag);
+ 		values[Anum_pg_seclabel_label - 1] = CStringGetTextDatum(seclabel);
+ 
+ 		newtup = heap_form_tuple(RelationGetDescr(pg_seclabel),
+ 								 values, nulls);
+ 		simple_heap_insert(pg_seclabel, newtup);
+ 
+ 		CatalogUpdateIndexes(pg_seclabel, newtup);
+ 
+ 		heap_freetuple(newtup);
+ 	}
+ 	systable_endscan(scan);
+ 		
+ 	heap_close(pg_seclabel, RowExclusiveLock);
+ }
+ 
+ /*
+  * DeleteSecurityLabel
+  *
+  * It tries to delete entries of security labels for given OID of
+  * the catalog, object itself and sub identifier (if needed) on
+  * the pg_seclabel system catalog.
+  * If given 'objectSubId' is 0, all the security labels matching
+  * with classId and objectId will be removed.
+  */
+ void
+ DeleteSecurityLabel(const ObjectAddress *object)
+ {
+ 	Relation	pg_seclabel;
+ 	ScanKeyData	keys[3];
+ 	SysScanDesc	scan;
+ 	HeapTuple	oldtup;
+ 	int			nkeys = 2;
+ 
+ 	/*
+ 	 * right now, we have obviously nothing to do on shared database
+ 	 * object deletion
+ 	 */
+ 	if (IsSharedRelation(object->classId))
+ 		return;
+ 
+ 	ScanKeyInit(&keys[0],
+ 				Anum_pg_seclabel_reloid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->classId));
+ 	ScanKeyInit(&keys[1],
+ 				Anum_pg_seclabel_objoid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->objectId));
+ 	if (object->objectSubId != 0)
+ 	{
+ 		ScanKeyInit(&keys[2],
+ 					Anum_pg_seclabel_subid,
+ 					BTEqualStrategyNumber, F_INT4EQ,
+ 					Int32GetDatum(object->objectSubId));
+ 		nkeys = 3;
+ 	}
+ 
+ 	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+ 
+ 	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+ 							  SnapshotNow, nkeys, keys);
+ 	while (HeapTupleIsValid(oldtup = systable_getnext(scan)))
+ 	{
+ 		simple_heap_delete(pg_seclabel, &oldtup->t_self);
+ 	}
+ 	systable_endscan(scan);
+ 
+ 	heap_close(pg_seclabel, RowExclusiveLock);
+ }
+ 
+ /*
+  * External security provider hook
+  */
+ static List *esp_relabel_hook_list = NIL;
+ 
+ typedef struct
+ {
+ 	const char				   *tag;
+ 	check_object_relabel_type	hook;
+ } esp_relabel_hook_entry;
+ 
+ void
+ register_object_relabel_hook(const char *tag,
+ 							 check_object_relabel_type hook)
+ {
+ 	esp_relabel_hook_entry *entry;
+ 	MemoryContext			oldcxt;
+ 
+ 	oldcxt = MemoryContextSwitchTo(TopMemoryContext);
+ 
+ 	entry = palloc(sizeof(esp_relabel_hook_entry));
+ 	entry->tag = pstrdup(tag);
+ 	entry->hook = hook;
+ 
+ 	esp_relabel_hook_list = lappend(esp_relabel_hook_list, entry);
+ 
+ 	MemoryContextSwitchTo(oldcxt);
+ }
+ 
+ /*
+  * check_relation_relabel 
+  *
+  * It checks whether the user is allowed to relabel this relation
+  */
+ static void
+ check_relation_relabel(int objtype, Relation relation)
+ {
+ 	/*
+ 	 * check object ownership
+ 	 */
+ 	if (!pg_class_ownercheck(RelationGetRelid(relation), GetUserId()))
+ 		aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_CLASS,
+ 					   RelationGetRelationName(relation));
+ 
+ 	/*
+ 	 * next, verify that the relation type matches the intent
+ 	 */
+ 	switch (objtype)
+ 	{
+ 		case OBJECT_TABLE:
+ 		case OBJECT_COLUMN:
+ 			if (relation->rd_rel->relkind != RELKIND_RELATION)
+ 				ereport(ERROR,
+ 						(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ 						 errmsg("\"%s\" is not a table",
+ 								RelationGetRelationName(relation))));
+ 			break;
+ 
+ 		case OBJECT_SEQUENCE:
+ 			if (relation->rd_rel->relkind != RELKIND_SEQUENCE)
+ 				ereport(ERROR,
+ 						(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ 						 errmsg("\"%s\" is not a sequence",
+ 								RelationGetRelationName(relation))));
+ 			break;
+ 
+ 		case OBJECT_VIEW:
+ 			if (relation->rd_rel->relkind != RELKIND_VIEW)
+ 				ereport(ERROR,
+ 						(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ 						 errmsg("\"%s\" is not a view",
+ 								RelationGetRelationName(relation))));
+ 			break;
+ 	}
+ }
+ 
+ /*
+  * ExecSecLabelStmt
+  *
+  * SECURITY LABEL [FOR <esp>] ON <class> <name> IS <new label>
+  */
+ void
+ ExecSecLabelStmt(SecLabelStmt *stmt)
+ {
+ 	esp_relabel_hook_entry *esp_entry = NULL;
+ 	ObjectAddress			address;
+ 	Relation				relation;
+ 	ListCell			   *l;
+ 
+ 	/*
+ 	 * SECURITY LABEL statement needs a label based security feature is
+ 	 * available at least.
+ 	 */
+ 	if (esp_relabel_hook_list == NIL)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("no label based security is available")));
+ 
+ 	/*
+ 	 * when just one label based security is available, we can omit
+ 	 * FOR <esp> clause because it is obvious which ESP module handles
+ 	 * it. But, we have to specify the tag when multiple label based
+ 	 * securities are available.
+ 	 */
+ 	if (!stmt->tag)
+ 	{
+ 		if (list_length(esp_relabel_hook_list) > 1)
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 					 errmsg("multiple label based securities are available")));
+ 
+ 		esp_entry = linitial(esp_relabel_hook_list);
+ 	}
+ 	else
+ 	{
+ 		foreach (l, esp_relabel_hook_list)
+ 		{
+ 			esp_entry = lfirst(l);
+ 
+ 			if (strcmp(stmt->tag, esp_entry->tag) == 0)
+ 				goto found;
+ 		}
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("no label based security for the tag: '%s'",
+ 						stmt->tag)));
+ 	}
+ 
+ found:
+ 	/*
+ 	 * Translate the parser representation which identifies this object
+ 	 * into ObjectAddress. get_object_address() will throw an error if
+      * the object does not exist, and will also acquire a lock on the
+      * target to guard against concurrent DROP operations.
+ 	 */
+ 	address = get_object_address(stmt->objtype, stmt->objname, stmt->objargs,
+ 								 &relation, ShareUpdateExclusiveLock);
+ 
+ 	/*
+ 	 * Privilege and integrity checks
+ 	 */
+ 	switch (stmt->objtype)
+ 	{
+ 		case OBJECT_SEQUENCE:
+ 		case OBJECT_TABLE:
+ 		case OBJECT_VIEW:
+ 		case OBJECT_COLUMN:
+ 			check_relation_relabel(stmt->objtype, relation);
+ 			break;
+ 
+ 		default:
+ 			elog(ERROR, "unrecognized object type: %d",
+ 				 (int)stmt->objtype);
+ 	}
+ 
+ 	Assert(esp_entry->hook != NULL);
+ 	(*esp_entry->hook)(&address, stmt->seclabel);
+ 
+ 	/*
+ 	 * Do actual relabeling. 
+ 	 */
+ 	SetSecurityLabel(&address, esp_entry->tag, stmt->seclabel);
+ 
+ 	/*
+ 	 * If get_object_address() opened the relation for us, we close it to keep
+ 	 * the reference count correct - but we retain any locks acquired by
+ 	 * get_object_address() until commit time, to guard against concurrent
+ 	 * activity.
+ 	 */
+ 	if (relation != NULL)
+ 		relation_close(relation, NoLock);
+ }
*** a/src/backend/nodes/copyfuncs.c
--- b/src/backend/nodes/copyfuncs.c
***************
*** 2607,2612 **** _copyCommentStmt(CommentStmt *from)
--- 2607,2626 ----
  	return newnode;
  }
  
+ static SecLabelStmt *
+ _copySecLabelStmt(SecLabelStmt *from)
+ {
+ 	SecLabelStmt *newnode = makeNode(SecLabelStmt);
+ 
+ 	COPY_SCALAR_FIELD(objtype);
+ 	COPY_NODE_FIELD(objname);
+ 	COPY_NODE_FIELD(objargs);
+ 	COPY_STRING_FIELD(tag);
+ 	COPY_STRING_FIELD(seclabel);
+ 
+ 	return newnode;
+ }
+ 
  static FetchStmt *
  _copyFetchStmt(FetchStmt *from)
  {
***************
*** 3958,3963 **** copyObject(void *from)
--- 3972,3980 ----
  		case T_CommentStmt:
  			retval = _copyCommentStmt(from);
  			break;
+ 		case T_SecLabelStmt:
+ 			retval = _copySecLabelStmt(from);
+ 			break;
  		case T_FetchStmt:
  			retval = _copyFetchStmt(from);
  			break;
*** a/src/backend/nodes/equalfuncs.c
--- b/src/backend/nodes/equalfuncs.c
***************
*** 1164,1169 **** _equalCommentStmt(CommentStmt *a, CommentStmt *b)
--- 1164,1181 ----
  }
  
  static bool
+ _equalSecLabelStmt(SecLabelStmt *a, SecLabelStmt *b)
+ {
+ 	COMPARE_SCALAR_FIELD(objtype);
+ 	COMPARE_NODE_FIELD(objname);
+ 	COMPARE_NODE_FIELD(objargs);
+ 	COMPARE_STRING_FIELD(tag);
+ 	COMPARE_STRING_FIELD(seclabel);
+ 
+ 	return true;
+ }
+ 
+ static bool
  _equalFetchStmt(FetchStmt *a, FetchStmt *b)
  {
  	COMPARE_SCALAR_FIELD(direction);
***************
*** 2624,2629 **** equal(void *a, void *b)
--- 2636,2644 ----
  		case T_CommentStmt:
  			retval = _equalCommentStmt(a, b);
  			break;
+ 		case T_SecLabelStmt:
+ 			retval = _equalSecLabelStmt(a, b);
+ 			break;
  		case T_FetchStmt:
  			retval = _equalFetchStmt(a, b);
  			break;
*** a/src/backend/parser/gram.y
--- b/src/backend/parser/gram.y
***************
*** 204,210 **** static TypeName *TableFuncTypeName(List *columns);
  		CreateFunctionStmt AlterFunctionStmt ReindexStmt RemoveAggrStmt
  		RemoveFuncStmt RemoveOperStmt RenameStmt RevokeStmt RevokeRoleStmt
  		RuleActionStmt RuleActionStmtOrEmpty RuleStmt
! 		SelectStmt TransactionStmt TruncateStmt
  		UnlistenStmt UpdateStmt VacuumStmt
  		VariableResetStmt VariableSetStmt VariableShowStmt
  		ViewStmt CheckPointStmt CreateConversionStmt
--- 204,210 ----
  		CreateFunctionStmt AlterFunctionStmt ReindexStmt RemoveAggrStmt
  		RemoveFuncStmt RemoveOperStmt RenameStmt RevokeStmt RevokeRoleStmt
  		RuleActionStmt RuleActionStmtOrEmpty RuleStmt
! 		SecLabelStmt SelectStmt TransactionStmt TruncateStmt
  		UnlistenStmt UpdateStmt VacuumStmt
  		VariableResetStmt VariableSetStmt VariableShowStmt
  		ViewStmt CheckPointStmt CreateConversionStmt
***************
*** 422,427 **** static TypeName *TableFuncTypeName(List *columns);
--- 422,429 ----
  %type <str>		OptTableSpace OptConsTableSpace OptTableSpaceOwner
  %type <list>	opt_check_option
  
+ %type <str>		label_item opt_esp
+ 
  %type <target>	xml_attribute_el
  %type <list>	xml_attribute_list xml_attributes
  %type <node>	xml_root_version opt_xml_root_standalone
***************
*** 499,505 **** static TypeName *TableFuncTypeName(List *columns);
  
  	KEY
  
! 	LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
  	LEAST LEFT LEVEL LIKE LIMIT LISTEN LOAD LOCAL LOCALTIME LOCALTIMESTAMP
  	LOCATION LOCK_P LOGIN_P
  
--- 501,507 ----
  
  	KEY
  
! 	LABEL LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
  	LEAST LEFT LEVEL LIKE LIMIT LISTEN LOAD LOCAL LOCALTIME LOCALTIMESTAMP
  	LOCATION LOCK_P LOGIN_P
  
***************
*** 737,742 **** stmt :
--- 739,745 ----
  			| RevokeStmt
  			| RevokeRoleStmt
  			| RuleStmt
+ 			| SecLabelStmt
  			| SelectStmt
  			| TransactionStmt
  			| TruncateStmt
***************
*** 4327,4332 **** comment_text:
--- 4330,4390 ----
  			| NULL_P							{ $$ = NULL; }
  		;
  
+ 
+ /*****************************************************************************
+  *
+  * ALTER THING name SECURITY LABEL TO label
+  *
+  *****************************************************************************/
+ 
+ SecLabelStmt: SECURITY LABEL opt_esp ON TABLE any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_TABLE;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 			| SECURITY LABEL opt_esp ON COLUMN any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_COLUMN;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 			| SECURITY LABEL opt_esp ON SEQUENCE any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_SEQUENCE;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 			| SECURITY LABEL opt_esp ON VIEW any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_VIEW;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 		;
+ 
+ label_item:		Sconst			{ $$ = $1; }
+ 
+ opt_esp:	FOR Sconst		{ $$ = $2; }
+ 			| /* empty */		{ $$ = NULL; }
+ 		;
+ 
  /*****************************************************************************
   *
   *		QUERY:
***************
*** 10993,10998 **** unreserved_keyword:
--- 11051,11057 ----
  			| INVOKER
  			| ISOLATION
  			| KEY
+ 			| LABEL
  			| LANGUAGE
  			| LARGE_P
  			| LAST_P
*** a/src/backend/tcop/utility.c
--- b/src/backend/tcop/utility.c
***************
*** 218,223 **** check_xact_readonly(Node *parsetree)
--- 218,224 ----
  		case T_AlterUserMappingStmt:
  		case T_DropUserMappingStmt:
  		case T_AlterTableSpaceOptionsStmt:
+ 		case T_SecLabelStmt:
  			PreventCommandIfReadOnly(CreateCommandTag(parsetree));
  			break;
  		default:
***************
*** 663,668 **** standard_ProcessUtility(Node *parsetree,
--- 664,673 ----
  			CommentObject((CommentStmt *) parsetree);
  			break;
  
+ 		case T_SecLabelStmt:
+ 			ExecSecLabelStmt((SecLabelStmt *) parsetree);
+ 			break;
+ 
  		case T_CopyStmt:
  			{
  				uint64		processed;
***************
*** 1592,1597 **** CreateCommandTag(Node *parsetree)
--- 1597,1606 ----
  			tag = "COMMENT";
  			break;
  
+ 		case T_SecLabelStmt:
+ 			tag = "SECURITY LABEL";
+ 			break;
+ 
  		case T_CopyStmt:
  			tag = "COPY";
  			break;
***************
*** 2314,2319 **** GetCommandLogLevel(Node *parsetree)
--- 2323,2332 ----
  			lev = LOGSTMT_DDL;
  			break;
  
+ 		case T_SecLabelStmt:
+ 			lev = LOGSTMT_DDL;
+ 			break;
+ 
  		case T_CopyStmt:
  			if (((CopyStmt *) parsetree)->is_from)
  				lev = LOGSTMT_MOD;
*** a/src/bin/pg_dump/pg_backup.h
--- b/src/bin/pg_dump/pg_backup.h
***************
*** 103,108 **** typedef struct _restoreOptions
--- 103,109 ----
  										 * restore */
  	int			use_setsessauth;/* Use SET SESSION AUTHORIZATION commands
  								 * instead of OWNER TO */
+ 	int			skip_seclabel;	/* Skip security label entries */
  	char	   *superuser;		/* Username to use as superuser */
  	char	   *use_role;		/* Issue SET ROLE to this */
  	int			dataOnly;
*** a/src/bin/pg_dump/pg_backup_archiver.c
--- b/src/bin/pg_dump/pg_backup_archiver.c
***************
*** 2275,2280 **** _tocEntryRequired(TocEntry *te, RestoreOptions *ropt, bool include_acls)
--- 2275,2284 ----
  	if ((!include_acls || ropt->aclsSkip) && _tocEntryIsACL(te))
  		return 0;
  
+ 	/* If it's security labels, maybe ignore it */
+ 	if (ropt->skip_seclabel && strcmp(te->desc, "LABEL") == 0)
+ 		return 0;
+ 
  	/* Ignore DATABASE entry unless we should create it */
  	if (!ropt->createDB && strcmp(te->desc, "DATABASE") == 0)
  		return 0;
***************
*** 2341,2346 **** _tocEntryRequired(TocEntry *te, RestoreOptions *ropt, bool include_acls)
--- 2345,2352 ----
  			(strcmp(te->desc, "ACL") == 0 &&
  			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0) ||
  			(strcmp(te->desc, "COMMENT") == 0 &&
+ 			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0) ||
+ 			(strcmp(te->desc, "LABEL") == 0 &&
  			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0))
  			res = res & REQ_DATA;
  		else
*** a/src/bin/pg_dump/pg_dump.c
--- b/src/bin/pg_dump/pg_dump.c
***************
*** 125,130 **** static int	binary_upgrade = 0;
--- 125,131 ----
  static int	disable_dollar_quoting = 0;
  static int	dump_inserts = 0;
  static int	column_inserts = 0;
+ static int	security_label = 0;
  
  
  static void help(const char *progname);
***************
*** 183,188 **** static void dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
--- 184,194 ----
  		const char *tag, const char *nspname, const char *owner,
  		const char *acls);
  
+ static void dumpSecLabel(Archive *fout,
+ 						 CatalogId objCatId, DumpId objDumpId,
+ 						 const char *type, const char *target,
+ 						 const char *nspname, const char *owner);
+ 
  static void getDependencies(void);
  static void getDomainConstraints(TypeInfo *tyinfo);
  static void getTableData(TableInfo *tblinfo, int numTables, bool oids);
***************
*** 300,305 **** main(int argc, char **argv)
--- 306,312 ----
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+ 		{"security-label", no_argument, &security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 448,453 **** main(int argc, char **argv)
--- 455,462 ----
  					outputNoTablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
+ 				else if (strcmp(optarg, "security-label") == 0)
+ 					security_label = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 643,648 **** main(int argc, char **argv)
--- 652,666 ----
  		do_sql_command(g_conn, "SET quote_all_identifiers = true");
  
  	/*
+ 	 * Disables security label support if server version < v9.1.x
+ 	 */
+ 	if (security_label && g_fout->remoteVersion < 90100)
+ 	{
+ 		write_msg(NULL, "Server does not support security labels\n");
+ 		security_label = 0;
+ 	}
+ 
+ 	/*
  	 * Start serializable transaction to dump consistent data.
  	 */
  	do_sql_command(g_conn, "BEGIN");
***************
*** 839,844 **** help(const char *progname)
--- 857,863 ----
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
+ 	printf(_("  --security-label            also dump security labels\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
***************
*** 10435,10440 **** dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
--- 10454,10564 ----
  }
  
  /*
+  * dumpSecLabel 
+  *
+  * It dumps any security labels associated with the object handed
+  * to this routine. The routine takes a constant character string
+  * for the target part of the security-label command, plus the
+  * namespace and owner of the object (for labeling the ArchiveEntry),
+  * plus catalogId which is lookup key for pg_seclabel, and dumpId
+  * for the object.
+  * If a matching pg_seclabel entry is found, it is dumped.
+  */
+ static void
+ dumpSecLabel(Archive *fout, CatalogId objCatId, DumpId objDumpId,
+ 			 const char *type, const char *target,
+ 			 const char *nspname, const char *owner)
+ {
+ 	PGresult	   *res;
+ 	PQExpBuffer		lquery;
+ 	PQExpBuffer		cquery;
+ 	PQExpBuffer		tgbuf;
+ 	int				i_attname;
+ 	int				i_tag;
+ 	int				i_label;
+ 	int				i, ntups;
+ 
+ 	/* do nothing, if security label dump is not enabled */
+ 	if (!security_label)
+ 		return;
+ 
+ 	/* --data-only skips security labels *except* large object */
+ 	if (dataOnly && strcmp(type, "LARGE OBJECT") != 0)
+ 		return;
+ 
+ 	/*
+ 	 * Fetch security labels associated with the object
+ 	 */
+ 	lquery = createPQExpBuffer();
+ 	cquery = createPQExpBuffer();
+ 	tgbuf = createPQExpBuffer();
+ 
+ 	appendPQExpBuffer(lquery,
+ 					  "SELECT a.attname, s.tag, s.label"
+ 					  "  FROM pg_catalog.pg_seclabel s"
+ 					  "       LEFT OUTER JOIN"
+ 					  "       pg_catalog.pg_attribute a"
+ 					  "       ON s.objoid = a.attrelid AND"
+ 					  "          s.subid = a.attnum"
+ 					  "  WHERE reloid = %u AND objoid = %u",
+ 					  objCatId.tableoid, objCatId.oid);
+ 
+ 	res = PQexec(g_conn, lquery->data);
+ 	check_sql_result(res, g_conn, lquery->data, PGRES_TUPLES_OK);
+ 
+ 	i_attname	= PQfnumber(res, "attname");
+ 	i_tag		= PQfnumber(res, "tag");
+ 	i_label		= PQfnumber(res, "label");
+ 
+ 	ntups = PQntuples(res);
+ 
+ 	for (i = 0; i < ntups; i++)
+ 	{
+ 		if (strcmp(type, "TABLE") == 0 &&
+ 			!PQgetisnull(res, i, i_attname))
+ 		{
+ 			appendPQExpBuffer(cquery,
+ 							  "SECURITY LABEL FOR '%s'"
+ 							  " ON COLUMN %s.%s IS '%s';\n",
+ 							  PQgetvalue(res, i, i_tag),
+ 							  target,
+ 							  fmtId(PQgetvalue(res, i, i_attname)),
+ 							  PQgetvalue(res, i, i_label));
+ 			continue;
+ 		}
+ 
+ 		/*
+ 		 * a.attname can be available only when type = "TABLE",
+ 		 * so we expect it will be always NULL. Elsewhere, we assume
+ 		 * it as a data corruption, so simply ignored.
+ 		 */
+ 		if (!PQgetisnull(res, i, i_attname))
+ 			continue;
+ 
+ 		appendPQExpBuffer(cquery,
+ 						  "SECURITY LABEL FOR '%s' ON %s %s IS '%s';\n",
+ 						  PQgetvalue(res, i, i_tag),
+ 						  type, target,
+ 						  PQgetvalue(res, i, i_label));
+ 	}
+ 	PQclear(res);
+ 
+ 	if (cquery->len > 0)
+ 	{
+ 		appendPQExpBuffer(tgbuf, "%s %s", type, target);
+ 		ArchiveEntry(fout, nilCatalogId, createDumpId(),
+ 					 tgbuf->data, nspname, NULL, owner,
+ 					 false, "LABEL", SECTION_NONE,
+ 					 cquery->data, "", NULL,
+ 					 &(objDumpId), 1,
+ 					 NULL, NULL);
+ 	}
+ 	destroyPQExpBuffer(lquery);
+ 	destroyPQExpBuffer(cquery);
+ 	destroyPQExpBuffer(tgbuf);
+ }
+ 
+ /*
   * dumpTable
   *	  write out to fout the declarations (not data) of a user-defined table
   */
***************
*** 10458,10463 **** dumpTable(Archive *fout, TableInfo *tbinfo)
--- 10582,10594 ----
  				tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
  				tbinfo->relacl);
  
+ 		/* Handle the security label here */
+ 		dumpSecLabel(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId,
+ 					 (tbinfo->relkind == RELKIND_SEQUENCE ? "SEQUENCE" :
+ 					  (tbinfo->relkind == RELKIND_VIEW ? "VIEW" : "TABLE")),
+ 					 namecopy,
+ 					 tbinfo->dobj.namespace->dobj.name,
+ 					 tbinfo->rolname);
  		/*
  		 * Handle column ACLs, if any.	Note: we pull these with a separate
  		 * query rather than trying to fetch them during getTableAttrs, so
*** a/src/bin/pg_dump/pg_dumpall.c
--- b/src/bin/pg_dump/pg_dumpall.c
***************
*** 69,74 **** static int	disable_triggers = 0;
--- 69,75 ----
  static int	inserts = 0;
  static int	no_tablespaces = 0;
  static int	use_setsessauth = 0;
+ static int	security_label = 0;
  static int	server_version;
  
  static FILE *OPF;
***************
*** 133,138 **** main(int argc, char *argv[])
--- 134,140 ----
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+ 		{"security-label", no_argument, &security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 286,291 **** main(int argc, char *argv[])
--- 288,295 ----
  					no_tablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
+ 				else if (strcmp(optarg, "security-label") == 0)
+ 					security_label = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 371,376 **** main(int argc, char *argv[])
--- 375,382 ----
  		appendPQExpBuffer(pgdumpopts, " --quote-all-identifiers");
  	if (use_setsessauth)
  		appendPQExpBuffer(pgdumpopts, " --use-set-session-authorization");
+ 	if (security_label)
+ 		appendPQExpBuffer(pgdumpopts, " --security-label");
  
  	/*
  	 * If there was a database specified on the command line, use that,
***************
*** 567,572 **** help(void)
--- 573,579 ----
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
+ 	printf(_("  --security-label            also dump security labels\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
*** a/src/bin/pg_dump/pg_restore.c
--- b/src/bin/pg_dump/pg_restore.c
***************
*** 76,81 **** main(int argc, char **argv)
--- 76,82 ----
  	static int	no_data_for_failed_tables = 0;
  	static int	outputNoTablespaces = 0;
  	static int	use_setsessauth = 0;
+ 	static int	skip_seclabel = 0;
  
  	struct option cmdopts[] = {
  		{"clean", 0, NULL, 'c'},
***************
*** 116,121 **** main(int argc, char **argv)
--- 117,123 ----
  		{"no-tablespaces", no_argument, &outputNoTablespaces, 1},
  		{"role", required_argument, NULL, 2},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+ 		{"no-security-label", no_argument, &skip_seclabel, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 262,267 **** main(int argc, char **argv)
--- 264,271 ----
  					outputNoTablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
+ 				else if (strcmp(optarg, "no-security-label") == 0)
+ 					skip_seclabel = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 337,342 **** main(int argc, char **argv)
--- 341,347 ----
  	opts->noDataForFailedTables = no_data_for_failed_tables;
  	opts->noTablespace = outputNoTablespaces;
  	opts->use_setsessauth = use_setsessauth;
+ 	opts->skip_seclabel = skip_seclabel;
  
  	if (opts->formatName)
  	{
***************
*** 442,447 **** usage(const char *progname)
--- 447,453 ----
  			 "                           do not restore data of tables that could not be\n"
  			 "                           created\n"));
  	printf(_("  --no-tablespaces         do not restore tablespace assignments\n"));
+ 	printf(_("  --no-security-label      do not restore security labels\n"));
  	printf(_("  --role=ROLENAME          do SET ROLE before restore\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                           use SET SESSION AUTHORIZATION commands instead of\n"
*** a/src/include/catalog/indexing.h
--- b/src/include/catalog/indexing.h
***************
*** 281,286 **** DECLARE_UNIQUE_INDEX(pg_default_acl_oid_index, 828, on pg_default_acl using btre
--- 281,289 ----
  DECLARE_UNIQUE_INDEX(pg_db_role_setting_databaseid_rol_index, 2965, on pg_db_role_setting using btree(setdatabase oid_ops, setrole oid_ops));
  #define DbRoleSettingDatidRolidIndexId	2965
  
+ DECLARE_UNIQUE_INDEX(pg_seclabel_object_index, 3038, on pg_seclabel using btree(reloid oid_ops, objoid oid_ops, subid int4_ops, tag text_ops));
+ #define SecLabelObjectIndexId				3038
+ 
  /* last step of initialization script: build the indexes declared above */
  BUILD_INDICES
  
*** /dev/null
--- b/src/include/catalog/pg_seclabel.h
***************
*** 0 ****
--- 1,43 ----
+ /* -------------------------------------------------------------------------
+  *
+  * pg_seclabel.h
+  *    definition of the system "security label" relation (pg_seclabel)
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  *
+  * -------------------------------------------------------------------------
+  */
+ #ifndef PG_SECLABEL_H
+ #define PG_SECLABEL_H
+ 
+ #include "catalog/genbki.h"
+ 
+ /* ----------------
+  *		pg_seclabel definition.  cpp turns this into
+  *		typedef struct FormData_pg_seclabel
+  * ----------------
+  */
+ #define SecLabelRelationId		3037
+ 
+ CATALOG(pg_seclabel,3037) BKI_WITHOUT_OIDS
+ {
+ 	Oid			reloid;		/* OID of table containing the object */
+ 	Oid			objoid;		/* OID of the object itself */
+ 	int4		subid;		/* column number, or 0 if not used */
+ 	text		tag;		/* identifier of external security provider */
+ 	text		label;		/* security label of the object */
+ } FormData_pg_seclabel;
+ 
+ /* ----------------
+  *		compiler constants for pg_seclabel
+  * ----------------
+  */
+ #define Natts_pg_seclabel			5
+ #define Anum_pg_seclabel_reloid		1
+ #define Anum_pg_seclabel_objoid		2
+ #define Anum_pg_seclabel_subid		3
+ #define Anum_pg_seclabel_tag		4
+ #define Anum_pg_seclabel_label		5
+ 
+ #endif	/* PG_SECLABEL_H */
*** a/src/include/catalog/toasting.h
--- b/src/include/catalog/toasting.h
***************
*** 45,50 **** DECLARE_TOAST(pg_constraint, 2832, 2833);
--- 45,51 ----
  DECLARE_TOAST(pg_description, 2834, 2835);
  DECLARE_TOAST(pg_proc, 2836, 2837);
  DECLARE_TOAST(pg_rewrite, 2838, 2839);
+ DECLARE_TOAST(pg_seclabel, 3039, 3040);
  DECLARE_TOAST(pg_statistic, 2840, 2841);
  DECLARE_TOAST(pg_trigger, 2336, 2337);
  
*** /dev/null
--- b/src/include/commands/seclabel.h
***************
*** 0 ****
--- 1,36 ----
+ /*
+  * seclabel.h
+  *
+  * Prototypes for functions in commands/seclabel.c
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  */
+ #ifndef SECLABEL_H
+ #define SECLABEL_H
+ 
+ #include "catalog/objectaddress.h"
+ #include "nodes/primnodes.h"
+ #include "nodes/parsenodes.h"
+ 
+ /*
+  * Internal APIs
+  */
+ extern char *GetSecurityLabel(const ObjectAddress *object,
+ 							  const char *tag);
+ extern void  SetSecurityLabel(const ObjectAddress *object,
+ 							  const char *tag,
+ 							  const char *seclabel);
+ extern void  DeleteSecurityLabel(const ObjectAddress *object);
+ 
+ /*
+  * Statement and ESP hook support
+  */
+ extern void ExecSecLabelStmt(SecLabelStmt *stmt);
+ 
+ typedef void (*check_object_relabel_type)(const ObjectAddress *object,
+ 										  const char *seclabel);
+ extern void register_object_relabel_hook(const char *tag,
+ 										 check_object_relabel_type hook);
+ 
+ #endif	/* SECLABEL_H */
*** a/src/include/nodes/nodes.h
--- b/src/include/nodes/nodes.h
***************
*** 347,352 **** typedef enum NodeTag
--- 347,353 ----
  	T_AlterUserMappingStmt,
  	T_DropUserMappingStmt,
  	T_AlterTableSpaceOptionsStmt,
+ 	T_SecLabelStmt,
  
  	/*
  	 * TAGS FOR PARSE TREE NODES (parsenodes.h)
*** a/src/include/nodes/parsenodes.h
--- b/src/include/nodes/parsenodes.h
***************
*** 1850,1855 **** typedef struct CommentStmt
--- 1850,1869 ----
  } CommentStmt;
  
  /* ----------------------
+  *				SECURITY LABEL Statemetn
+  * ----------------------
+  */
+ typedef struct SecLabelStmt
+ {
+ 	NodeTag		type;
+ 	ObjectType	objtype;		/* Object's type */
+ 	List	   *objname;		/* Qualified name of the object */
+ 	List	   *objargs;		/* Arguments if needed (eg, for functions) */
+ 	char	   *tag;			/* Identifier of ESP, if specified */
+ 	char	   *seclabel;		/* New security label to be assigned */
+ } SecLabelStmt;
+ 
+ /* ----------------------
   *		Declare Cursor Statement
   *
   * Note: the "query" field of DeclareCursorStmt is only used in the raw grammar
*** a/src/include/parser/kwlist.h
--- b/src/include/parser/kwlist.h
***************
*** 208,213 **** PG_KEYWORD("isnull", ISNULL, TYPE_FUNC_NAME_KEYWORD)
--- 208,214 ----
  PG_KEYWORD("isolation", ISOLATION, UNRESERVED_KEYWORD)
  PG_KEYWORD("join", JOIN, TYPE_FUNC_NAME_KEYWORD)
  PG_KEYWORD("key", KEY, UNRESERVED_KEYWORD)
+ PG_KEYWORD("label", LABEL, UNRESERVED_KEYWORD)
  PG_KEYWORD("language", LANGUAGE, UNRESERVED_KEYWORD)
  PG_KEYWORD("large", LARGE_P, UNRESERVED_KEYWORD)
  PG_KEYWORD("last", LAST_P, UNRESERVED_KEYWORD)
*** a/src/test/regress/expected/sanity_check.out
--- b/src/test/regress/expected/sanity_check.out
***************
*** 114,119 **** SELECT relname, relhasindex
--- 114,120 ----
   pg_pltemplate           | t
   pg_proc                 | t
   pg_rewrite              | t
+  pg_seclabel             | t
   pg_shdepend             | t
   pg_shdescription        | t
   pg_statistic            | t
***************
*** 153,159 **** SELECT relname, relhasindex
   timetz_tbl              | f
   tinterval_tbl           | f
   varchar_tbl             | f
! (142 rows)
  
  --
  -- another sanity check: every system catalog that has OIDs should have
--- 154,160 ----
   timetz_tbl              | f
   tinterval_tbl           | f
   varchar_tbl             | f
! (143 rows)
  
  --
  -- another sanity check: every system catalog that has OIDs should have

*** a/doc/src/sgml/catalogs.sgml
--- b/doc/src/sgml/catalogs.sgml
***************
*** 209,214 ****
--- 209,219 ----
       </row>
  
       <row>
+       <entry><link linkend="catalog-pg-seclabel"><structname>pg_seclabel</structname></link></entry>
+       <entry>security labels on local database objects</entry>
+      </row>
+ 
+      <row>
        <entry><link linkend="catalog-pg-shdepend"><structname>pg_shdepend</structname></link></entry>
        <entry>dependencies on shared objects</entry>
       </row>
***************
*** 4227,4232 ****
--- 4232,4322 ----
    </table>
   </sect1>
  
+  <sect1 id="catalog-pg-seclabel">
+   <title><structname>pg_seclabel</structname></title>
+ 
+   <indexterm zone="catalog-pg-seclabel">
+    <primary>pg_seclabel</primary>
+   </indexterm>
+ 
+   <para>
+    The catalog <structname>pg_seclabel</structname> stores the security
+    label of database objects. This information allows external security
+    providers to apply label based mandatory access controls.
+   </para>
+ 
+   <para>
+    When external security providers with label based mandatory access
+    control are installed, its security label shall be assigned on
+    creation of database obejcts.
+    (Please note that only relations are supported right now.)
+   </para>
+   <para>
+    The security labels shall be automatically cleaned up when the database
+    object being labeled is dropped.
+   </para>
+   <para>
+    See also <link linkend="sql-security-label"><command>SECURITY LABEL</command></link>,
+    which provides a functionality to relabel a certain database object,
+    as long as user has enough privileges.
+   </para>
+ 
+   <table>
+    <title><structname>pg_seclabel</structname> Columns</title>
+ 
+    <tgroup cols="4">
+     <thead>
+      <row>
+       <entry>Name</entry>
+       <entry>Type</entry>
+       <entry>References</entry>
+       <entry>Description</entry>
+      </row>
+     </thead>
+ 
+     <tbody>
+      <row>
+       <entry><structfield>reloid</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry><literal><link linkend="catalog-pg-class"><structname>pg_class</structname></link>.oid</literal></entry>
+       <entry>The OID of the system catalog this object appears in</entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>objoid</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry>any OID column</entry>
+       <entry>The OID of the object this security label assigned on</entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>subid</structfield></entry>
+       <entry><type>int4</type></entry>
+       <entry></entry>
+       <entry>For a security label on a table column, this is the column number
+        (the <structfield>objoid</structfield> and <structfield>classoid</structfield>
+        refer to the table itself).  For all other object types, this column is
+        zero
+       </entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>tag</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry></entry>
+       <entry>identifier of external security provider</entry>
+      </row>
+ 
+      <row>
+       <entry><structfield>label</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry></entry>
+       <entry>security label in text format</entry>
+      </row>
+     </tbody>
+    </tgroup>
+   </table>
+  </sect1>
  
   <sect1 id="catalog-pg-shdepend">
    <title><structname>pg_shdepend</structname></title>
*** /dev/null
--- b/doc/src/sgml/esp.sgml
***************
*** 0 ****
--- 1,249 ----
+ <chapter id="esp">
+  <title>External Security Provider</title>
+  <para>
+   External security provider (ESP) is a plugin which makes access control
+   decision based on its security model and policy.
+  </para>
+  <para>
+   <productname>PostgreSQL</productname> version 9.1 or later provides a set of
+   facilities to enhance access control features using ESP, in addition to the
+   default database privilege mechanism introduced
+   as the <xref linkend="user-manag">.
+  </para>
+  <para>
+   This chapter introduces brief overview of ESP concept and corresponding
+   features, but it does not introduce details of individual ESP plugins.
+   If you need to know something about a certain ESP plugin, please reference
+   documentation of the plugin.
+  </para>
+ 
+  <sect1 id="esp-overview">
+   <title>Overview</title>
+   <para>
+    The ESP concept was designed to integrate various kind of security
+    models into <productname>PostgreSQL</productname>.
+ 
+    It allows third-party modules to perform as security provider which
+    makes access control decision on accesses to database objects;
+    such as tables, functions and so on.
+ 
+    Please note that it never replaces anything in the default database
+    privilege mechanism. It just installs additional access control stuffs.
+   </para>
+   <para>
+    Access control is a mechanism that decides what actions are allowed
+    or denied on a pair of certain user and object to be referenced,
+    then applies the decision on any requests come from clients.
+   </para>
+   <para>
+    The default database privilege mechanism makes its access control
+    decision based on the authenticated user identifier and permissions
+    of database objects to be referenced.
+   </para>
+   <para>
+    Here are some cases that we hope to make and apply access control
+    decisions based on a different basis from the default one.
+ 
+    For example, one significant goal of ESP is integration of mandatory
+    access control that only allows security administrator to set up
+    access rights of database objects, unlike the default one which
+    allows owner of them to set up their access rights.
+   </para>
+   <para>
+    At the implementation level, <productname>PostgreSQL</productname> 9.1
+    or later provides a series of security hooks which are put on strategic
+    points of core routines; such as a routine that checks permissions of
+    tables and columns for the supplied DML statement.
+   </para>
+   <para>
+    ESP modules shall be invoked via the security hooks, then it can make
+    its access control decision based on the security model and supplied
+    information about user's request; such as OID of tables to be referenced.
+   </para>
+   <para>
+    Expected behaviors are depending on every security hooks.
+ 
+    One hook may assume ESP raises an error, if access control violation.
+    One other hook may assume ESP returns a bool value which informs the
+    caller routine whether its decision was 'allowed' or 'denied'.
+   </para>
+   <para>
+    These hooks shall be filled up when we load plugins.
+ 
+    Administrator can add a configuration of
+    <literal>shared_preload_libraries</literal> on which we specify a few
+    plugins to be loaded on starting up the server process, as follows:
+ 
+ <programlisting>
+ shared_preload_libraries = 'sepgsql'    # (change requires restart)
+ </programlisting>
+ 
+    You should never use <literal>local_preload_libraries</literal> instead,
+    even if the plugin is well verified without any vulnerabilities, because
+    it can be overridden by GUC variable settings passed in startup packet.
+   </para>
+   <para>
+    Please note that ESP framework has quite-limited coverage of access control
+    compared to the default database privilege mechanism right now.
+    In this release, it only hooks on execution of DML, a part of DDL and
+    post client authentication process.
+   </para>
+  </sect1>
+ 
+  <sect1 id="esp-mac">
+   <title>Mandatory Access Control</title>
+   <para>
+    It is a major of ESP to support mandatory access control (MAC) policy
+    in <productname>PostgreSQL</productname>.
+   </para>
+   <para>
+    Unlike discretionary access control (DAC), only a security administrator
+    is allowed to control centralized MAC policy and access rights on
+    individual objects; it means any other users don't have ability to change
+    the access rights on database objects, even if they have ownership of the
+    object.
+   </para>
+   <para>
+    This characteristic enables to confine classified information in certain
+    domains, even if owner of data tries to leak it somewhere, because the
+    owner cannot change its access rights as he like.
+   </para>
+   <para>
+    Here is a a traditional rule for instance. It prevents people who can
+    read both of classified and unclassified data object to write unclassified
+    data object. It means infomation moves only single direction; from
+    unclassified to classified. Since this rule is applied to everybody,
+    noboby can leak classified information into unclassified ones, even if
+    a malicious internal tries to do.
+   </para>
+   <para>
+    MAC is designed to tackle such a strict security requirement.
+   </para>
+ 
+   <sect2 id="esp-mac-label">
+    <title>Security Label</title>
+    <para>
+     In the default database privileges, <command>GRANT</command> and
+     <command>REVOKE</command> commands allow superusers and owner of the
+     database obejcts to set up access permissions, then it makes access
+     control decision based on these properties.
+    </para>
+    <para>
+     On the other hand, MAC model also has a property that characterizes
+     database objects from the viewpoint of MAC. A typical MAC feature uses
+     security label to identify the objects. It is a short text with a format
+     according to the security model.
+    </para>
+    <para>
+     The following examples are security label in SELinux.
+     It contains all the needed properties to make access control decision
+     from the viewpoint of SELinux, like a pair of access permissions and
+     owner identifier of the database object.
+ <synopsis>
+ dbadm_u:system_r:postgresql_t:s0
+ 
+ system_u:object_r:sepgsql_table_t:s0:c0
+ </synopsis>
+    </para>
+    <para>
+     It also means MAC model cannot make its access control decision on accesses
+     to database objects without security labels. So, we need to assign a certain
+     security label on database objects to be referenced.
+    </para>
+    <para>
+     In addition, MAC model also represents privilege set of user as a security
+     label, instead of user identifier. Mostly, security label of the users are
+     assigned according to the result of authentication.
+    </para>
+    <para>
+     In other words, MAC mechanism is something like a function which returns
+     a binary state ('allowed' or 'denied') for the supplied actions and
+     security labels of user and object to be referenced.
+    </para>
+    <para>
+     DAC mechanism (ie; the default database privilege mechanism) is also like
+     a function which returns a binary state for the supplied actions, user
+     identifier and permissions on the object to be referenced, so they are not
+     fundamentally difference.
+    </para>
+   </sect2>
+   <sect2 id="esp-mac-label-manage">
+    <title>Management of security label</title>
+    <para>
+     As we introduced above, MAC mechanism needs both of user and object to be
+     labeled, to make its access control decision.
+    </para>
+    <para>
+     For database objects, <productname>PostgreSQL</productname> provides
+     a facility that enables to assign a security label on them.
+ 
+     When an ESP plugin of MAC is installed, it shall assign a default security
+     label of a new database object on its creation time.
+ 
+     In addition, user can relabel security label of database objects using
+     <xref linkend="SQL-SECURITY-LABEL"> command later, as long as this
+     operation is allowed by security mechanisms.
+    </para>
+    <para>
+     The following example creates a new table <literal>tbl</literal> on the
+     system with <productname>SELinux</productname> support using ESP.
+ <screen>
+ postgres=> CREATE TABLE tbl (x int, y text);
+ CREATE TABLE
+ postgres=> SELECT * FROM pg_seclabel WHERE objoid = 'tbl'::regclass and subid=0;
+  reloid | objoid | subid |   tag   |                label
+ --------+--------+-------+---------+--------------------------------------
+    1259 |  24600 |     0 | selinux | system_u:object_r:sepgsql_table_t:s0
+ (1 row)
+ </screen>
+     It shows us that <literal>system_u:object_r:sepgsql_table_t:s0</literal>
+     was assigned on the creation time of table <literal>tbl</literal>.
+ <screen>
+ postgres=> SECURITY LABEL ON TABLE tbl IS 'system_u:object_r:sepgsql_ro_table_t:s0';
+ SECURITY LABEL
+ postgres=> SELECT * FROM pg_seclabel WHERE objoid = 'tbl'::regclass and subid=0;
+  reloid | objoid | subid |   tag   |                  label
+ --------+--------+-------+---------+-----------------------------------------
+    1259 |  24600 |     0 | selinux | system_u:object_r:sepgsql_ro_table_t:s0
+ (1 row)
+ </screen>
+     It also shows us <command>SECURITY LABEL</command> command allows to relabel
+     the table to <literal>system_u:object_r:sepgsql_ro_table_t:s0</literal>.
+    </para>
+    <para>
+     The
+     <link linkend="catalog-pg-seclabel">
+      <structname>pg_seclabel</structname>
+     </link>
+     is a system catalog to store
+     security labels, and ESP plugins shall reference the catalog to fetch
+     them on making its access control decisions.
+    </para>
+    <para>
+     On the other hand, the way to assign a security label of user is depending
+     on the type of ESP plugin.
+ 
+     Perhaps, one plugin may associates a security label with authenticated
+     database user, and other plugin assigns a security label which is retrieved
+     from the peer process using system API.
+ 
+     So, <productname>PostgreSQL</productname> does not constrain ESP plugins
+     a certain way to retrive security label of users.
+     It provides a hook just after the database authentication, ESP plugin can
+     assign a security label on the current session with its own way.
+    </para>
+    <para>
+     When we backup and restore databases, security labels are also properties
+     of database objects to be handled correctly.
+ 
+     The <command>pg_dump</command> and <command>pg_dumpall</command> support
+     <literal>--security-label</literal> option that enables to include
+     security label of the database objects into archives.
+ 
+     And the <command>pg_restore</command> also supports
+     <literal>--no-security-label</literal> option that enables to ignore
+     security labels, even if the archives contains labels.
+    </para>
+   </sect2>
+  </sect1>
+ </chapter>
*** a/doc/src/sgml/external-projects.sgml
--- b/doc/src/sgml/external-projects.sgml
***************
*** 250,254 ****
--- 250,266 ----
     <application><ulink url="http://www.pgadmin.org/">pgAdmin III</ulink></>, 
     and there are several commercially available ones as well.
    </para>
+ 
+   <para>
+    The <xref linkend="esp"> introduces how <productname>PostgreSQL</>
+    integrate additional security features using external security
+    providers.
+ 
+    <application><ulink url="http://code.google.com/p/sepgsql/">
+      SE-PostgreSQL
+    </ulink></application> is an external security provider which
+    applies mandatory access control based on the centralized
+    security policy of operation system.
+   </para>
   </sect1>
  </appendix>
*** a/doc/src/sgml/filelist.sgml
--- b/doc/src/sgml/filelist.sgml
***************
*** 46,51 ****
--- 46,52 ----
  <!entity runtime       SYSTEM "runtime.sgml">
  <!entity config        SYSTEM "config.sgml">
  <!entity user-manag    SYSTEM "user-manag.sgml">
+ <!entity esp           SYSTEM "esp.sgml">
  <!entity wal           SYSTEM "wal.sgml">
  
  <!-- programmer's guide -->
*** a/doc/src/sgml/postgres.sgml
--- b/doc/src/sgml/postgres.sgml
***************
*** 150,155 ****
--- 150,156 ----
    &config;
    &client-auth;
    &user-manag;
+   &esp;
    &manage-ag;
    &charset;
    &maintenance;
*** a/doc/src/sgml/ref/allfiles.sgml
--- b/doc/src/sgml/ref/allfiles.sgml
***************
*** 132,137 **** Complete list of usable sgml source files in this directory.
--- 132,138 ----
  <!entity rollbackPrepared   system "rollback_prepared.sgml">
  <!entity rollbackTo         system "rollback_to.sgml">
  <!entity savepoint          system "savepoint.sgml">
+ <!entity securityLabel      system "seclabel.sgml">
  <!entity select             system "select.sgml">
  <!entity selectInto         system "select_into.sgml">
  <!entity set                system "set.sgml">
*** a/doc/src/sgml/ref/pg_dump.sgml
--- b/doc/src/sgml/ref/pg_dump.sgml
***************
*** 778,783 **** PostgreSQL documentation
--- 778,793 ----
         </para>
        </listitem>
       </varlistentry>
+ 
+      <varlistentry>
+       <term><option>--security-label</option></term>
+       <listitem>
+        <para>
+         With this option, it also outputs security labels of database
+         objects to be dumped, if labeled.
+        </para>
+       </listitem>
+      </varlistentry>
      </variablelist>
     </para>
   </refsect1>
*** a/doc/src/sgml/ref/pg_dumpall.sgml
--- b/doc/src/sgml/ref/pg_dumpall.sgml
***************
*** 493,498 **** PostgreSQL documentation
--- 493,507 ----
         </para>
        </listitem>
       </varlistentry>
+      <varlistentry>
+       <term><option>--security-label</option></term>
+       <listitem>
+        <para>
+         With this option, it also outputs security labels of database
+         objects to be dumped, if labeled.
+        </para>
+       </listitem>
+      </varlistentry>
     </variablelist>
    </para>
   </refsect1>
*** a/doc/src/sgml/ref/pg_restore.sgml
--- b/doc/src/sgml/ref/pg_restore.sgml
***************
*** 329,334 ****
--- 329,347 ----
       </varlistentry>
  
       <varlistentry>
+       <term><option>--no-security-label</option></term>
+       <listitem>
+        <para>
+         Do not output commands to relabel database objects,
+         even if the archive contains them.
+         With this option, all objects will be created with a default
+         security label, or without any labels if no label based
+         security feature is not installed.
+        </para>
+       </listitem>
+      </varlistentry>
+ 
+      <varlistentry>
        <term><option>-P <replaceable class="parameter">function-name(argtype [, ...])</replaceable></option></term>
        <term><option>--function=<replaceable class="parameter">function-name(argtype [, ...])</replaceable></option></term>
        <listitem>
*** /dev/null
--- b/doc/src/sgml/ref/seclabel.sgml
***************
*** 0 ****
--- 1,123 ----
+ <refentry id="SQL-SECURITY-LABEL">
+  <refmeta>
+   <refentrytitle>SECURITY LABEL</refentrytitle>
+   <manvolnum>7</manvolnum>
+   <refmiscinfo>SQL - Language Statements</refmiscinfo>
+  </refmeta>
+ 
+  <refnamediv>
+   <refname>SECURITY LABEL</refname>
+   <refpurpose>relabel the security label of an object</refpurpose>
+  </refnamediv>
+ 
+  <indexterm zone="sql-security-label">
+   <primary>SECURITY LABEL</primary>
+  </indexterm>
+ 
+  <refsynopsisdiv>
+ <synopsis>
+ SECURITY LABEL [ FOR '<replaceable class="PARAMETER">esp_tag</replaceable>' ] ON
+ {
+   TABLE <replaceable class="PARAMETER">object_name</replaceable> |
+   COLUMN <replaceable class="PARAMETER">table_name</replaceable>.<replaceable class="PARAMETER">column_name</replaceable> |
+   SEQUENCE <replaceable class="PARAMETER">object_name</replaceable> |
+   VIEW <replaceable class="PARAMETER">object_name</replaceable>
+ } IS '<replaceable class="PARAMETER">security_label</replaceable>';
+ </synopsis>
+  </refsynopsisdiv>
+ 
+  <refsect1>
+   <title>Description</title>
+ 
+   <para>
+    <command>SECURITY LABEL</command> relabels a security label of a database object.
+   </para>
+ 
+   <para>
+    We can assign individual security labels on a certain database object for
+    each security providers, using <command>SECURITY LABEL</command> command.
+   </para>
+   <para>
+    Security labels are automatically assigned when the object is created,
+    and also automatically dropped when the object is dropped.
+   </para>
+ 
+  </refsect1>
+ 
+  <refsect1>
+   <title>Parameters</title>
+   <variablelist>
+    <varlistentry>
+     <term><replaceable class="parameter">object_name</replaceable></term>
+     <term><replaceable class="parameter">table_name</replaceable></term>
+     <term><replaceable class="parameter">table_name.column_name</replaceable></term>
+     <listitem>
+      <para>
+       The name of the object to be relabeled.  Names of tables, columns,
+       sequences and views can be schema-qualified.
+      </para>
+     </listitem>
+    </varlistentry>
+ 
+    <varlistentry>
+     <term><replaceable class="parameter">security_label</replaceable></term>
+     <listitem>
+      <para>
+       The new security label as a string literal.
+      </para>
+      <para>
+       It shall be validated by one of the label based security features,
+       in addition to its permission checks relabeling on the specified
+       database objects.
+      </para>
+     </listitem>
+    </varlistentry>
+ 
+    <varlistentry>
+     <term><replaceable class="parameter">esp_tag</replaceable></term>
+     <listitem>
+      <para>
+       The identifier string of external security provider.
+      </para>
+      <para>
+       When we install just one provider, we can omit this clause because
+       it is obvious which provider shall handle the given security label.
+       Elsewhere, when we install two or more providers concurrently,
+       we need to identify a certain external security provider.
+      </para>
+     </listitem>
+    </varlistentry>
+   </variablelist>
+  </refsect1>
+ 
+  <refsect1>
+   <title>Notes</title>
+   <para>
+    This feature requires one label based mandatory access control feature
+    to be installed at least, because a security label is specific for
+    each providers, so it has to be validated when we relabel it.
+   </para>
+  </refsect1>
+ 
+  <refsect1>
+   <title>Examples</title>
+ 
+   <para>
+    Relabel a security label on the table to '<literal>system_u:object_r:sepgsql_table_t:s0</literal>'.
+ 
+ <programlisting>
+ SECURITY LABEL FOR 'selinux' ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';
+ </programlisting>
+   </para>
+  </refsect1>
+ 
+  <refsect1>
+   <title>Compatibility</title>
+   <para>
+    There is no <command>SECURITY LABEL</command> command in the SQL standard.
+   </para>
+  </refsect1>
+ </refentry>
+ 
+ 
+ 
*** a/doc/src/sgml/reference.sgml
--- b/doc/src/sgml/reference.sgml
***************
*** 160,165 ****
--- 160,166 ----
     &rollbackPrepared;
     &rollbackTo;
     &savepoint;
+    &securityLabel;
     &select;
     &selectInto;
     &set;
*** a/src/backend/catalog/Makefile
--- b/src/backend/catalog/Makefile
***************
*** 38,44 **** POSTGRES_BKI_SRCS = $(addprefix $(top_srcdir)/src/include/catalog/,\
  	pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
  	pg_ts_parser.h pg_ts_template.h \
  	pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
! 	pg_default_acl.h \
  	toasting.h indexing.h \
      )
  
--- 38,44 ----
  	pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
  	pg_ts_parser.h pg_ts_template.h \
  	pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
! 	pg_default_acl.h pg_seclabel.h \
  	toasting.h indexing.h \
      )
  
*** a/src/backend/catalog/dependency.c
--- b/src/backend/catalog/dependency.c
***************
*** 57,62 ****
--- 57,63 ----
  #include "commands/defrem.h"
  #include "commands/proclang.h"
  #include "commands/schemacmds.h"
+ #include "commands/seclabel.h"
  #include "commands/tablespace.h"
  #include "commands/trigger.h"
  #include "commands/typecmds.h"
***************
*** 1010,1015 **** deleteOneObject(const ObjectAddress *object, Relation depRel)
--- 1011,1023 ----
  	DeleteComments(object->objectId, object->classId, object->objectSubId);
  
  	/*
+ 	 * Delete any security labels associated with this object. (This is also
+ 	 * a convenient place to do it instead of having every object type know
+ 	 * to do it.)
+ 	 */
+ 	DeleteSecurityLabel(object);
+ 
+ 	/*
  	 * CommandCounterIncrement here to ensure that preceding changes are all
  	 * visible to the next deletion step.
  	 */
*** a/src/backend/commands/Makefile
--- b/src/backend/commands/Makefile
***************
*** 17,23 **** OBJS = aggregatecmds.o alter.o analyze.o async.o cluster.o comment.o  \
  	dbcommands.o define.o discard.o explain.o foreigncmds.o functioncmds.o \
  	indexcmds.o lockcmds.o operatorcmds.o opclasscmds.o \
  	portalcmds.o prepare.o proclang.o \
! 	schemacmds.o sequence.o tablecmds.o tablespace.o trigger.o \
  	tsearchcmds.o typecmds.o user.o vacuum.o vacuumlazy.o \
  	variable.o view.o
  
--- 17,23 ----
  	dbcommands.o define.o discard.o explain.o foreigncmds.o functioncmds.o \
  	indexcmds.o lockcmds.o operatorcmds.o opclasscmds.o \
  	portalcmds.o prepare.o proclang.o \
! 	schemacmds.o seclabel.o sequence.o tablecmds.o tablespace.o trigger.o \
  	tsearchcmds.o typecmds.o user.o vacuum.o vacuumlazy.o \
  	variable.o view.o
  
*** /dev/null
--- b/src/backend/commands/seclabel.c
***************
*** 0 ****
--- 1,441 ----
+ /* -------------------------------------------------------------------------
+  *
+  * seclabel.c
+  *    routines to support security label feature.
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  *
+  * -------------------------------------------------------------------------
+  */
+ #include "postgres.h"
+ 
+ #include "access/genam.h"
+ #include "access/heapam.h"
+ #include "catalog/catalog.h"
+ #include "catalog/indexing.h"
+ #include "catalog/pg_seclabel.h"
+ #include "commands/seclabel.h"
+ #include "miscadmin.h"
+ #include "utils/acl.h"
+ #include "utils/builtins.h"
+ #include "utils/fmgroids.h"
+ #include "utils/lsyscache.h"
+ #include "utils/memutils.h"
+ #include "utils/tqual.h"
+ 
+ /*
+  * GetSecurityLabel
+  *
+  * It tries to look up a security label entry for the given OID of
+  * the catalog, object itself and sub identifier (if needed) from
+  * the pg_selabel system catalog.
+  * It can return NULL, if no valid entry. Elsewhere, it returns
+  * a security label of the specified database object.
+  */
+ char *
+ GetSecurityLabel(const ObjectAddress *object, const char *tag)
+ {
+ 	Relation	pg_seclabel;
+ 	ScanKeyData	keys[4];
+ 	SysScanDesc	scan;
+ 	HeapTuple	tuple;
+ 	Datum		datum;
+ 	bool		isnull;
+ 	char	   *seclabel = NULL;
+ 
+ 	Assert(!IsSharedRelation(object->classId));
+ 
+ 	ScanKeyInit(&keys[0],
+ 				Anum_pg_seclabel_reloid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->classId));
+ 	ScanKeyInit(&keys[1],
+ 				Anum_pg_seclabel_objoid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->objectId));
+ 	ScanKeyInit(&keys[2],
+ 				Anum_pg_seclabel_subid,
+ 				BTEqualStrategyNumber, F_INT4EQ,
+ 				Int32GetDatum(object->objectSubId));
+ 	ScanKeyInit(&keys[3],
+ 				Anum_pg_seclabel_tag,
+ 				BTEqualStrategyNumber, F_TEXTEQ,
+ 				CStringGetTextDatum(tag));
+ 
+ 	pg_seclabel = heap_open(SecLabelRelationId, AccessShareLock);
+ 
+ 	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+ 							  SnapshotNow, 4, keys);
+ 
+ 	tuple = systable_getnext(scan);
+ 	if (HeapTupleIsValid(tuple))
+ 	{
+ 		datum = heap_getattr(tuple, Anum_pg_seclabel_label,
+ 							 RelationGetDescr(pg_seclabel), &isnull);
+ 		if (!isnull)
+ 			seclabel = TextDatumGetCString(datum);
+ 	}
+ 	systable_endscan(scan);
+ 
+ 	heap_close(pg_seclabel, AccessShareLock);
+ 
+ 	return seclabel;
+ }
+ 
+ /*
+  * SetSecurityLabel
+  *
+  * It tries to insert/update/delete a security label for the given OID
+  * of the catalog, object itself and sub identifier (if needed) on the
+  * pg_seclabel system catalog.
+  * If given 'seclabel' is NULL, it tries to delete the specified entry.
+  * Elsewhere, it tries to insert (if no specified entry now) or updata
+  * security label of the specified entry.
+  */
+ void
+ SetSecurityLabel(const ObjectAddress *object,
+ 				 const char *tag, const char *seclabel)
+ {
+ 	Relation	pg_seclabel;
+ 	ScanKeyData	keys[4];
+ 	SysScanDesc	scan;
+ 	HeapTuple	oldtup;
+ 	HeapTuple	newtup = NULL;
+ 	Datum		values[Natts_pg_seclabel];
+ 	bool		nulls[Natts_pg_seclabel];
+ 	bool		replaces[Natts_pg_seclabel];
+ 
+ 	Assert(!IsSharedRelation(object->classId));
+ 
+ 	ScanKeyInit(&keys[0],
+ 				Anum_pg_seclabel_reloid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+                 ObjectIdGetDatum(object->classId));
+ 	ScanKeyInit(&keys[1],
+ 				Anum_pg_seclabel_objoid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->objectId));
+ 	ScanKeyInit(&keys[2],
+ 				Anum_pg_seclabel_subid,
+ 				BTEqualStrategyNumber, F_INT4EQ,
+ 				Int32GetDatum(object->objectSubId));
+ 	ScanKeyInit(&keys[3],
+ 				Anum_pg_seclabel_tag,
+ 				BTEqualStrategyNumber, F_TEXTEQ,
+ 				CStringGetTextDatum(tag));
+ 
+ 	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+ 
+ 	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+ 							  SnapshotNow, 4, keys);
+ 
+ 	oldtup = systable_getnext(scan);
+ 	if (HeapTupleIsValid(oldtup))
+ 	{
+ 		if (seclabel != NULL)
+ 		{
+ 			/*
+ 			 * update the specified security label entry
+ 			 */
+ 			memset(nulls, false, sizeof(nulls));
+ 			memset(replaces, false, sizeof(replaces));
+ 
+ 			replaces[Anum_pg_seclabel_label - 1] = true;
+ 			values[Anum_pg_seclabel_label - 1]
+ 				= CStringGetTextDatum(seclabel);
+ 
+ 			newtup = heap_modify_tuple(oldtup, RelationGetDescr(pg_seclabel),
+ 									   values, nulls, replaces);
+ 			simple_heap_update(pg_seclabel, &oldtup->t_self, newtup);
+ 
+ 			CatalogUpdateIndexes(pg_seclabel, newtup);
+ 
+ 			heap_freetuple(newtup);
+ 		}
+ 		else
+ 		{
+ 			/*
+ 			 * when seclabel = NULL, it means to remove the matched
+ 			 * entry from pg_seclabel.
+ 			 */
+ 			simple_heap_delete(pg_seclabel, &oldtup->t_self);
+ 		}
+ 	}
+ 	else if (seclabel != NULL)
+ 	{
+ 		/*
+ 		 * insert a new security label entry
+ 		 */
+ 		memset(nulls, false, sizeof(nulls));
+ 		values[Anum_pg_seclabel_reloid - 1] = ObjectIdGetDatum(object->classId);
+ 		values[Anum_pg_seclabel_objoid - 1] = ObjectIdGetDatum(object->objectId);
+ 		values[Anum_pg_seclabel_subid - 1] = Int32GetDatum(object->objectSubId);
+ 		values[Anum_pg_seclabel_tag - 1] = CStringGetTextDatum(tag);
+ 		values[Anum_pg_seclabel_label - 1] = CStringGetTextDatum(seclabel);
+ 
+ 		newtup = heap_form_tuple(RelationGetDescr(pg_seclabel),
+ 								 values, nulls);
+ 		simple_heap_insert(pg_seclabel, newtup);
+ 
+ 		CatalogUpdateIndexes(pg_seclabel, newtup);
+ 
+ 		heap_freetuple(newtup);
+ 	}
+ 	systable_endscan(scan);
+ 		
+ 	heap_close(pg_seclabel, RowExclusiveLock);
+ }
+ 
+ /*
+  * DeleteSecurityLabel
+  *
+  * It tries to delete entries of security labels for given OID of
+  * the catalog, object itself and sub identifier (if needed) on
+  * the pg_seclabel system catalog.
+  * If given 'objectSubId' is 0, all the security labels matching
+  * with classId and objectId will be removed.
+  */
+ void
+ DeleteSecurityLabel(const ObjectAddress *object)
+ {
+ 	Relation	pg_seclabel;
+ 	ScanKeyData	keys[3];
+ 	SysScanDesc	scan;
+ 	HeapTuple	oldtup;
+ 	int			nkeys = 2;
+ 
+ 	/*
+ 	 * right now, we have obviously nothing to do on shared database
+ 	 * object deletion
+ 	 */
+ 	if (IsSharedRelation(object->classId))
+ 		return;
+ 
+ 	ScanKeyInit(&keys[0],
+ 				Anum_pg_seclabel_reloid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->classId));
+ 	ScanKeyInit(&keys[1],
+ 				Anum_pg_seclabel_objoid,
+ 				BTEqualStrategyNumber, F_OIDEQ,
+ 				ObjectIdGetDatum(object->objectId));
+ 	if (object->objectSubId != 0)
+ 	{
+ 		ScanKeyInit(&keys[2],
+ 					Anum_pg_seclabel_subid,
+ 					BTEqualStrategyNumber, F_INT4EQ,
+ 					Int32GetDatum(object->objectSubId));
+ 		nkeys = 3;
+ 	}
+ 
+ 	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+ 
+ 	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+ 							  SnapshotNow, nkeys, keys);
+ 	while (HeapTupleIsValid(oldtup = systable_getnext(scan)))
+ 	{
+ 		simple_heap_delete(pg_seclabel, &oldtup->t_self);
+ 	}
+ 	systable_endscan(scan);
+ 
+ 	heap_close(pg_seclabel, RowExclusiveLock);
+ }
+ 
+ /*
+  * check_relation_relabel 
+  *
+  * It checks whether the user is allowed to relabel this relation
+  */
+ static void
+ check_relation_relabel(int objtype, Relation relation)
+ {
+ 	/*
+ 	 * check object ownership
+ 	 */
+ 	if (!pg_class_ownercheck(RelationGetRelid(relation), GetUserId()))
+ 		aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_CLASS,
+ 					   RelationGetRelationName(relation));
+ 
+ 	/*
+ 	 * next, verify that the relation type matches the intent
+ 	 */
+ 	switch (objtype)
+ 	{
+ 		case OBJECT_TABLE:
+ 		case OBJECT_COLUMN:
+ 			if (relation->rd_rel->relkind != RELKIND_RELATION)
+ 				ereport(ERROR,
+ 						(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ 						 errmsg("\"%s\" is not a table",
+ 								RelationGetRelationName(relation))));
+ 			break;
+ 
+ 		case OBJECT_SEQUENCE:
+ 			if (relation->rd_rel->relkind != RELKIND_SEQUENCE)
+ 				ereport(ERROR,
+ 						(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ 						 errmsg("\"%s\" is not a sequence",
+ 								RelationGetRelationName(relation))));
+ 			break;
+ 
+ 		case OBJECT_VIEW:
+ 			if (relation->rd_rel->relkind != RELKIND_VIEW)
+ 				ereport(ERROR,
+ 						(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ 						 errmsg("\"%s\" is not a view",
+ 								RelationGetRelationName(relation))));
+ 			break;
+ 	}
+ }
+ 
+ /*
+  * Registration of an external security provider hook
+  */
+ static List *esp_relabel_hook_list = NIL;
+ 
+ typedef struct
+ {
+ 	const char				   *tag;
+ 	check_object_relabel_type	hook;
+ } esp_relabel_hook_entry;
+ 
+ void
+ register_object_relabel_hook(const char *tag, check_object_relabel_type hook)
+ {
+ 	esp_relabel_hook_entry *entry;
+ 	MemoryContext			oldcxt;
+ 
+ 	oldcxt = MemoryContextSwitchTo(TopMemoryContext);
+ 	entry = palloc(sizeof(esp_relabel_hook_entry));
+ 	entry->tag = pstrdup(tag);
+ 	entry->hook = hook;
+ 
+ 	esp_relabel_hook_list = lappend(esp_relabel_hook_list, entry);
+ 
+ 	MemoryContextSwitchTo(oldcxt);
+ }
+ 
+ /*
+  * ExecSecLabelStmt
+  *
+  * SECURITY LABEL [FOR <esp>] ON <class> <name> IS <new label>
+  */
+ void
+ ExecSecLabelStmt(SecLabelStmt *stmt)
+ {
+ 	esp_relabel_hook_entry *entry;
+ 	ObjectAddress			address;
+ 	Relation				relation;
+ 	ListCell			   *cell;
+ 	const char			   *tag = NULL;
+ 
+ 	/*
+ 	 * SECURITY LABEL statement needs one label based security feature
+ 	 * being available at least.
+ 	 */
+ 	if (list_length(esp_relabel_hook_list) == 0)
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("No label based security is available now")));
+ 
+ 	/*
+ 	 * Determine what ESP needs to own the supplied label
+ 	 */
+ 	if (!stmt->tag)
+ 	{
+ 		/*
+ 		 * User can omit FOR <provider> clause, only when one ESP is
+ 		 * installed, because it is obvious what ESP needs to own the
+ 		 * supplied security label.
+ 		 * But we prohibit to omit it when multiple ESPs are installed.
+ 		 */
+ 		if (list_length(esp_relabel_hook_list) > 1)
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 					 errmsg("No FOR clause in spite of multiple "
+ 							"label based security features")));
+ 		entry = linitial(esp_relabel_hook_list);
+ 	}
+ 	else
+ 	{
+ 		/*
+ 		 * If user explicitly specified a security provider,
+ 		 * it has to be installed of course.
+ 		 */
+ 		foreach (cell, esp_relabel_hook_list)
+ 		{
+ 			entry = lfirst(cell);
+ 
+ 			if (strcmp(stmt->tag, entry->tag) == 0)
+ 				goto found;
+ 		}
+ 		ereport(ERROR,
+ 				(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ 				 errmsg("No label based security feature for \"%s\"",
+ 						stmt->tag)));
+ 	}
+ found:
+ 	Assert(entry != NULL);
+ 	tag = entry->tag;
+ 
+ 	/*
+ 	 * Translate the parser representation which identifies this object
+ 	 * into ObjectAddress. get_object_address() will throw an error if
+      * the object does not exist, and will also acquire a lock on the
+      * target to guard against concurrent DROP operations.
+ 	 */
+ 	address = get_object_address(stmt->objtype, stmt->objname, stmt->objargs,
+ 								 &relation, ShareUpdateExclusiveLock);
+ 
+ 	/*
+ 	 * Privilege and integrity checks
+ 	 */
+ 	switch (stmt->objtype)
+ 	{
+ 		case OBJECT_SEQUENCE:
+ 		case OBJECT_TABLE:
+ 		case OBJECT_VIEW:
+ 		case OBJECT_COLUMN:
+ 			check_relation_relabel(stmt->objtype, relation);
+ 			break;
+ 
+ 		default:
+ 			elog(ERROR, "unrecognized object type: %d",
+ 				 (int)stmt->objtype);
+ 	}
+ 
+ 	/*
+ 	 * Privilege and validation checks by external security provider
+ 	 */
+ 	foreach (cell, esp_relabel_hook_list)
+ 	{
+ 		entry = lfirst(cell);
+ 
+ 		Assert(entry->hook);
+ 		/*
+ 		 * If the supplied FOR <provider> clause is not matched with
+ 		 * this entry, we call the security hook without new security
+ 		 * label. The ESP shall check the privilege to update one of
+ 		 * properties of the supecified database object.
+ 		 */
+ 		if (strcmp(tag, entry->tag) == 0)
+ 			(*entry->hook)(&address, stmt->seclabel);
+ 		else
+ 			(*entry->hook)(&address, NULL);
+ 	}
+ 
+ 	/*
+ 	 * Do actual relabeling. 
+ 	 */
+ 	SetSecurityLabel(&address, tag, stmt->seclabel);
+ 
+ 	/*
+ 	 * If get_object_address() opened the relation for us, we close it to keep
+ 	 * the reference count correct - but we retain any locks acquired by
+ 	 * get_object_address() until commit time, to guard against concurrent
+ 	 * activity.
+ 	 */
+ 	if (relation != NULL)
+ 		relation_close(relation, NoLock);
+ }
*** a/src/backend/nodes/copyfuncs.c
--- b/src/backend/nodes/copyfuncs.c
***************
*** 2607,2612 **** _copyCommentStmt(CommentStmt *from)
--- 2607,2626 ----
  	return newnode;
  }
  
+ static SecLabelStmt *
+ _copySecLabelStmt(SecLabelStmt *from)
+ {
+ 	SecLabelStmt *newnode = makeNode(SecLabelStmt);
+ 
+ 	COPY_SCALAR_FIELD(objtype);
+ 	COPY_NODE_FIELD(objname);
+ 	COPY_NODE_FIELD(objargs);
+ 	COPY_STRING_FIELD(tag);
+ 	COPY_STRING_FIELD(seclabel);
+ 
+ 	return newnode;
+ }
+ 
  static FetchStmt *
  _copyFetchStmt(FetchStmt *from)
  {
***************
*** 3958,3963 **** copyObject(void *from)
--- 3972,3980 ----
  		case T_CommentStmt:
  			retval = _copyCommentStmt(from);
  			break;
+ 		case T_SecLabelStmt:
+ 			retval = _copySecLabelStmt(from);
+ 			break;
  		case T_FetchStmt:
  			retval = _copyFetchStmt(from);
  			break;
*** a/src/backend/nodes/equalfuncs.c
--- b/src/backend/nodes/equalfuncs.c
***************
*** 1164,1169 **** _equalCommentStmt(CommentStmt *a, CommentStmt *b)
--- 1164,1181 ----
  }
  
  static bool
+ _equalSecLabelStmt(SecLabelStmt *a, SecLabelStmt *b)
+ {
+ 	COMPARE_SCALAR_FIELD(objtype);
+ 	COMPARE_NODE_FIELD(objname);
+ 	COMPARE_NODE_FIELD(objargs);
+ 	COMPARE_STRING_FIELD(tag);
+ 	COMPARE_STRING_FIELD(seclabel);
+ 
+ 	return true;
+ }
+ 
+ static bool
  _equalFetchStmt(FetchStmt *a, FetchStmt *b)
  {
  	COMPARE_SCALAR_FIELD(direction);
***************
*** 2624,2629 **** equal(void *a, void *b)
--- 2636,2644 ----
  		case T_CommentStmt:
  			retval = _equalCommentStmt(a, b);
  			break;
+ 		case T_SecLabelStmt:
+ 			retval = _equalSecLabelStmt(a, b);
+ 			break;
  		case T_FetchStmt:
  			retval = _equalFetchStmt(a, b);
  			break;
*** a/src/backend/parser/gram.y
--- b/src/backend/parser/gram.y
***************
*** 204,210 **** static TypeName *TableFuncTypeName(List *columns);
  		CreateFunctionStmt AlterFunctionStmt ReindexStmt RemoveAggrStmt
  		RemoveFuncStmt RemoveOperStmt RenameStmt RevokeStmt RevokeRoleStmt
  		RuleActionStmt RuleActionStmtOrEmpty RuleStmt
! 		SelectStmt TransactionStmt TruncateStmt
  		UnlistenStmt UpdateStmt VacuumStmt
  		VariableResetStmt VariableSetStmt VariableShowStmt
  		ViewStmt CheckPointStmt CreateConversionStmt
--- 204,210 ----
  		CreateFunctionStmt AlterFunctionStmt ReindexStmt RemoveAggrStmt
  		RemoveFuncStmt RemoveOperStmt RenameStmt RevokeStmt RevokeRoleStmt
  		RuleActionStmt RuleActionStmtOrEmpty RuleStmt
! 		SecLabelStmt SelectStmt TransactionStmt TruncateStmt
  		UnlistenStmt UpdateStmt VacuumStmt
  		VariableResetStmt VariableSetStmt VariableShowStmt
  		ViewStmt CheckPointStmt CreateConversionStmt
***************
*** 422,427 **** static TypeName *TableFuncTypeName(List *columns);
--- 422,429 ----
  %type <str>		OptTableSpace OptConsTableSpace OptTableSpaceOwner
  %type <list>	opt_check_option
  
+ %type <str>		label_item opt_esp
+ 
  %type <target>	xml_attribute_el
  %type <list>	xml_attribute_list xml_attributes
  %type <node>	xml_root_version opt_xml_root_standalone
***************
*** 499,505 **** static TypeName *TableFuncTypeName(List *columns);
  
  	KEY
  
! 	LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
  	LEAST LEFT LEVEL LIKE LIMIT LISTEN LOAD LOCAL LOCALTIME LOCALTIMESTAMP
  	LOCATION LOCK_P LOGIN_P
  
--- 501,507 ----
  
  	KEY
  
! 	LABEL LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
  	LEAST LEFT LEVEL LIKE LIMIT LISTEN LOAD LOCAL LOCALTIME LOCALTIMESTAMP
  	LOCATION LOCK_P LOGIN_P
  
***************
*** 737,742 **** stmt :
--- 739,745 ----
  			| RevokeStmt
  			| RevokeRoleStmt
  			| RuleStmt
+ 			| SecLabelStmt
  			| SelectStmt
  			| TransactionStmt
  			| TruncateStmt
***************
*** 4327,4332 **** comment_text:
--- 4330,4390 ----
  			| NULL_P							{ $$ = NULL; }
  		;
  
+ 
+ /*****************************************************************************
+  *
+  * ALTER THING name SECURITY LABEL TO label
+  *
+  *****************************************************************************/
+ 
+ SecLabelStmt: SECURITY LABEL opt_esp ON TABLE any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_TABLE;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 			| SECURITY LABEL opt_esp ON COLUMN any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_COLUMN;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 			| SECURITY LABEL opt_esp ON SEQUENCE any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_SEQUENCE;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 			| SECURITY LABEL opt_esp ON VIEW any_name IS label_item
+ 				{
+ 					SecLabelStmt *n = makeNode(SecLabelStmt);
+ 
+ 					n->objtype = OBJECT_VIEW;
+ 					n->objname = $6;
+ 					n->tag = $3;
+ 					n->seclabel = $8;
+ 					$$ = (Node *)n;
+ 				}
+ 		;
+ 
+ label_item:		Sconst			{ $$ = $1; }
+ 
+ opt_esp:	FOR Sconst		{ $$ = $2; }
+ 			| /* empty */		{ $$ = NULL; }
+ 		;
+ 
  /*****************************************************************************
   *
   *		QUERY:
***************
*** 10993,10998 **** unreserved_keyword:
--- 11051,11057 ----
  			| INVOKER
  			| ISOLATION
  			| KEY
+ 			| LABEL
  			| LANGUAGE
  			| LARGE_P
  			| LAST_P
*** a/src/backend/tcop/utility.c
--- b/src/backend/tcop/utility.c
***************
*** 218,223 **** check_xact_readonly(Node *parsetree)
--- 218,224 ----
  		case T_AlterUserMappingStmt:
  		case T_DropUserMappingStmt:
  		case T_AlterTableSpaceOptionsStmt:
+ 		case T_SecLabelStmt:
  			PreventCommandIfReadOnly(CreateCommandTag(parsetree));
  			break;
  		default:
***************
*** 663,668 **** standard_ProcessUtility(Node *parsetree,
--- 664,673 ----
  			CommentObject((CommentStmt *) parsetree);
  			break;
  
+ 		case T_SecLabelStmt:
+ 			ExecSecLabelStmt((SecLabelStmt *) parsetree);
+ 			break;
+ 
  		case T_CopyStmt:
  			{
  				uint64		processed;
***************
*** 1592,1597 **** CreateCommandTag(Node *parsetree)
--- 1597,1606 ----
  			tag = "COMMENT";
  			break;
  
+ 		case T_SecLabelStmt:
+ 			tag = "SECURITY LABEL";
+ 			break;
+ 
  		case T_CopyStmt:
  			tag = "COPY";
  			break;
***************
*** 2314,2319 **** GetCommandLogLevel(Node *parsetree)
--- 2323,2332 ----
  			lev = LOGSTMT_DDL;
  			break;
  
+ 		case T_SecLabelStmt:
+ 			lev = LOGSTMT_DDL;
+ 			break;
+ 
  		case T_CopyStmt:
  			if (((CopyStmt *) parsetree)->is_from)
  				lev = LOGSTMT_MOD;
*** a/src/bin/pg_dump/pg_backup.h
--- b/src/bin/pg_dump/pg_backup.h
***************
*** 103,108 **** typedef struct _restoreOptions
--- 103,109 ----
  										 * restore */
  	int			use_setsessauth;/* Use SET SESSION AUTHORIZATION commands
  								 * instead of OWNER TO */
+ 	int			skip_seclabel;	/* Skip security label entries */
  	char	   *superuser;		/* Username to use as superuser */
  	char	   *use_role;		/* Issue SET ROLE to this */
  	int			dataOnly;
*** a/src/bin/pg_dump/pg_backup_archiver.c
--- b/src/bin/pg_dump/pg_backup_archiver.c
***************
*** 2275,2280 **** _tocEntryRequired(TocEntry *te, RestoreOptions *ropt, bool include_acls)
--- 2275,2284 ----
  	if ((!include_acls || ropt->aclsSkip) && _tocEntryIsACL(te))
  		return 0;
  
+ 	/* If it's security labels, maybe ignore it */
+ 	if (ropt->skip_seclabel && strcmp(te->desc, "LABEL") == 0)
+ 		return 0;
+ 
  	/* Ignore DATABASE entry unless we should create it */
  	if (!ropt->createDB && strcmp(te->desc, "DATABASE") == 0)
  		return 0;
***************
*** 2341,2346 **** _tocEntryRequired(TocEntry *te, RestoreOptions *ropt, bool include_acls)
--- 2345,2352 ----
  			(strcmp(te->desc, "ACL") == 0 &&
  			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0) ||
  			(strcmp(te->desc, "COMMENT") == 0 &&
+ 			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0) ||
+ 			(strcmp(te->desc, "LABEL") == 0 &&
  			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0))
  			res = res & REQ_DATA;
  		else
*** a/src/bin/pg_dump/pg_dump.c
--- b/src/bin/pg_dump/pg_dump.c
***************
*** 125,130 **** static int	binary_upgrade = 0;
--- 125,131 ----
  static int	disable_dollar_quoting = 0;
  static int	dump_inserts = 0;
  static int	column_inserts = 0;
+ static int	security_label = 0;
  
  
  static void help(const char *progname);
***************
*** 183,188 **** static void dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
--- 184,194 ----
  		const char *tag, const char *nspname, const char *owner,
  		const char *acls);
  
+ static void dumpSecLabel(Archive *fout,
+ 						 CatalogId objCatId, DumpId objDumpId,
+ 						 const char *type, const char *target,
+ 						 const char *nspname, const char *owner);
+ 
  static void getDependencies(void);
  static void getDomainConstraints(TypeInfo *tyinfo);
  static void getTableData(TableInfo *tblinfo, int numTables, bool oids);
***************
*** 300,305 **** main(int argc, char **argv)
--- 306,312 ----
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+ 		{"security-label", no_argument, &security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 448,453 **** main(int argc, char **argv)
--- 455,462 ----
  					outputNoTablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
+ 				else if (strcmp(optarg, "security-label") == 0)
+ 					security_label = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 643,648 **** main(int argc, char **argv)
--- 652,666 ----
  		do_sql_command(g_conn, "SET quote_all_identifiers = true");
  
  	/*
+ 	 * Disables security label support if server version < v9.1.x
+ 	 */
+ 	if (security_label && g_fout->remoteVersion < 90100)
+ 	{
+ 		write_msg(NULL, "Server does not support security labels\n");
+ 		security_label = 0;
+ 	}
+ 
+ 	/*
  	 * Start serializable transaction to dump consistent data.
  	 */
  	do_sql_command(g_conn, "BEGIN");
***************
*** 839,844 **** help(const char *progname)
--- 857,863 ----
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
+ 	printf(_("  --security-label            also dump security labels\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
***************
*** 10435,10440 **** dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
--- 10454,10564 ----
  }
  
  /*
+  * dumpSecLabel 
+  *
+  * It dumps any security labels associated with the object handed
+  * to this routine. The routine takes a constant character string
+  * for the target part of the security-label command, plus the
+  * namespace and owner of the object (for labeling the ArchiveEntry),
+  * plus catalogId which is lookup key for pg_seclabel, and dumpId
+  * for the object.
+  * If a matching pg_seclabel entry is found, it is dumped.
+  */
+ static void
+ dumpSecLabel(Archive *fout, CatalogId objCatId, DumpId objDumpId,
+ 			 const char *type, const char *target,
+ 			 const char *nspname, const char *owner)
+ {
+ 	PGresult	   *res;
+ 	PQExpBuffer		lquery;
+ 	PQExpBuffer		cquery;
+ 	PQExpBuffer		tgbuf;
+ 	int				i_attname;
+ 	int				i_tag;
+ 	int				i_label;
+ 	int				i, ntups;
+ 
+ 	/* do nothing, if security label dump is not enabled */
+ 	if (!security_label)
+ 		return;
+ 
+ 	/* --data-only skips security labels *except* large object */
+ 	if (dataOnly && strcmp(type, "LARGE OBJECT") != 0)
+ 		return;
+ 
+ 	/*
+ 	 * Fetch security labels associated with the object
+ 	 */
+ 	lquery = createPQExpBuffer();
+ 	cquery = createPQExpBuffer();
+ 	tgbuf = createPQExpBuffer();
+ 
+ 	appendPQExpBuffer(lquery,
+ 					  "SELECT a.attname, s.tag, s.label"
+ 					  "  FROM pg_catalog.pg_seclabel s"
+ 					  "       LEFT OUTER JOIN"
+ 					  "       pg_catalog.pg_attribute a"
+ 					  "       ON s.objoid = a.attrelid AND"
+ 					  "          s.subid = a.attnum"
+ 					  "  WHERE reloid = %u AND objoid = %u",
+ 					  objCatId.tableoid, objCatId.oid);
+ 
+ 	res = PQexec(g_conn, lquery->data);
+ 	check_sql_result(res, g_conn, lquery->data, PGRES_TUPLES_OK);
+ 
+ 	i_attname	= PQfnumber(res, "attname");
+ 	i_tag		= PQfnumber(res, "tag");
+ 	i_label		= PQfnumber(res, "label");
+ 
+ 	ntups = PQntuples(res);
+ 
+ 	for (i = 0; i < ntups; i++)
+ 	{
+ 		if (strcmp(type, "TABLE") == 0 &&
+ 			!PQgetisnull(res, i, i_attname))
+ 		{
+ 			appendPQExpBuffer(cquery,
+ 							  "SECURITY LABEL FOR '%s'"
+ 							  " ON COLUMN %s.%s IS '%s';\n",
+ 							  PQgetvalue(res, i, i_tag),
+ 							  target,
+ 							  fmtId(PQgetvalue(res, i, i_attname)),
+ 							  PQgetvalue(res, i, i_label));
+ 			continue;
+ 		}
+ 
+ 		/*
+ 		 * a.attname can be available only when type = "TABLE",
+ 		 * so we expect it will be always NULL. Elsewhere, we assume
+ 		 * it as a data corruption, so simply ignored.
+ 		 */
+ 		if (!PQgetisnull(res, i, i_attname))
+ 			continue;
+ 
+ 		appendPQExpBuffer(cquery,
+ 						  "SECURITY LABEL FOR '%s' ON %s %s IS '%s';\n",
+ 						  PQgetvalue(res, i, i_tag),
+ 						  type, target,
+ 						  PQgetvalue(res, i, i_label));
+ 	}
+ 	PQclear(res);
+ 
+ 	if (cquery->len > 0)
+ 	{
+ 		appendPQExpBuffer(tgbuf, "%s %s", type, target);
+ 		ArchiveEntry(fout, nilCatalogId, createDumpId(),
+ 					 tgbuf->data, nspname, NULL, owner,
+ 					 false, "LABEL", SECTION_NONE,
+ 					 cquery->data, "", NULL,
+ 					 &(objDumpId), 1,
+ 					 NULL, NULL);
+ 	}
+ 	destroyPQExpBuffer(lquery);
+ 	destroyPQExpBuffer(cquery);
+ 	destroyPQExpBuffer(tgbuf);
+ }
+ 
+ /*
   * dumpTable
   *	  write out to fout the declarations (not data) of a user-defined table
   */
***************
*** 10458,10463 **** dumpTable(Archive *fout, TableInfo *tbinfo)
--- 10582,10594 ----
  				tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
  				tbinfo->relacl);
  
+ 		/* Handle the security label here */
+ 		dumpSecLabel(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId,
+ 					 (tbinfo->relkind == RELKIND_SEQUENCE ? "SEQUENCE" :
+ 					  (tbinfo->relkind == RELKIND_VIEW ? "VIEW" : "TABLE")),
+ 					 namecopy,
+ 					 tbinfo->dobj.namespace->dobj.name,
+ 					 tbinfo->rolname);
  		/*
  		 * Handle column ACLs, if any.	Note: we pull these with a separate
  		 * query rather than trying to fetch them during getTableAttrs, so
*** a/src/bin/pg_dump/pg_dumpall.c
--- b/src/bin/pg_dump/pg_dumpall.c
***************
*** 69,74 **** static int	disable_triggers = 0;
--- 69,75 ----
  static int	inserts = 0;
  static int	no_tablespaces = 0;
  static int	use_setsessauth = 0;
+ static int	security_label = 0;
  static int	server_version;
  
  static FILE *OPF;
***************
*** 133,138 **** main(int argc, char *argv[])
--- 134,140 ----
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+ 		{"security-label", no_argument, &security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 286,291 **** main(int argc, char *argv[])
--- 288,295 ----
  					no_tablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
+ 				else if (strcmp(optarg, "security-label") == 0)
+ 					security_label = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 371,376 **** main(int argc, char *argv[])
--- 375,382 ----
  		appendPQExpBuffer(pgdumpopts, " --quote-all-identifiers");
  	if (use_setsessauth)
  		appendPQExpBuffer(pgdumpopts, " --use-set-session-authorization");
+ 	if (security_label)
+ 		appendPQExpBuffer(pgdumpopts, " --security-label");
  
  	/*
  	 * If there was a database specified on the command line, use that,
***************
*** 567,572 **** help(void)
--- 573,579 ----
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
+ 	printf(_("  --security-label            also dump security labels\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
*** a/src/bin/pg_dump/pg_restore.c
--- b/src/bin/pg_dump/pg_restore.c
***************
*** 76,81 **** main(int argc, char **argv)
--- 76,82 ----
  	static int	no_data_for_failed_tables = 0;
  	static int	outputNoTablespaces = 0;
  	static int	use_setsessauth = 0;
+ 	static int	skip_seclabel = 0;
  
  	struct option cmdopts[] = {
  		{"clean", 0, NULL, 'c'},
***************
*** 116,121 **** main(int argc, char **argv)
--- 117,123 ----
  		{"no-tablespaces", no_argument, &outputNoTablespaces, 1},
  		{"role", required_argument, NULL, 2},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+ 		{"no-security-label", no_argument, &skip_seclabel, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 262,267 **** main(int argc, char **argv)
--- 264,271 ----
  					outputNoTablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
+ 				else if (strcmp(optarg, "no-security-label") == 0)
+ 					skip_seclabel = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 337,342 **** main(int argc, char **argv)
--- 341,347 ----
  	opts->noDataForFailedTables = no_data_for_failed_tables;
  	opts->noTablespace = outputNoTablespaces;
  	opts->use_setsessauth = use_setsessauth;
+ 	opts->skip_seclabel = skip_seclabel;
  
  	if (opts->formatName)
  	{
***************
*** 442,447 **** usage(const char *progname)
--- 447,453 ----
  			 "                           do not restore data of tables that could not be\n"
  			 "                           created\n"));
  	printf(_("  --no-tablespaces         do not restore tablespace assignments\n"));
+ 	printf(_("  --no-security-label      do not restore security labels\n"));
  	printf(_("  --role=ROLENAME          do SET ROLE before restore\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                           use SET SESSION AUTHORIZATION commands instead of\n"
*** a/src/include/catalog/indexing.h
--- b/src/include/catalog/indexing.h
***************
*** 281,286 **** DECLARE_UNIQUE_INDEX(pg_default_acl_oid_index, 828, on pg_default_acl using btre
--- 281,289 ----
  DECLARE_UNIQUE_INDEX(pg_db_role_setting_databaseid_rol_index, 2965, on pg_db_role_setting using btree(setdatabase oid_ops, setrole oid_ops));
  #define DbRoleSettingDatidRolidIndexId	2965
  
+ DECLARE_UNIQUE_INDEX(pg_seclabel_object_index, 3038, on pg_seclabel using btree(reloid oid_ops, objoid oid_ops, subid int4_ops, tag text_ops));
+ #define SecLabelObjectIndexId				3038
+ 
  /* last step of initialization script: build the indexes declared above */
  BUILD_INDICES
  
*** /dev/null
--- b/src/include/catalog/pg_seclabel.h
***************
*** 0 ****
--- 1,43 ----
+ /* -------------------------------------------------------------------------
+  *
+  * pg_seclabel.h
+  *    definition of the system "security label" relation (pg_seclabel)
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  *
+  * -------------------------------------------------------------------------
+  */
+ #ifndef PG_SECLABEL_H
+ #define PG_SECLABEL_H
+ 
+ #include "catalog/genbki.h"
+ 
+ /* ----------------
+  *		pg_seclabel definition.  cpp turns this into
+  *		typedef struct FormData_pg_seclabel
+  * ----------------
+  */
+ #define SecLabelRelationId		3037
+ 
+ CATALOG(pg_seclabel,3037) BKI_WITHOUT_OIDS
+ {
+ 	Oid			reloid;		/* OID of table containing the object */
+ 	Oid			objoid;		/* OID of the object itself */
+ 	int4		subid;		/* column number, or 0 if not used */
+ 	text		tag;		/* identifier of external security provider */
+ 	text		label;		/* security label of the object */
+ } FormData_pg_seclabel;
+ 
+ /* ----------------
+  *		compiler constants for pg_seclabel
+  * ----------------
+  */
+ #define Natts_pg_seclabel			5
+ #define Anum_pg_seclabel_reloid		1
+ #define Anum_pg_seclabel_objoid		2
+ #define Anum_pg_seclabel_subid		3
+ #define Anum_pg_seclabel_tag		4
+ #define Anum_pg_seclabel_label		5
+ 
+ #endif	/* PG_SECLABEL_H */
*** a/src/include/catalog/toasting.h
--- b/src/include/catalog/toasting.h
***************
*** 45,50 **** DECLARE_TOAST(pg_constraint, 2832, 2833);
--- 45,51 ----
  DECLARE_TOAST(pg_description, 2834, 2835);
  DECLARE_TOAST(pg_proc, 2836, 2837);
  DECLARE_TOAST(pg_rewrite, 2838, 2839);
+ DECLARE_TOAST(pg_seclabel, 3039, 3040);
  DECLARE_TOAST(pg_statistic, 2840, 2841);
  DECLARE_TOAST(pg_trigger, 2336, 2337);
  
*** /dev/null
--- b/src/include/commands/seclabel.h
***************
*** 0 ****
--- 1,36 ----
+ /*
+  * seclabel.h
+  *
+  * Prototypes for functions in commands/seclabel.c
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  */
+ #ifndef SECLABEL_H
+ #define SECLABEL_H
+ 
+ #include "catalog/objectaddress.h"
+ #include "nodes/primnodes.h"
+ #include "nodes/parsenodes.h"
+ 
+ /*
+  * Internal APIs
+  */
+ extern char *GetSecurityLabel(const ObjectAddress *object,
+ 							  const char *tag);
+ extern void  SetSecurityLabel(const ObjectAddress *object,
+ 							  const char *tag,
+ 							  const char *seclabel);
+ extern void  DeleteSecurityLabel(const ObjectAddress *object);
+ 
+ /*
+  * Statement and ESP hook support
+  */
+ extern void ExecSecLabelStmt(SecLabelStmt *stmt);
+ 
+ typedef void (*check_object_relabel_type)(const ObjectAddress *object,
+ 										  const char *seclabel);
+ extern void register_object_relabel_hook(const char *tag,
+ 										 check_object_relabel_type hook);
+ 
+ #endif	/* SECLABEL_H */
*** a/src/include/nodes/nodes.h
--- b/src/include/nodes/nodes.h
***************
*** 347,352 **** typedef enum NodeTag
--- 347,353 ----
  	T_AlterUserMappingStmt,
  	T_DropUserMappingStmt,
  	T_AlterTableSpaceOptionsStmt,
+ 	T_SecLabelStmt,
  
  	/*
  	 * TAGS FOR PARSE TREE NODES (parsenodes.h)
*** a/src/include/nodes/parsenodes.h
--- b/src/include/nodes/parsenodes.h
***************
*** 1850,1855 **** typedef struct CommentStmt
--- 1850,1869 ----
  } CommentStmt;
  
  /* ----------------------
+  *				SECURITY LABEL Statemetn
+  * ----------------------
+  */
+ typedef struct SecLabelStmt
+ {
+ 	NodeTag		type;
+ 	ObjectType	objtype;		/* Object's type */
+ 	List	   *objname;		/* Qualified name of the object */
+ 	List	   *objargs;		/* Arguments if needed (eg, for functions) */
+ 	char	   *tag;			/* Identifier of ESP, if specified */
+ 	char	   *seclabel;		/* New security label to be assigned */
+ } SecLabelStmt;
+ 
+ /* ----------------------
   *		Declare Cursor Statement
   *
   * Note: the "query" field of DeclareCursorStmt is only used in the raw grammar
*** a/src/include/parser/kwlist.h
--- b/src/include/parser/kwlist.h
***************
*** 208,213 **** PG_KEYWORD("isnull", ISNULL, TYPE_FUNC_NAME_KEYWORD)
--- 208,214 ----
  PG_KEYWORD("isolation", ISOLATION, UNRESERVED_KEYWORD)
  PG_KEYWORD("join", JOIN, TYPE_FUNC_NAME_KEYWORD)
  PG_KEYWORD("key", KEY, UNRESERVED_KEYWORD)
+ PG_KEYWORD("label", LABEL, UNRESERVED_KEYWORD)
  PG_KEYWORD("language", LANGUAGE, UNRESERVED_KEYWORD)
  PG_KEYWORD("large", LARGE_P, UNRESERVED_KEYWORD)
  PG_KEYWORD("last", LAST_P, UNRESERVED_KEYWORD)
*** a/src/include/utils/errcodes.h
--- b/src/include/utils/errcodes.h
***************
*** 260,265 ****
--- 260,266 ----
  #define ERRCODE_DATATYPE_MISMATCH			MAKE_SQLSTATE('4','2', '8','0','4')
  #define ERRCODE_INDETERMINATE_DATATYPE		MAKE_SQLSTATE('4','2', 'P','1','8')
  #define ERRCODE_WRONG_OBJECT_TYPE			MAKE_SQLSTATE('4','2', '8','0','9')
+ #define ERRCODE_INVALID_SECLABEL			MAKE_SQLSTATE('4','2', 'P','2','1')
  /*
   * Note: for ERRCODE purposes, we divide namable objects into these categories:
   * databases, schemas, prepared statements, cursors, tables, columns,
*** a/src/test/regress/expected/sanity_check.out
--- b/src/test/regress/expected/sanity_check.out
***************
*** 114,119 **** SELECT relname, relhasindex
--- 114,120 ----
   pg_pltemplate           | t
   pg_proc                 | t
   pg_rewrite              | t
+  pg_seclabel             | t
   pg_shdepend             | t
   pg_shdescription        | t
   pg_statistic            | t
***************
*** 153,159 **** SELECT relname, relhasindex
   timetz_tbl              | f
   tinterval_tbl           | f
   varchar_tbl             | f
! (142 rows)
  
  --
  -- another sanity check: every system catalog that has OIDs should have
--- 154,160 ----
   timetz_tbl              | f
   tinterval_tbl           | f
   varchar_tbl             | f
! (143 rows)
  
  --
  -- another sanity check: every system catalog that has OIDs should have

diff --git a/contrib/dummy_seclabel/Makefile b/contrib/dummy_seclabel/Makefile
new file mode 100644
index 0000000..316c27f
diff --git a/contrib/dummy_seclabel/dummy_seclabel.c b/contrib/dummy_seclabel/dummy_seclabel.c
new file mode 100644
index 0000000..e46fc45
diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml
index ab11b15..3758b64 100644
--- a/doc/src/sgml/catalogs.sgml
+++ b/doc/src/sgml/catalogs.sgml
@@ -209,6 +209,11 @@
      </row>
 
      <row>
+      <entry><link linkend="catalog-pg-seclabel"><structname>pg_seclabel</structname></link></entry>
+      <entry>security labels on database objects</entry>
+     </row>
+
+     <row>
       <entry><link linkend="catalog-pg-shdepend"><structname>pg_shdepend</structname></link></entry>
       <entry>dependencies on shared objects</entry>
      </row>
@@ -4229,6 +4234,81 @@
  </sect1>
 
 
+ <sect1 id="catalog-pg-seclabel">
+  <title><structname>pg_seclabel</structname></title>
+
+  <indexterm zone="catalog-pg-seclabel">
+   <primary>pg_seclabel</primary>
+  </indexterm>
+
+  <para>
+   The catalog <structname>pg_seclabel</structname> stores security
+   labels on database objects.  See the 
+   <xref linkend="sql-security-label"> statement.
+  </para>
+
+  <table>
+   <title><structname>pg_seclabel</structname> Columns</title>
+
+   <tgroup cols="4">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Type</entry>
+      <entry>References</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><structfield>objoid</structfield></entry>
+      <entry><type>oid</type></entry>
+      <entry>any OID column</entry>
+      <entry>The OID of the object this security label assigned on</entry>
+     </row>
+
+     <row>
+      <entry><structfield>classoid</structfield></entry>
+      <entry><type>oid</type></entry>
+      <entry><literal><link linkend="catalog-pg-class"><structname>pg_class</structname></link>.oid</literal></entry>
+      <entry>The OID of the system catalog this object appears in</entry>
+     </row>
+
+     <row>
+      <entry><structfield>objsubid</structfield></entry>
+      <entry><type>int4</type></entry>
+      <entry></entry>
+      <entry>
+       For a security label on a table column, this is the column number (the
+       <structfield>objoid</> and <structfield>classoid</> refer to
+       the table itself).  For all other object types, this column is
+       zero.
+      </entry>
+     </row>
+
+     <row>
+      <entry><structfield>provider</structfield></entry>
+      <entry><type>text</type></entry>
+      <entry></entry>
+      <entry>
+       The label provider associated with this label.
+      </entry>
+     </row>
+
+     <row>
+      <entry><structfield>label</structfield></entry>
+      <entry><type>text</type></entry>
+      <entry></entry>
+      <entry>
+       The security label applied to this object.
+      </entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
  <sect1 id="catalog-pg-shdepend">
   <title><structname>pg_shdepend</structname></title>
 
diff --git a/doc/src/sgml/ref/allfiles.sgml b/doc/src/sgml/ref/allfiles.sgml
index 7b97883..f5d67a2 100644
--- a/doc/src/sgml/ref/allfiles.sgml
+++ b/doc/src/sgml/ref/allfiles.sgml
@@ -132,6 +132,7 @@ Complete list of usable sgml source files in this directory.
 <!entity rollbackPrepared   system "rollback_prepared.sgml">
 <!entity rollbackTo         system "rollback_to.sgml">
 <!entity savepoint          system "savepoint.sgml">
+<!entity securityLabel      system "security_label.sgml">
 <!entity select             system "select.sgml">
 <!entity selectInto         system "select_into.sgml">
 <!entity set                system "set.sgml">
diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml
index 1b8402e..8242b53 100644
--- a/doc/src/sgml/ref/pg_dump.sgml
+++ b/doc/src/sgml/ref/pg_dump.sgml
@@ -778,6 +778,16 @@ PostgreSQL documentation
        </para>
       </listitem>
      </varlistentry>
+
+     <varlistentry>
+      <term><option>--security-label</option></term>
+      <listitem>
+       <para>
+        With this option, it also outputs security labels of database
+        objects to be dumped, if labeled.
+       </para>
+      </listitem>
+     </varlistentry>
     </variablelist>
    </para>
  </refsect1>
diff --git a/doc/src/sgml/ref/pg_dumpall.sgml b/doc/src/sgml/ref/pg_dumpall.sgml
index 14fa109..68dcc35 100644
--- a/doc/src/sgml/ref/pg_dumpall.sgml
+++ b/doc/src/sgml/ref/pg_dumpall.sgml
@@ -493,6 +493,15 @@ PostgreSQL documentation
        </para>
       </listitem>
      </varlistentry>
+     <varlistentry>
+      <term><option>--security-label</option></term>
+      <listitem>
+       <para>
+        With this option, it also outputs security labels of database
+        objects to be dumped, if labeled.
+       </para>
+      </listitem>
+     </varlistentry>
    </variablelist>
   </para>
  </refsect1>
diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgml
index 9dc2511..7860696 100644
--- a/doc/src/sgml/ref/pg_restore.sgml
+++ b/doc/src/sgml/ref/pg_restore.sgml
@@ -329,6 +329,16 @@
      </varlistentry>
 
      <varlistentry>
+      <term><option>--no-security-label</option></term>
+      <listitem>
+       <para>
+        Do not output commands to restore security labels,
+        even if the archive contains them.
+       </para>
+      </listitem>
+     </varlistentry>
+
+     <varlistentry>
       <term><option>-P <replaceable class="parameter">function-name(argtype [, ...])</replaceable></option></term>
       <term><option>--function=<replaceable class="parameter">function-name(argtype [, ...])</replaceable></option></term>
       <listitem>
diff --git a/doc/src/sgml/ref/security_label.sgml b/doc/src/sgml/ref/security_label.sgml
new file mode 100644
index 0000000..7fce58b
--- /dev/null
+++ b/doc/src/sgml/ref/security_label.sgml
@@ -0,0 +1,194 @@
+<!--
+$PostgreSQL$
+PostgreSQL documentation
+-->
+
+<refentry id="SQL-SECURITY-LABEL">
+ <refmeta>
+  <refentrytitle>SECURITY LABEL</refentrytitle>
+  <manvolnum>7</manvolnum>
+  <refmiscinfo>SQL - Language Statements</refmiscinfo>
+ </refmeta>
+
+ <refnamediv>
+  <refname>SECURITY LABEL</refname>
+  <refpurpose>define or change a security label applied to an object</refpurpose>
+ </refnamediv>
+
+ <indexterm zone="sql-security-label">
+  <primary>SECURITY LABEL</primary>
+ </indexterm>
+
+ <refsynopsisdiv>
+<synopsis>
+SECURITY LABEL [ FOR <replaceable class="PARAMETER">provider</replaceable> ] ON
+{
+  TABLE <replaceable class="PARAMETER">object_name</replaceable> |
+  COLUMN <replaceable class="PARAMETER">table_name</replaceable>.<replaceable class="PARAMETER">column_name</replaceable> |
+  AGGREGATE <replaceable class="PARAMETER">agg_name</replaceable> (<replaceable class="PARAMETER">agg_type</replaceable> [, ...] ) |
+  DOMAIN <replaceable class="PARAMETER">object_name</replaceable> |
+  FUNCTION <replaceable class="PARAMETER">function_name</replaceable> ( [ [ <replaceable class="parameter">argmode</replaceable> ] [ <replaceable class="parameter">argname</replaceable> ] <replaceable class="parameter">argtype</replaceable> [, ...] ] ) |
+  LARGE OBJECT <replaceable class="PARAMETER">large_object_oid</replaceable> |
+  [ PROCEDURAL ] LANGUAGE <replaceable class="PARAMETER">object_name</replaceable> |
+  SCHEMA <replaceable class="PARAMETER">object_name</replaceable> |
+  SEQUENCE <replaceable class="PARAMETER">object_name</replaceable> |
+  TYPE <replaceable class="PARAMETER">object_name</replaceable> |
+  VIEW <replaceable class="PARAMETER">object_name</replaceable>
+} IS '<replaceable class="PARAMETER">label</replaceable>'
+</synopsis>
+ </refsynopsisdiv>
+
+ <refsect1>
+  <title>Description</title>
+
+  <para>
+   <command>SECURITY LABEL</command> applies a security label to a database
+   object.  An arbitrary number of security labels, one per label provider, can
+   be associated with a given database object.  Label providers are loadable
+   modules which register themselves by using the function
+   <function>register_label_provider</>.
+  </para>
+
+  <note>
+    <para>
+      <function>register_label_provider</> is not an SQL function; it can
+      only be called from C code loaded into the backend.
+    </para>
+  </note>
+
+  <para>
+   The label provider determines whether a given a label is valid and whether
+   it is permissible to assign that label to a given object.  The meaning of a
+   given label is likewise at the discretion of the label provider.
+   <productname>PostgreSQL</> places no restrictions on whether or how a
+   label provider must interpret security labels; it merely provides a
+   mechanism for storing them.  In practice, this facility is intended to allow
+   integration with label-based mandatory access control (MAC) systems such as
+   <productname>SE-Linux</>.  Such systems make all access control decisions
+   based on object labels, rather than traditional discretionary access control
+   (DAC) concepts such as users and groups.
+  </para>
+ </refsect1>
+
+ <refsect1>
+  <title>Parameters</title>
+
+  <variablelist>
+   <varlistentry>
+    <term><replaceable class="parameter">object_name</replaceable></term>
+    <term><replaceable class="parameter">table_name.column_name</replaceable></term>
+    <term><replaceable class="parameter">agg_name</replaceable></term>
+    <term><replaceable class="parameter">function_name</replaceable></term>
+    <listitem>
+     <para>
+      The name of the object to be commented.  Names of tables,
+      aggregates, domains, functions, sequences, types, and views can
+      be schema-qualified.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">provider</replaceable></term>
+    <listitem>
+     <para>
+      The name of the provider with which this label is to be associated.  The
+      named provider must be loaded and must consent to the proposed labeling
+      operation.  If exactly one provider is loaded, the provider name may be
+      omitted for brevity.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">argmode</replaceable></term>
+
+    <listitem>
+     <para>
+      The mode of a function argument: <literal>IN</>, <literal>OUT</>,
+      <literal>INOUT</>, or <literal>VARIADIC</>.
+      If omitted, the default is <literal>IN</>.
+      Note that <command>COMMENT ON FUNCTION</command> does not actually pay
+      any attention to <literal>OUT</> arguments, since only the input
+      arguments are needed to determine the function's identity.
+      So it is sufficient to list the <literal>IN</>, <literal>INOUT</>,
+      and <literal>VARIADIC</> arguments.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">argname</replaceable></term>
+
+    <listitem>
+     <para>
+      The name of a function argument.
+      Note that <command>COMMENT ON FUNCTION</command> does not actually pay
+      any attention to argument names, since only the argument data
+      types are needed to determine the function's identity.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">argtype</replaceable></term>
+
+    <listitem>
+     <para>
+      The data type(s) of the function's arguments (optionally 
+      schema-qualified), if any.
+     </para>
+    </listitem>
+   </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">large_object_oid</replaceable></term>
+    <listitem>
+     <para>
+      The OID of the large object.
+     </para>
+    </listitem>
+   </varlistentry>
+
+    <varlistentry>
+     <term><literal>PROCEDURAL</literal></term>
+
+     <listitem>
+      <para>
+       This is a noise word.
+      </para>
+     </listitem>
+    </varlistentry>
+
+   <varlistentry>
+    <term><replaceable class="parameter">label</replaceable></term>
+    <listitem>
+     <para>
+      The new security label, written as a string literal; or <literal>NULL</>
+      to drop the security label.
+     </para>
+    </listitem>
+   </varlistentry>
+  </variablelist>
+ </refsect1>
+
+ <refsect1>
+  <title>Examples</title>
+
+  <para>
+   The following example shows how the security label of a table might
+   be changed.
+
+<programlisting>
+SECURITY LABEL FOR selinux ON TABLE mytable IS 'system_u:object_r:sepgsql_table_t:s0';
+</programlisting>
+  </para>
+ </refsect1>
+
+ <refsect1>
+  <title>Compatibility</title>
+  <para>
+   There is no <command>SECURITY LABEL</command> command in the SQL standard.
+  </para>
+ </refsect1>
+</refentry>
diff --git a/doc/src/sgml/reference.sgml b/doc/src/sgml/reference.sgml
index 052fe0e..463746c 100644
--- a/doc/src/sgml/reference.sgml
+++ b/doc/src/sgml/reference.sgml
@@ -160,6 +160,7 @@
    &rollbackPrepared;
    &rollbackTo;
    &savepoint;
+   &securityLabel;
    &select;
    &selectInto;
    &set;
diff --git a/src/backend/catalog/Makefile b/src/backend/catalog/Makefile
index f4a7eb0..6a47f39 100644
--- a/src/backend/catalog/Makefile
+++ b/src/backend/catalog/Makefile
@@ -38,7 +38,7 @@ POSTGRES_BKI_SRCS = $(addprefix $(top_srcdir)/src/include/catalog/,\
 	pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
 	pg_ts_parser.h pg_ts_template.h \
 	pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
-	pg_default_acl.h \
+	pg_default_acl.h pg_seclabel.h \
 	toasting.h indexing.h \
     )
 
diff --git a/src/backend/catalog/dependency.c b/src/backend/catalog/dependency.c
index 62598ee..18e07eb 100644
--- a/src/backend/catalog/dependency.c
+++ b/src/backend/catalog/dependency.c
@@ -57,6 +57,7 @@
 #include "commands/defrem.h"
 #include "commands/proclang.h"
 #include "commands/schemacmds.h"
+#include "commands/seclabel.h"
 #include "commands/tablespace.h"
 #include "commands/trigger.h"
 #include "commands/typecmds.h"
@@ -1004,10 +1005,12 @@ deleteOneObject(const ObjectAddress *object, Relation depRel)
 	doDeletion(object);
 
 	/*
-	 * Delete any comments associated with this object.  (This is a convenient
-	 * place to do it instead of having every object type know to do it.)
+	 * Delete any comments or security labels associated with this object.
+	 * (This is a convenient place to do these things, rather than having every
+	 * object type know to do it.)
 	 */
 	DeleteComments(object->objectId, object->classId, object->objectSubId);
+	DeleteSecurityLabel(object);
 
 	/*
 	 * CommandCounterIncrement here to ensure that preceding changes are all
diff --git a/src/backend/commands/Makefile b/src/backend/commands/Makefile
index 4e9bf43..9d2a732 100644
--- a/src/backend/commands/Makefile
+++ b/src/backend/commands/Makefile
@@ -17,7 +17,7 @@ OBJS = aggregatecmds.o alter.o analyze.o async.o cluster.o comment.o  \
 	dbcommands.o define.o discard.o explain.o foreigncmds.o functioncmds.o \
 	indexcmds.o lockcmds.o operatorcmds.o opclasscmds.o \
 	portalcmds.o prepare.o proclang.o \
-	schemacmds.o sequence.o tablecmds.o tablespace.o trigger.o \
+	schemacmds.o seclabel.o sequence.o tablecmds.o tablespace.o trigger.o \
 	tsearchcmds.o typecmds.o user.o vacuum.o vacuumlazy.o \
 	variable.o view.o
 
diff --git a/src/backend/commands/seclabel.c b/src/backend/commands/seclabel.c
new file mode 100644
index 0000000..417ad88
--- /dev/null
+++ b/src/backend/commands/seclabel.c
@@ -0,0 +1,387 @@
+/* -------------------------------------------------------------------------
+ *
+ * seclabel.c
+ *    routines to support security label feature.
+ *
+ * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * -------------------------------------------------------------------------
+ */
+#include "postgres.h"
+
+#include "access/genam.h"
+#include "access/heapam.h"
+#include "catalog/catalog.h"
+#include "catalog/indexing.h"
+#include "catalog/namespace.h"
+#include "catalog/pg_seclabel.h"
+#include "commands/seclabel.h"
+#include "miscadmin.h"
+#include "utils/acl.h"
+#include "utils/builtins.h"
+#include "utils/fmgroids.h"
+#include "utils/lsyscache.h"
+#include "utils/memutils.h"
+#include "utils/tqual.h"
+
+/*
+ * For most object types, the permissions-checking logic is simple enough
+ * that it makes sense to just include it in CommentObject().  However,
+ * attributes require a bit more checking.
+ */
+static void CheckAttributeSecLabel(Relation relation);
+
+typedef struct
+{
+	const char *provider_name;
+	check_object_relabel_type	hook;
+} LabelProvider;
+
+static List *label_provider_list = NIL;
+
+/*
+ * ExecSecLabelStmt --
+ *
+ * Apply a security label to a database object.
+ */
+void
+ExecSecLabelStmt(SecLabelStmt *stmt)
+{
+	LabelProvider *provider = NULL;
+	ObjectAddress	address;
+	Relation		relation;
+	ListCell	   *lc;
+
+	/*
+	 * Find the named label provider, or if none specified, check whether
+	 * there's exactly one, and if so use it.
+	 */
+	if (stmt->provider == NULL)
+	{
+		if (label_provider_list == NIL)
+			ereport(ERROR,
+					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+				 errmsg("security label providers have been loaded")));
+		if (lnext(list_head(label_provider_list)) != NULL)
+			ereport(ERROR,
+					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+				 errmsg("must specify provider when multiple security label providers have been loaded")));
+		provider = (LabelProvider *) linitial(label_provider_list);
+	}
+	else
+	{
+		foreach (lc, label_provider_list)
+		{
+			LabelProvider *lp = lfirst(lc);
+
+			if (strcmp(stmt->provider, lp->provider_name) == 0)
+			{
+				provider = lp;
+				break;
+			}
+		}
+		if (provider == NULL)
+			ereport(ERROR,
+					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+					 errmsg("security label provider \"%s\" is not loaded",
+							stmt->provider)));
+	}
+
+	/*
+	 * Translate the parser representation which identifies this object
+	 * into an ObjectAddress. get_object_address() will throw an error if
+     * the object does not exist, and will also acquire a lock on the
+     * target to guard against concurrent modifications.
+	 */
+	address = get_object_address(stmt->objtype, stmt->objname, stmt->objargs,
+								 &relation, ShareUpdateExclusiveLock);
+
+	/* Privilege and integrity checks. */
+	switch (stmt->objtype)
+	{
+		case OBJECT_SEQUENCE:
+		case OBJECT_TABLE:
+		case OBJECT_VIEW:
+			if (!pg_class_ownercheck(RelationGetRelid(relation), GetUserId()))
+				aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_CLASS,
+							   RelationGetRelationName(relation));
+			break;
+		case OBJECT_COLUMN:
+			CheckAttributeSecLabel(relation);
+			break;
+		case OBJECT_TYPE:
+			if (!pg_type_ownercheck(address.objectId, GetUserId()))
+				aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_TYPE,
+							   format_type_be(address.objectId));
+			break;
+		case OBJECT_AGGREGATE:
+		case OBJECT_FUNCTION:
+			if (!pg_proc_ownercheck(address.objectId, GetUserId()))
+				aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PROC,
+							   NameListToString(stmt->objname));
+			break;
+		case OBJECT_SCHEMA:
+			if (!pg_namespace_ownercheck(address.objectId, GetUserId()))
+				aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_NAMESPACE,
+							   strVal(linitial(stmt->objname)));
+			break;
+		case OBJECT_LANGUAGE:
+			if (!superuser())
+				ereport(ERROR,
+						(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+					 errmsg("must be superuser to comment on procedural language")));
+			break;
+		case OBJECT_LARGEOBJECT:
+			if (!pg_largeobject_ownercheck(address.objectId, GetUserId()))
+				ereport(ERROR,
+						(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+						 errmsg("must be owner of large object %u",
+							address.objectId)));
+			break;
+		default:
+			elog(ERROR, "unrecognized object type: %d",
+				 (int) stmt->objtype);
+	}
+
+	/* Provider gets control here, may throw ERROR to veto new label. */
+	(*provider->hook)(&address, stmt->label);
+
+	/* Apply new label. */
+	SetSecurityLabel(&address, provider->provider_name, stmt->label);
+
+	/*
+	 * If get_object_address() opened the relation for us, we close it to keep
+	 * the reference count correct - but we retain any locks acquired by
+	 * get_object_address() until commit time, to guard against concurrent
+	 * activity.
+	 */
+	if (relation != NULL)
+		relation_close(relation, NoLock);
+}
+
+/*
+ * GetSecurityLabel returns the security label for a database object for a
+ * given provider, or NULL if there is no such label.
+ */
+char *
+GetSecurityLabel(const ObjectAddress *object, const char *provider)
+{
+	Relation	pg_seclabel;
+	ScanKeyData	keys[4];
+	SysScanDesc	scan;
+	HeapTuple	tuple;
+	Datum		datum;
+	bool		isnull;
+	char	   *seclabel = NULL;
+
+	Assert(!IsSharedRelation(object->classId));
+
+	ScanKeyInit(&keys[0],
+				Anum_pg_seclabel_objoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->objectId));
+	ScanKeyInit(&keys[1],
+				Anum_pg_seclabel_classoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->classId));
+	ScanKeyInit(&keys[2],
+				Anum_pg_seclabel_objsubid,
+				BTEqualStrategyNumber, F_INT4EQ,
+				Int32GetDatum(object->objectSubId));
+	ScanKeyInit(&keys[3],
+				Anum_pg_seclabel_provider,
+				BTEqualStrategyNumber, F_TEXTEQ,
+				CStringGetTextDatum(provider));
+
+	pg_seclabel = heap_open(SecLabelRelationId, AccessShareLock);
+
+	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+							  SnapshotNow, 4, keys);
+
+	tuple = systable_getnext(scan);
+	if (HeapTupleIsValid(tuple))
+	{
+		datum = heap_getattr(tuple, Anum_pg_seclabel_label,
+							 RelationGetDescr(pg_seclabel), &isnull);
+		if (!isnull)
+			seclabel = TextDatumGetCString(datum);
+	}
+	systable_endscan(scan);
+
+	heap_close(pg_seclabel, AccessShareLock);
+
+	return seclabel;
+}
+
+/*
+ * SetSecurityLabel attempts to set the security label for the specified
+ * provider on the specified object to the given value.  NULL means that any
+ * any existing label should be deleted.
+ */
+void
+SetSecurityLabel(const ObjectAddress *object,
+				 const char *provider, const char *label)
+{
+	Relation	pg_seclabel;
+	ScanKeyData	keys[4];
+	SysScanDesc	scan;
+	HeapTuple	oldtup;
+	HeapTuple	newtup = NULL;
+	Datum		values[Natts_pg_seclabel];
+	bool		nulls[Natts_pg_seclabel];
+	bool		replaces[Natts_pg_seclabel];
+
+	/* Security labels on shared objects are not supported. */
+	Assert(!IsSharedRelation(object->classId));
+
+	/* Prepare to form or update a tuple, if necessary. */
+	memset(nulls, false, sizeof(nulls));
+	memset(replaces, false, sizeof(replaces));
+	values[Anum_pg_seclabel_objoid - 1] = ObjectIdGetDatum(object->objectId);
+	values[Anum_pg_seclabel_classoid - 1] = ObjectIdGetDatum(object->classId);
+	values[Anum_pg_seclabel_objsubid - 1] = Int32GetDatum(object->objectSubId);
+	values[Anum_pg_seclabel_provider - 1] = CStringGetTextDatum(provider);
+	if (label != NULL)
+		values[Anum_pg_seclabel_label - 1] = CStringGetTextDatum(label);
+
+	/* Use the index to search for a matching old tuple */
+	ScanKeyInit(&keys[0],
+				Anum_pg_seclabel_objoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->objectId));
+	ScanKeyInit(&keys[1],
+				Anum_pg_seclabel_classoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->classId));
+	ScanKeyInit(&keys[2],
+				Anum_pg_seclabel_objsubid,
+				BTEqualStrategyNumber, F_INT4EQ,
+				Int32GetDatum(object->objectSubId));
+	ScanKeyInit(&keys[3],
+				Anum_pg_seclabel_provider,
+				BTEqualStrategyNumber, F_TEXTEQ,
+				CStringGetTextDatum(provider));
+
+	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+
+	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+							  SnapshotNow, 4, keys);
+
+	oldtup = systable_getnext(scan);
+	if (HeapTupleIsValid(oldtup))
+	{
+		if (label == NULL)
+			simple_heap_delete(pg_seclabel, &oldtup->t_self);
+		else
+		{
+			replaces[Anum_pg_seclabel_label - 1] = true;
+			newtup = heap_modify_tuple(oldtup, RelationGetDescr(pg_seclabel),
+									   values, nulls, replaces);
+			simple_heap_update(pg_seclabel, &oldtup->t_self, newtup);
+		}
+	}
+	systable_endscan(scan);
+
+	/* If we didn't find an old tuple, insert a new one */
+	if (newtup == NULL && label != NULL)
+	{
+		newtup = heap_form_tuple(RelationGetDescr(pg_seclabel),
+								 values, nulls);
+		simple_heap_insert(pg_seclabel, newtup);
+	}
+
+	/* Update indexes, if necessary */
+	if (newtup != NULL)
+	{
+		CatalogUpdateIndexes(pg_seclabel, newtup);
+		heap_freetuple(newtup);
+	}
+
+	heap_close(pg_seclabel, RowExclusiveLock);
+}
+
+/*
+ * DeleteSecurityLabel removes all security labels for an object (and any
+ * sub-objects, if applicable).
+ */
+void
+DeleteSecurityLabel(const ObjectAddress *object)
+{
+	Relation	pg_seclabel;
+	ScanKeyData	skey[3];
+	SysScanDesc	scan;
+	HeapTuple	oldtup;
+	int			nkeys;
+
+	/* Security labels on shared objects are not supported. */
+	if (IsSharedRelation(object->classId))
+		return;
+
+	ScanKeyInit(&skey[0],
+				Anum_pg_seclabel_objoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->objectId));
+	ScanKeyInit(&skey[1],
+				Anum_pg_seclabel_classoid,
+				BTEqualStrategyNumber, F_OIDEQ,
+				ObjectIdGetDatum(object->classId));
+	if (object->objectSubId != 0)
+	{
+		ScanKeyInit(&skey[2],
+					Anum_pg_seclabel_objsubid,
+					BTEqualStrategyNumber, F_INT4EQ,
+					Int32GetDatum(object->objectSubId));
+		nkeys = 3;
+	}
+	else
+		nkeys = 2;
+
+	pg_seclabel = heap_open(SecLabelRelationId, RowExclusiveLock);
+
+	scan = systable_beginscan(pg_seclabel, SecLabelObjectIndexId, true,
+							  SnapshotNow, nkeys, skey);
+	while (HeapTupleIsValid(oldtup = systable_getnext(scan)))
+		simple_heap_delete(pg_seclabel, &oldtup->t_self);
+	systable_endscan(scan);
+
+	heap_close(pg_seclabel, RowExclusiveLock);
+}
+
+/*
+ * Check whether the user is allowed to comment on an attribute of the
+ * specified relation.
+ */
+static void
+CheckAttributeSecLabel(Relation relation)
+{
+	if (!pg_class_ownercheck(RelationGetRelid(relation), GetUserId()))
+		aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_CLASS,
+					   RelationGetRelationName(relation));
+
+	/*
+	 * Allow security labels only on columns of tables, views, and composite
+	 * types (which are the only relkinds for which pg_dump will dump labels).
+	 */
+	if (relation->rd_rel->relkind != RELKIND_RELATION &&
+		relation->rd_rel->relkind != RELKIND_VIEW &&
+		relation->rd_rel->relkind != RELKIND_COMPOSITE_TYPE)
+		ereport(ERROR,
+				(errcode(ERRCODE_WRONG_OBJECT_TYPE),
+				 errmsg("\"%s\" is not a table, view, or composite type",
+						RelationGetRelationName(relation))));
+}
+
+void
+register_label_provider(const char *provider_name, check_object_relabel_type hook)
+{
+	LabelProvider  *provider;
+	MemoryContext	oldcxt;
+
+	oldcxt = MemoryContextSwitchTo(TopMemoryContext);
+	provider = palloc(sizeof(LabelProvider));
+	provider->provider_name = pstrdup(provider_name);
+	provider->hook = hook;
+	label_provider_list = lappend(label_provider_list, provider);
+	MemoryContextSwitchTo(oldcxt);
+}
diff --git a/src/backend/nodes/copyfuncs.c b/src/backend/nodes/copyfuncs.c
index deaeb76..e07aa3e 100644
--- a/src/backend/nodes/copyfuncs.c
+++ b/src/backend/nodes/copyfuncs.c
@@ -2607,6 +2607,20 @@ _copyCommentStmt(CommentStmt *from)
 	return newnode;
 }
 
+static SecLabelStmt *
+_copySecLabelStmt(SecLabelStmt *from)
+{
+	SecLabelStmt *newnode = makeNode(SecLabelStmt);
+
+	COPY_SCALAR_FIELD(objtype);
+	COPY_NODE_FIELD(objname);
+	COPY_NODE_FIELD(objargs);
+	COPY_STRING_FIELD(provider);
+	COPY_STRING_FIELD(label);
+
+	return newnode;
+}
+
 static FetchStmt *
 _copyFetchStmt(FetchStmt *from)
 {
@@ -3958,6 +3972,9 @@ copyObject(void *from)
 		case T_CommentStmt:
 			retval = _copyCommentStmt(from);
 			break;
+		case T_SecLabelStmt:
+			retval = _copySecLabelStmt(from);
+			break;
 		case T_FetchStmt:
 			retval = _copyFetchStmt(from);
 			break;
diff --git a/src/backend/nodes/equalfuncs.c b/src/backend/nodes/equalfuncs.c
index 6b6cd99..8d083c8 100644
--- a/src/backend/nodes/equalfuncs.c
+++ b/src/backend/nodes/equalfuncs.c
@@ -1164,6 +1164,18 @@ _equalCommentStmt(CommentStmt *a, CommentStmt *b)
 }
 
 static bool
+_equalSecLabelStmt(SecLabelStmt *a, SecLabelStmt *b)
+{
+	COMPARE_SCALAR_FIELD(objtype);
+	COMPARE_NODE_FIELD(objname);
+	COMPARE_NODE_FIELD(objargs);
+	COMPARE_STRING_FIELD(provider);
+	COMPARE_STRING_FIELD(label);
+
+	return true;
+}
+
+static bool
 _equalFetchStmt(FetchStmt *a, FetchStmt *b)
 {
 	COMPARE_SCALAR_FIELD(direction);
@@ -2624,6 +2636,9 @@ equal(void *a, void *b)
 		case T_CommentStmt:
 			retval = _equalCommentStmt(a, b);
 			break;
+		case T_SecLabelStmt:
+			retval = _equalSecLabelStmt(a, b);
+			break;
 		case T_FetchStmt:
 			retval = _equalFetchStmt(a, b);
 			break;
diff --git a/src/backend/parser/gram.y b/src/backend/parser/gram.y
index 22ce353..51fea86 100644
--- a/src/backend/parser/gram.y
+++ b/src/backend/parser/gram.y
@@ -204,7 +204,7 @@ static TypeName *TableFuncTypeName(List *columns);
 		CreateFunctionStmt AlterFunctionStmt ReindexStmt RemoveAggrStmt
 		RemoveFuncStmt RemoveOperStmt RenameStmt RevokeStmt RevokeRoleStmt
 		RuleActionStmt RuleActionStmtOrEmpty RuleStmt
-		SelectStmt TransactionStmt TruncateStmt
+		SecLabelStmt SelectStmt TransactionStmt TruncateStmt
 		UnlistenStmt UpdateStmt VacuumStmt
 		VariableResetStmt VariableSetStmt VariableShowStmt
 		ViewStmt CheckPointStmt CreateConversionStmt
@@ -334,7 +334,7 @@ static TypeName *TableFuncTypeName(List *columns);
 %type <boolean> copy_from
 
 %type <ival>	opt_column event cursor_options opt_hold opt_set_data
-%type <objtype>	reindex_type drop_type comment_type
+%type <objtype>	reindex_type drop_type comment_type security_label_type
 
 %type <node>	fetch_args limit_clause select_limit_value
 				offset_clause select_offset_value
@@ -422,6 +422,8 @@ static TypeName *TableFuncTypeName(List *columns);
 %type <str>		OptTableSpace OptConsTableSpace OptTableSpaceOwner
 %type <list>	opt_check_option
 
+%type <str>		opt_provider security_label
+
 %type <target>	xml_attribute_el
 %type <list>	xml_attribute_list xml_attributes
 %type <node>	xml_root_version opt_xml_root_standalone
@@ -499,7 +501,7 @@ static TypeName *TableFuncTypeName(List *columns);
 
 	KEY
 
-	LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
+	LABEL LANGUAGE LARGE_P LAST_P LC_COLLATE_P LC_CTYPE_P LEADING
 	LEAST LEFT LEVEL LIKE LIMIT LISTEN LOAD LOCAL LOCALTIME LOCALTIMESTAMP
 	LOCATION LOCK_P LOGIN_P
 
@@ -737,6 +739,7 @@ stmt :
 			| RevokeStmt
 			| RevokeRoleStmt
 			| RuleStmt
+			| SecLabelStmt
 			| SelectStmt
 			| TransactionStmt
 			| TruncateStmt
@@ -4327,6 +4330,92 @@ comment_text:
 			| NULL_P							{ $$ = NULL; }
 		;
 
+
+/*****************************************************************************
+ *
+ *  SECURITY LABEL [FOR <provider>] ON <object> IS <label>
+ *
+ *  As with COMMENT ON, <object> can refer to various types of database
+ *  objects (e.g. TABLE, COLUMN, etc.).
+ *
+ *****************************************************************************/
+
+SecLabelStmt:
+			SECURITY LABEL opt_provider ON security_label_type any_name
+			IS security_label
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+					n->provider = $3;
+					n->objtype = $5;
+					n->objname = $6;
+					n->objargs = NIL;
+					n->label = $8;
+					$$ = (Node *) n;
+				}
+			| SECURITY LABEL opt_provider ON AGGREGATE func_name aggr_args
+			  IS security_label
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+					n->provider = $3;
+					n->objtype = OBJECT_AGGREGATE;
+					n->objname = $6;
+					n->objargs = $7;
+					n->label = $9;
+					$$ = (Node *) n;
+				}
+			| SECURITY LABEL opt_provider ON FUNCTION func_name func_args
+			  IS security_label
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+					n->provider = $3;
+					n->objtype = OBJECT_FUNCTION;
+					n->objname = $6;
+					n->objargs = extractArgTypes($7);
+					n->label = $9;
+					$$ = (Node *) n;
+				}
+			| SECURITY LABEL opt_provider ON LARGE_P OBJECT_P NumericOnly
+			  IS security_label
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+					n->provider = $3;
+					n->objtype = OBJECT_LARGEOBJECT;
+					n->objname = list_make1($7);
+					n->objargs = NIL;
+					n->label = $9;
+					$$ = (Node *) n;
+				}
+			| SECURITY LABEL opt_provider ON opt_procedural LANGUAGE any_name
+			  IS security_label
+				{
+					SecLabelStmt *n = makeNode(SecLabelStmt);
+					n->provider = $3;
+					n->objtype = OBJECT_LANGUAGE;
+					n->objname = $7;
+					n->objargs = NIL;
+					n->label = $9;
+					$$ = (Node *) n;
+				}
+		;
+
+opt_provider:	FOR ColId_or_Sconst	{ $$ = $2; }
+				| /* empty */		{ $$ = NULL; }
+		;
+
+security_label_type:
+			COLUMN								{ $$ = OBJECT_COLUMN; }
+			| SCHEMA							{ $$ = OBJECT_SCHEMA; }
+			| SEQUENCE							{ $$ = OBJECT_SEQUENCE; }
+			| TABLE								{ $$ = OBJECT_TABLE; }
+			| DOMAIN_P							{ $$ = OBJECT_TYPE; }
+			| TYPE_P							{ $$ = OBJECT_TYPE; }
+			| VIEW								{ $$ = OBJECT_VIEW; }
+		;
+
+security_label:	Sconst				{ $$ = $1; }
+				| NULL_P			{ $$ = NULL; }
+		;
+
 /*****************************************************************************
  *
  *		QUERY:
@@ -10993,6 +11082,7 @@ unreserved_keyword:
 			| INVOKER
 			| ISOLATION
 			| KEY
+			| LABEL
 			| LANGUAGE
 			| LARGE_P
 			| LAST_P
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 1865f84..3636173 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -37,6 +37,7 @@
 #include "commands/prepare.h"
 #include "commands/proclang.h"
 #include "commands/schemacmds.h"
+#include "commands/seclabel.h"
 #include "commands/sequence.h"
 #include "commands/tablecmds.h"
 #include "commands/tablespace.h"
@@ -218,6 +219,7 @@ check_xact_readonly(Node *parsetree)
 		case T_AlterUserMappingStmt:
 		case T_DropUserMappingStmt:
 		case T_AlterTableSpaceOptionsStmt:
+		case T_SecLabelStmt:
 			PreventCommandIfReadOnly(CreateCommandTag(parsetree));
 			break;
 		default:
@@ -663,6 +665,10 @@ standard_ProcessUtility(Node *parsetree,
 			CommentObject((CommentStmt *) parsetree);
 			break;
 
+		case T_SecLabelStmt:
+			ExecSecLabelStmt((SecLabelStmt *) parsetree);
+			break;
+
 		case T_CopyStmt:
 			{
 				uint64		processed;
@@ -1592,6 +1598,10 @@ CreateCommandTag(Node *parsetree)
 			tag = "COMMENT";
 			break;
 
+		case T_SecLabelStmt:
+			tag = "SECURITY LABEL";
+			break;
+
 		case T_CopyStmt:
 			tag = "COPY";
 			break;
@@ -2314,6 +2324,10 @@ GetCommandLogLevel(Node *parsetree)
 			lev = LOGSTMT_DDL;
 			break;
 
+		case T_SecLabelStmt:
+			lev = LOGSTMT_DDL;
+			break;
+
 		case T_CopyStmt:
 			if (((CopyStmt *) parsetree)->is_from)
 				lev = LOGSTMT_MOD;
diff --git a/src/bin/pg_dump/pg_backup.h b/src/bin/pg_dump/pg_backup.h
index 6f0277e..8fa9a57 100644
--- a/src/bin/pg_dump/pg_backup.h
+++ b/src/bin/pg_dump/pg_backup.h
@@ -103,6 +103,7 @@ typedef struct _restoreOptions
 										 * restore */
 	int			use_setsessauth;/* Use SET SESSION AUTHORIZATION commands
 								 * instead of OWNER TO */
+	int			skip_seclabel;	/* Skip security label entries */
 	char	   *superuser;		/* Username to use as superuser */
 	char	   *use_role;		/* Issue SET ROLE to this */
 	int			dataOnly;
diff --git a/src/bin/pg_dump/pg_backup_archiver.c b/src/bin/pg_dump/pg_backup_archiver.c
index a73afec..d1a9c54 100644
--- a/src/bin/pg_dump/pg_backup_archiver.c
+++ b/src/bin/pg_dump/pg_backup_archiver.c
@@ -2275,6 +2275,10 @@ _tocEntryRequired(TocEntry *te, RestoreOptions *ropt, bool include_acls)
 	if ((!include_acls || ropt->aclsSkip) && _tocEntryIsACL(te))
 		return 0;
 
+	/* If it's security labels, maybe ignore it */
+	if (ropt->skip_seclabel && strcmp(te->desc, "SECURITY LABEL") == 0)
+		return 0;
+
 	/* Ignore DATABASE entry unless we should create it */
 	if (!ropt->createDB && strcmp(te->desc, "DATABASE") == 0)
 		return 0;
@@ -2341,6 +2345,8 @@ _tocEntryRequired(TocEntry *te, RestoreOptions *ropt, bool include_acls)
 			(strcmp(te->desc, "ACL") == 0 &&
 			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0) ||
 			(strcmp(te->desc, "COMMENT") == 0 &&
+			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0) ||
+			(strcmp(te->desc, "SECURITY LABEL") == 0 &&
 			 strncmp(te->tag, "LARGE OBJECT ", 13) == 0))
 			res = res & REQ_DATA;
 		else
diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c
index fdf48fe..7bacfb1 100644
--- a/src/bin/pg_dump/pg_dump.c
+++ b/src/bin/pg_dump/pg_dump.c
@@ -125,6 +125,7 @@ static int	binary_upgrade = 0;
 static int	disable_dollar_quoting = 0;
 static int	dump_inserts = 0;
 static int	column_inserts = 0;
+static int	security_label = 0;
 
 
 static void help(const char *progname);
@@ -183,6 +184,10 @@ static void dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
 		const char *tag, const char *nspname, const char *owner,
 		const char *acls);
 
+static void dumpSecLabel(Archive *fout, CatalogId objCatId, DumpId objDumpId,
+			 const char *type, const char *target, const char *nspname,
+			 const char *owner);
+
 static void getDependencies(void);
 static void getDomainConstraints(TypeInfo *tyinfo);
 static void getTableData(TableInfo *tblinfo, int numTables, bool oids);
@@ -300,6 +305,7 @@ main(int argc, char **argv)
 		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
 		{"role", required_argument, NULL, 3},
 		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+		{"security-label", no_argument, &security_label, 1},
 
 		{NULL, 0, NULL, 0}
 	};
@@ -448,6 +454,8 @@ main(int argc, char **argv)
 					outputNoTablespaces = 1;
 				else if (strcmp(optarg, "use-set-session-authorization") == 0)
 					use_setsessauth = 1;
+				else if (strcmp(optarg, "security-label") == 0)
+					security_label = 1;
 				else
 				{
 					fprintf(stderr,
@@ -643,6 +651,15 @@ main(int argc, char **argv)
 		do_sql_command(g_conn, "SET quote_all_identifiers = true");
 
 	/*
+	 * Disables security label support if server version < v9.1.x
+	 */
+	if (security_label && g_fout->remoteVersion < 90100)
+	{
+		write_msg(NULL, "Server does not support security labels\n");
+		security_label = 0;
+	}
+
+	/*
 	 * Start serializable transaction to dump consistent data.
 	 */
 	do_sql_command(g_conn, "BEGIN");
@@ -839,6 +856,7 @@ help(const char *progname)
 	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
 	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
 	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
+	printf(_("  --security-label            also dump security labels\n"));
 	printf(_("  --use-set-session-authorization\n"
 			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
 	"                              ALTER OWNER commands to set ownership\n"));
@@ -10435,6 +10453,111 @@ dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
 }
 
 /*
+ * dumpSecLabel 
+ *
+ * It dumps any security labels associated with the object handed
+ * to this routine. The routine takes a constant character string
+ * for the target part of the security-label command, plus the
+ * namespace and owner of the object (for labeling the ArchiveEntry),
+ * plus catalogId which is lookup key for pg_seclabel, and dumpId
+ * for the object.
+ * If a matching pg_seclabel entry is found, it is dumped.
+ */
+static void
+dumpSecLabel(Archive *fout, CatalogId objCatId, DumpId objDumpId,
+			 const char *type, const char *target,
+			 const char *nspname, const char *owner)
+{
+	PGresult	   *res;
+	PQExpBuffer		lquery;
+	PQExpBuffer		cquery;
+	PQExpBuffer		tgbuf;
+	int				i_attname;
+	int				i_provider;
+	int				i_label;
+	int				i, ntups;
+
+	/* do nothing, if security label dump is not enabled */
+	if (!security_label)
+		return;
+
+	/* --data-only skips security labels *except* large object */
+	if (dataOnly && strcmp(type, "LARGE OBJECT") != 0)
+		return;
+
+	/*
+	 * Fetch security labels associated with the object
+	 */
+	lquery = createPQExpBuffer();
+	cquery = createPQExpBuffer();
+	tgbuf = createPQExpBuffer();
+
+	appendPQExpBuffer(lquery,
+					  "SELECT a.attname, s.provider, s.label"
+					  "  FROM pg_catalog.pg_seclabel s"
+					  "       LEFT OUTER JOIN"
+					  "       pg_catalog.pg_attribute a"
+					  "       ON s.objoid = a.attrelid AND"
+					  "          s.objsubid = a.attnum"
+					  "  WHERE classoid = %u AND objoid = %u",
+					  objCatId.tableoid, objCatId.oid);
+
+	res = PQexec(g_conn, lquery->data);
+	check_sql_result(res, g_conn, lquery->data, PGRES_TUPLES_OK);
+
+	i_attname = PQfnumber(res, "attname");
+	i_provider = PQfnumber(res, "provider");
+	i_label	= PQfnumber(res, "label");
+
+	ntups = PQntuples(res);
+
+	for (i = 0; i < ntups; i++)
+	{
+		if (strcmp(type, "TABLE") == 0 &&
+			!PQgetisnull(res, i, i_attname))
+		{
+			appendPQExpBuffer(cquery,
+							  "SECURITY LABEL FOR '%s'"
+							  " ON COLUMN %s.%s IS '%s';\n",
+							  PQgetvalue(res, i, i_provider),
+							  target,
+							  fmtId(PQgetvalue(res, i, i_attname)),
+							  PQgetvalue(res, i, i_label));
+			continue;
+		}
+
+		/*
+		 * a.attname can be available only when type = "TABLE",
+		 * so we expect it will be always NULL. Elsewhere, we assume
+		 * it as a data corruption, so simply ignored.
+		 */
+		if (!PQgetisnull(res, i, i_attname))
+			continue;
+
+		appendPQExpBuffer(cquery,
+						  "SECURITY LABEL FOR '%s' ON %s %s IS '%s';\n",
+						  PQgetvalue(res, i, i_provider),
+						  type, target,
+						  PQgetvalue(res, i, i_label));
+	}
+	PQclear(res);
+
+	if (cquery->len > 0)
+	{
+		appendPQExpBuffer(tgbuf, "%s %s", type, target);
+		ArchiveEntry(fout, nilCatalogId, createDumpId(),
+					 tgbuf->data, nspname, NULL, owner,
+					 false, "SECURITY LABEL", SECTION_NONE,
+					 cquery->data, "", NULL,
+					 &(objDumpId), 1,
+					 NULL, NULL);
+	}
+	destroyPQExpBuffer(lquery);
+	destroyPQExpBuffer(cquery);
+	destroyPQExpBuffer(tgbuf);
+}
+
+/*
  * dumpTable
  *	  write out to fout the declarations (not data) of a user-defined table
  */
@@ -10458,6 +10581,13 @@ dumpTable(Archive *fout, TableInfo *tbinfo)
 				tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
 				tbinfo->relacl);
 
+		/* Handle the security label here */
+		dumpSecLabel(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId,
+					 (tbinfo->relkind == RELKIND_SEQUENCE ? "SEQUENCE" :
+					  (tbinfo->relkind == RELKIND_VIEW ? "VIEW" : "TABLE")),
+					 namecopy,
+					 tbinfo->dobj.namespace->dobj.name,
+					 tbinfo->rolname);
 		/*
 		 * Handle column ACLs, if any.	Note: we pull these with a separate
 		 * query rather than trying to fetch them during getTableAttrs, so
diff --git a/src/bin/pg_dump/pg_dumpall.c b/src/bin/pg_dump/pg_dumpall.c
index 9294e07..79708be 100644
--- a/src/bin/pg_dump/pg_dumpall.c
+++ b/src/bin/pg_dump/pg_dumpall.c
@@ -69,6 +69,7 @@ static int	disable_triggers = 0;
 static int	inserts = 0;
 static int	no_tablespaces = 0;
 static int	use_setsessauth = 0;
+static int	security_label = 0;
 static int	server_version;
 
 static FILE *OPF;
@@ -133,6 +134,7 @@ main(int argc, char *argv[])
 		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
 		{"role", required_argument, NULL, 3},
 		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+		{"security-label", no_argument, &security_label, 1},
 
 		{NULL, 0, NULL, 0}
 	};
@@ -286,6 +288,8 @@ main(int argc, char *argv[])
 					no_tablespaces = 1;
 				else if (strcmp(optarg, "use-set-session-authorization") == 0)
 					use_setsessauth = 1;
+				else if (strcmp(optarg, "security-label") == 0)
+					security_label = 1;
 				else
 				{
 					fprintf(stderr,
@@ -371,6 +375,8 @@ main(int argc, char *argv[])
 		appendPQExpBuffer(pgdumpopts, " --quote-all-identifiers");
 	if (use_setsessauth)
 		appendPQExpBuffer(pgdumpopts, " --use-set-session-authorization");
+	if (security_label)
+		appendPQExpBuffer(pgdumpopts, " --security-label");
 
 	/*
 	 * If there was a database specified on the command line, use that,
@@ -567,6 +573,7 @@ help(void)
 	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
 	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
 	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
+	printf(_("  --security-label            also dump security labels\n"));
 	printf(_("  --use-set-session-authorization\n"
 			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
 	"                              ALTER OWNER commands to set ownership\n"));
diff --git a/src/bin/pg_dump/pg_restore.c b/src/bin/pg_dump/pg_restore.c
index b9f0e86..1ddba72 100644
--- a/src/bin/pg_dump/pg_restore.c
+++ b/src/bin/pg_dump/pg_restore.c
@@ -76,6 +76,7 @@ main(int argc, char **argv)
 	static int	no_data_for_failed_tables = 0;
 	static int	outputNoTablespaces = 0;
 	static int	use_setsessauth = 0;
+	static int	skip_seclabel = 0;
 
 	struct option cmdopts[] = {
 		{"clean", 0, NULL, 'c'},
@@ -116,6 +117,7 @@ main(int argc, char **argv)
 		{"no-tablespaces", no_argument, &outputNoTablespaces, 1},
 		{"role", required_argument, NULL, 2},
 		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
+		{"no-security-label", no_argument, &skip_seclabel, 1},
 
 		{NULL, 0, NULL, 0}
 	};
@@ -262,6 +264,8 @@ main(int argc, char **argv)
 					outputNoTablespaces = 1;
 				else if (strcmp(optarg, "use-set-session-authorization") == 0)
 					use_setsessauth = 1;
+				else if (strcmp(optarg, "no-security-label") == 0)
+					skip_seclabel = 1;
 				else
 				{
 					fprintf(stderr,
@@ -337,6 +341,7 @@ main(int argc, char **argv)
 	opts->noDataForFailedTables = no_data_for_failed_tables;
 	opts->noTablespace = outputNoTablespaces;
 	opts->use_setsessauth = use_setsessauth;
+	opts->skip_seclabel = skip_seclabel;
 
 	if (opts->formatName)
 	{
@@ -442,6 +447,7 @@ usage(const char *progname)
 			 "                           do not restore data of tables that could not be\n"
 			 "                           created\n"));
 	printf(_("  --no-tablespaces         do not restore tablespace assignments\n"));
+	printf(_("  --no-security-label      do not restore security labels\n"));
 	printf(_("  --role=ROLENAME          do SET ROLE before restore\n"));
 	printf(_("  --use-set-session-authorization\n"
 			 "                           use SET SESSION AUTHORIZATION commands instead of\n"
diff --git a/src/include/catalog/indexing.h b/src/include/catalog/indexing.h
index 38c48b9..9fa11c5 100644
--- a/src/include/catalog/indexing.h
+++ b/src/include/catalog/indexing.h
@@ -281,6 +281,9 @@ DECLARE_UNIQUE_INDEX(pg_default_acl_oid_index, 828, on pg_default_acl using btre
 DECLARE_UNIQUE_INDEX(pg_db_role_setting_databaseid_rol_index, 2965, on pg_db_role_setting using btree(setdatabase oid_ops, setrole oid_ops));
 #define DbRoleSettingDatidRolidIndexId	2965
 
+DECLARE_UNIQUE_INDEX(pg_seclabel_object_index, 3038, on pg_seclabel using btree(objoid oid_ops, classoid oid_ops, objsubid int4_ops, provider text_ops));
+#define SecLabelObjectIndexId				3038
+
 /* last step of initialization script: build the indexes declared above */
 BUILD_INDICES
 
diff --git a/src/include/catalog/pg_seclabel.h b/src/include/catalog/pg_seclabel.h
new file mode 100644
index 0000000..1fd7451
--- /dev/null
+++ b/src/include/catalog/pg_seclabel.h
@@ -0,0 +1,43 @@
+/* -------------------------------------------------------------------------
+ *
+ * pg_seclabel.h
+ *    definition of the system "security label" relation (pg_seclabel)
+ *
+ * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * -------------------------------------------------------------------------
+ */
+#ifndef PG_SECLABEL_H
+#define PG_SECLABEL_H
+
+#include "catalog/genbki.h"
+
+/* ----------------
+ *		pg_seclabel definition.  cpp turns this into
+ *		typedef struct FormData_pg_seclabel
+ * ----------------
+ */
+#define SecLabelRelationId		3037
+
+CATALOG(pg_seclabel,3037) BKI_WITHOUT_OIDS
+{
+	Oid			objoid;		/* OID of the object itself */
+	Oid			classoid;	/* OID of table containing the object */
+	int4		objsubid;	/* column number, or 0 if not used */
+	text		provider;	/* name of label provider */
+	text		label;		/* security label of the object */
+} FormData_pg_seclabel;
+
+/* ----------------
+ *		compiler constants for pg_seclabel
+ * ----------------
+ */
+#define Natts_pg_seclabel			5
+#define Anum_pg_seclabel_objoid		1
+#define Anum_pg_seclabel_classoid	2
+#define Anum_pg_seclabel_objsubid	3
+#define Anum_pg_seclabel_provider	4
+#define Anum_pg_seclabel_label		5
+
+#endif	/* PG_SECLABEL_H */
diff --git a/src/include/catalog/toasting.h b/src/include/catalog/toasting.h
index 560d837..1e59cd2 100644
--- a/src/include/catalog/toasting.h
+++ b/src/include/catalog/toasting.h
@@ -45,6 +45,7 @@ DECLARE_TOAST(pg_constraint, 2832, 2833);
 DECLARE_TOAST(pg_description, 2834, 2835);
 DECLARE_TOAST(pg_proc, 2836, 2837);
 DECLARE_TOAST(pg_rewrite, 2838, 2839);
+DECLARE_TOAST(pg_seclabel, 3039, 3040);
 DECLARE_TOAST(pg_statistic, 2840, 2841);
 DECLARE_TOAST(pg_trigger, 2336, 2337);
 
diff --git a/src/include/commands/seclabel.h b/src/include/commands/seclabel.h
new file mode 100644
index 0000000..4c3854e
--- /dev/null
+++ b/src/include/commands/seclabel.h
@@ -0,0 +1,35 @@
+/*
+ * seclabel.h
+ *
+ * Prototypes for functions in commands/seclabel.c
+ *
+ * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ */
+#ifndef SECLABEL_H
+#define SECLABEL_H
+
+#include "catalog/objectaddress.h"
+#include "nodes/primnodes.h"
+#include "nodes/parsenodes.h"
+
+/*
+ * Internal APIs
+ */
+extern char *GetSecurityLabel(const ObjectAddress *object,
+				 const char *provider);
+extern void SetSecurityLabel(const ObjectAddress *object,
+			     const char *provider, const char *label);
+extern void DeleteSecurityLabel(const ObjectAddress *object);
+
+/*
+ * Statement and ESP hook support
+ */
+extern void ExecSecLabelStmt(SecLabelStmt *stmt);
+
+typedef void (*check_object_relabel_type)(const ObjectAddress *object,
+										  const char *seclabel);
+extern void register_label_provider(const char *provider,
+								    check_object_relabel_type hook);
+
+#endif	/* SECLABEL_H */
diff --git a/src/include/nodes/nodes.h b/src/include/nodes/nodes.h
index 35def5e..0d33a2e 100644
--- a/src/include/nodes/nodes.h
+++ b/src/include/nodes/nodes.h
@@ -347,6 +347,7 @@ typedef enum NodeTag
 	T_AlterUserMappingStmt,
 	T_DropUserMappingStmt,
 	T_AlterTableSpaceOptionsStmt,
+	T_SecLabelStmt,
 
 	/*
 	 * TAGS FOR PARSE TREE NODES (parsenodes.h)
diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h
index b67ab68..5d6498e 100644
--- a/src/include/nodes/parsenodes.h
+++ b/src/include/nodes/parsenodes.h
@@ -1850,6 +1850,20 @@ typedef struct CommentStmt
 } CommentStmt;
 
 /* ----------------------
+ *				SECURITY LABEL Statement
+ * ----------------------
+ */
+typedef struct SecLabelStmt
+{
+	NodeTag		type;
+	ObjectType	objtype;		/* Object's type */
+	List	   *objname;		/* Qualified name of the object */
+	List	   *objargs;		/* Arguments if needed (eg, for functions) */
+	char	   *provider;		/* Label provider (or NULL) */
+	char	   *label;			/* New security label to be assigned */
+} SecLabelStmt;
+
+/* ----------------------
  *		Declare Cursor Statement
  *
  * Note: the "query" field of DeclareCursorStmt is only used in the raw grammar
diff --git a/src/include/parser/kwlist.h b/src/include/parser/kwlist.h
index 5e3ccd5..028f5ae 100644
--- a/src/include/parser/kwlist.h
+++ b/src/include/parser/kwlist.h
@@ -208,6 +208,7 @@ PG_KEYWORD("isnull", ISNULL, TYPE_FUNC_NAME_KEYWORD)
 PG_KEYWORD("isolation", ISOLATION, UNRESERVED_KEYWORD)
 PG_KEYWORD("join", JOIN, TYPE_FUNC_NAME_KEYWORD)
 PG_KEYWORD("key", KEY, UNRESERVED_KEYWORD)
+PG_KEYWORD("label", LABEL, UNRESERVED_KEYWORD)
 PG_KEYWORD("language", LANGUAGE, UNRESERVED_KEYWORD)
 PG_KEYWORD("large", LARGE_P, UNRESERVED_KEYWORD)
 PG_KEYWORD("last", LAST_P, UNRESERVED_KEYWORD)
diff --git a/src/test/regress/expected/sanity_check.out b/src/test/regress/expected/sanity_check.out
index 1d9e110..9596b0b 100644
--- a/src/test/regress/expected/sanity_check.out
+++ b/src/test/regress/expected/sanity_check.out
@@ -114,6 +114,7 @@ SELECT relname, relhasindex
  pg_pltemplate           | t
  pg_proc                 | t
  pg_rewrite              | t
+ pg_seclabel             | t
  pg_shdepend             | t
  pg_shdescription        | t
  pg_statistic            | t
@@ -153,7 +154,7 @@ SELECT relname, relhasindex
  timetz_tbl              | f
  tinterval_tbl           | f
  varchar_tbl             | f
-(142 rows)
+(143 rows)
 
 --
 -- another sanity check: every system catalog that has OIDs should have

*** a/contrib/Makefile
--- b/contrib/Makefile
***************
*** 15,20 **** SUBDIRS = \
--- 15,21 ----
  		dblink		\
  		dict_int	\
  		dict_xsyn	\
+ 		dummy_esp	\
  		earthdistance	\
  		fuzzystrmatch	\
  		hstore		\
*** /dev/null
--- b/contrib/dummy_esp/Makefile
***************
*** 0 ****
--- 1,14 ----
+ # contrib/dummy_esp/Makefile
+ 
+ MODULES = dummy_esp
+ 
+ ifdef USE_PGXS
+ PG_CONFIG = pg_config
+ PGXS := $(shell $(PG_CONFIG) --pgxs)
+ include $(PGXS)
+ else
+ subdir = contrib/dummy_esp
+ top_builddir = ../..
+ include $(top_builddir)/src/Makefile.global
+ include $(top_srcdir)/contrib/contrib-global.mk
+ endif
*** /dev/null
--- b/contrib/dummy_esp/dummy_esp.c
***************
*** 0 ****
--- 1,56 ----
+ /*
+  * dummy_esp.c
+  *
+  * A dummy plugin of external security provider with security label.
+  *
+  * This module does not provide something worthful from security perspective,
+  * but being used to regression test independent from the platform specific
+  * features like SELinux.
+  *
+  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
+  * Portions Copyright (c) 1994, Regents of the University of California
+  */
+ #include "postgres.h"
+ 
+ #include "commands/seclabel.h"
+ 
+ PG_MODULE_MAGIC;
+ 
+ /* Entrypoint of the module */
+ void _PG_init(void);
+ 
+ /*
+  * dummy_object_relabel
+  *
+  * It shall be invoked when user tries to assign security label of
+  * the database object.
+  */
+ void
+ dummy_object_relabel(const ObjectAddress *object, const char *seclabel)
+ {
+ 	if (strcmp(seclabel, "unclassified") == 0 ||
+ 		strcmp(seclabel, "classified") == 0)
+ 		return;
+ 
+ 	if (strcmp(seclabel, "secret") == 0 ||
+ 		strcmp(seclabel, "top secret") == 0)
+ 	{
+ 		if (!superuser())
+ 			ereport(ERROR,
+ 					(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ 					 errmsg("only superuser can set '%s' label", seclabel)));
+ 		return;
+ 	}
+ 	ereport(ERROR,
+ 			(errcode(ERRCODE_INVALID_NAME),
+ 			 errmsg("'%s' is not a valid security label", seclabel)));
+ }
+ 
+ /*
+  * Entrypoint of the module
+  */
+ void
+ _PG_init(void)
+ {
+ 	register_label_provider("dummy", dummy_object_relabel);
+ }
*** a/doc/src/sgml/catalogs.sgml
--- b/doc/src/sgml/catalogs.sgml
***************
*** 5964,5969 ****
--- 5964,5974 ----
       </row>
  
       <row>
+       <entry><link linkend="view-pg-seclabels"><structname>pg_seclabels</structname></link></entry>
+       <entry>security labels</entry>
+      </row>
+ 
+      <row>
        <entry><link linkend="view-pg-settings"><structname>pg_settings</structname></link></entry>
        <entry>parameter settings</entry>
       </row>
***************
*** 6870,6876 ****
--- 6875,6965 ----
    </para>
  
   </sect1>
+  <sect1 id="view-pg-seclabels">
+   <title><structname>pg_seclabels</structname></title>
+ 
+   <indexterm zone="view-pg-seclabels">
+    <primary>pg_seclabels</primary>
+   </indexterm>
+ 
+   <para>
+    The view <structname>pg_seclabels</structname> provides references to
+    security label of database objects with their text identifiers.
+   </para>
+ 
+   <table>
+    <title><structname>pg_seclabels</> Columns</title>
  
+    <tgroup cols="4">
+     <thead>
+      <row>
+       <entry>Name</entry>
+       <entry>Type</entry>
+       <entry>References</entry>
+       <entry>Description</entry>
+      </row>
+     </thead>
+     <tbody>
+      <row>
+       <entry><structfield>objoid</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry>any OID column</entry>
+       <entry>The OID of the object this security label assigned on</entry>
+      </row>
+      <row>
+       <entry><structfield>classoid</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry><literal><link linkend="catalog-pg-class"><structname>pg_class</structname></link>.oid</literal></entry>
+       <entry>The OID of the system catalog this object appears in</entry>
+      </row>
+      <row>
+       <entry><structfield>objsubid</structfield></entry>
+       <entry><type>int4</type></entry>
+       <entry></entry>
+       <entry>
+        For a security label on a table column, this is the column number (the
+        <structfield>objoid</> and <structfield>classoid</> refer to
+        the table itself).  For all other object types, this column is
+        zero.
+       </entry>
+      </row>
+      <row>
+       <entry><structfield>objtype</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry></entry>
+       <entry>text identifier of the object type</entry>
+      </row>
+      <row>
+       <entry><structfield>objnamespace</structfield></entry>
+       <entry><type>oid</type></entry>
+       <entry><literal><link linkend="catalog-pg-namespace"><structname>pg_namespace</structname></link>.oid</literal></entry>
+       <entry>
+        The OID of the namespace that contains this object.
+        Maybe <literal>NULL</literal>, if object does not have its namespace.
+       </entry>
+      </row>
+      <row>
+       <entry><structfield>objname</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry></entry>
+       <entry>The name of the object this security label assigned on</entry>
+      </row>
+      <row>
+       <entry><structfield>provider</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry><literal><link linkend="catalog-pg-seclabel"><structname>pg_seclabel</structname></link>.provider</literal></entry>
+       <entry>The label provider associated with this label.</entry>
+      </row>
+      <row>
+       <entry><structfield>label</structfield></entry>
+       <entry><type>text</type></entry>
+       <entry><literal><link linkend="catalog-pg-seclabel"><structname>pg_seclabel</structname></link>.label</literal></entry>
+       <entry>The security label applied to this object.</entry>
+      </row>
+     </tbody>
+    </tgroup>
+   </table>
+  </sect1>
   <sect1 id="view-pg-settings">
    <title><structname>pg_settings</structname></title>
  
*** a/doc/src/sgml/user-manag.sgml
--- b/doc/src/sgml/user-manag.sgml
***************
*** 502,505 **** DROP ROLE <replaceable>name</replaceable>;
--- 502,536 ----
    </para>
   </sect1>
  
+  <sect1 id="external-security-providers">
+   <title>External Security Providers</title>
+ 
+   <para>
+    <productname>PostgreSQL</productname> allows third party plugins to
+    make their access control decision in addition to the default database
+    privilege mechanism. We call these plugins external security providers.
+    The version <literal>9.1.0</literal> or later provide various kind of
+    security hooks on strategic points of code paths, then the external
+    security providers shall be invoked via the hooks.
+   </para>
+   <para>
+    The major purpose to support external security providers is porting
+    mandatory access control (MAC) features;
+    such as <productname>SELinux</productname>.
+    Unlike the default database privilege mechanism, it makes access
+    control decision using a security label of database objects being
+    referenced and a centralized security policy.
+    <productname>PostgreSQL</productname> provides a set of facilities
+    to manage security labels of database objects as built-in feature.
+    The <link linkend="catalog-pg-seclabel"><structname>pg_seclabel
+    </structname></link> system catalog enables to assign security labels
+    on database objects, <xref linkend="sql-security-label"> command
+    allows us to manage security labels, and some of security hooks allows
+    to label database objects on its creation time.
+   </para>
+   <para>
+    We don't mention about detail of the individual security module here,
+    so please reference their own documentation to see any more information.
+   </para>
+  </sect1>
  </chapter>
*** a/src/backend/catalog/system_views.sql
--- b/src/backend/catalog/system_views.sql
***************
*** 160,165 **** CREATE VIEW pg_prepared_xacts AS
--- 160,274 ----
  CREATE VIEW pg_prepared_statements AS
      SELECT * FROM pg_prepared_statement() AS P;
  
+ CREATE VIEW pg_seclabels AS
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	CASE WHEN rel.relkind = 'r' THEN 'table'::text
+ 	     WHEN rel.relkind = 'v' THEN 'view'::text
+ 	     WHEN rel.relkind = 'S' THEN 'sequence'::text END AS objtype,
+ 	rel.relnamespace AS objnamespace,
+ 	CASE WHEN pg_table_is_visible(rel.oid)
+ 	     THEN quote_ident(rel.relname)
+ 	     ELSE quote_ident(nsp.nspname) || '.' || quote_ident(rel.relname)
+ 	     END AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_class rel ON l.classoid = rel.tableoid AND l.objoid = rel.oid
+ 	JOIN pg_namespace nsp ON rel.relnamespace = nsp.oid
+ WHERE
+ 	l.objsubid = 0
+ UNION ALL
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	'column'::text AS objtype,
+ 	rel.relnamespace AS objnamespace,
+ 	CASE WHEN pg_table_is_visible(rel.oid)
+ 	     THEN quote_ident(rel.relname)
+ 	     ELSE quote_ident(nsp.nspname) || '.' || quote_ident(rel.relname)
+ 	     END || '.' || att.attname AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_class rel ON l.classoid = rel.tableoid AND l.objoid = rel.oid
+ 	JOIN pg_attribute att
+ 	     ON rel.oid = att.attrelid AND l.objsubid = att.attnum
+ 	JOIN pg_namespace nsp ON rel.relnamespace = nsp.oid
+ WHERE
+ 	l.objsubid != 0
+ UNION ALL
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	CASE WHEN pro.proisagg = true THEN 'aggregate'::text
+ 	     WHEN pro.proisagg = false THEN 'function'::text
+ 	END AS objtype,
+ 	pro.pronamespace AS objnamespace,
+ 	CASE WHEN pg_function_is_visible(pro.oid)
+ 	     THEN quote_ident(pro.proname)
+ 	     ELSE quote_ident(nsp.nspname) || '.' || quote_ident(pro.proname)
+ 	END || '(' || pg_catalog.pg_get_function_arguments(pro.oid) || ')' AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_proc pro ON l.classoid = pro.tableoid AND l.objoid = pro.oid
+ 	JOIN pg_namespace nsp ON pro.pronamespace = nsp.oid
+ WHERE
+ 	l.objsubid = 0
+ UNION ALL
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	CASE WHEN typ.typtype = 'd' THEN 'domain'::text
+ 	ELSE 'type'::text END AS objtype,
+ 	typ.typnamespace AS objnamespace,
+ 	CASE WHEN pg_type_is_visible(typ.oid)
+ 	THEN quote_ident(typ.typname)
+ 	ELSE quote_ident(nsp.nspname) || '.' || quote_ident(typ.typname)
+ 	END AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_type typ ON l.classoid = typ.tableoid AND l.objoid = typ.oid
+ 	JOIN pg_namespace nsp ON typ.typnamespace = nsp.oid
+ WHERE
+ 	l.objsubid = 0
+ UNION ALL
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	'large object'::text AS objtype,
+ 	NULL::oid AS objnamespace,
+ 	l.objoid::text AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_largeobject_metadata lom ON l.objoid = lom.oid
+ WHERE
+ 	l.classoid = 'pg_catalog.pg_largeobject'::regclass AND l.objsubid = 0
+ UNION ALL
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	'language'::text AS objtype,
+ 	NULL::oid AS objnamespace,
+ 	quote_ident(lan.lanname) AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_language lan ON l.classoid = lan.tableoid AND l.objoid = lan.oid
+ WHERE
+ 	l.objsubid = 0
+ UNION ALL
+ SELECT
+ 	l.objoid, l.classoid, l.objsubid,
+ 	'schema'::text AS objtype,
+ 	nsp.oid AS objnamespace,
+ 	quote_ident(nsp.nspname) AS objname,
+ 	l.provider, l.label
+ FROM
+ 	pg_seclabel l
+ 	JOIN pg_namespace nsp ON l.classoid = nsp.tableoid AND l.objoid = nsp.oid
+ WHERE
+ 	l.objsubid = 0
+ ;
+ 
  CREATE VIEW pg_settings AS 
      SELECT * FROM pg_show_all_settings() AS A; 
  
*** a/src/bin/pg_dump/pg_dump.c
--- b/src/bin/pg_dump/pg_dump.c
***************
*** 70,75 **** typedef struct
--- 70,83 ----
  	int			objsubid;		/* subobject (table column #) */
  } CommentItem;
  
+ typedef struct
+ {
+ 	const char *provider;		/* label provider of this security label */
+ 	const char *label;			/* security label for an object */
+ 	Oid			classoid;		/* object class (catalog OID) */
+ 	Oid			objoid;			/* object OID */
+ 	int			objsubid;		/* subobject (table column #) */
+ } SecLabelItem;
  
  /* global decls */
  bool		g_verbose;			/* User wants verbose narration of our
***************
*** 125,131 **** static int	binary_upgrade = 0;
  static int	disable_dollar_quoting = 0;
  static int	dump_inserts = 0;
  static int	column_inserts = 0;
! static int	security_label = 0;
  
  
  static void help(const char *progname);
--- 133,139 ----
  static int	disable_dollar_quoting = 0;
  static int	dump_inserts = 0;
  static int	column_inserts = 0;
! static int	no_security_label = 0;
  
  
  static void help(const char *progname);
***************
*** 142,147 **** static void dumpComment(Archive *fout, const char *target,
--- 150,161 ----
  static int findComments(Archive *fout, Oid classoid, Oid objoid,
  			 CommentItem **items);
  static int	collectComments(Archive *fout, CommentItem **items);
+ static void	dumpSecLabel(Archive *fout, const char *target,
+ 						 const char *namespace, const char *owner,
+ 						 CatalogId catalogId, int subid, DumpId dumpId);
+ static int	findSecLabels(Archive *fout, Oid classoid, Oid objoid,
+ 						  SecLabelItem **items);
+ static int	collectSecLabels(Archive *fout, SecLabelItem **items);
  static void dumpDumpableObject(Archive *fout, DumpableObject *dobj);
  static void dumpNamespace(Archive *fout, NamespaceInfo *nspinfo);
  static void dumpType(Archive *fout, TypeInfo *tyinfo);
***************
*** 184,193 **** static void dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
  		const char *tag, const char *nspname, const char *owner,
  		const char *acls);
  
- static void dumpSecLabel(Archive *fout, CatalogId objCatId, DumpId objDumpId,
- 			 const char *type, const char *target, const char *nspname,
- 			 const char *owner);
- 
  static void getDependencies(void);
  static void getDomainConstraints(TypeInfo *tyinfo);
  static void getTableData(TableInfo *tblinfo, int numTables, bool oids);
--- 198,203 ----
***************
*** 305,311 **** main(int argc, char **argv)
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
! 		{"security-label", no_argument, &security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
--- 315,321 ----
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
! 		{"no-security-label", no_argument, &no_security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 454,461 **** main(int argc, char **argv)
  					outputNoTablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
! 				else if (strcmp(optarg, "security-label") == 0)
! 					security_label = 1;
  				else
  				{
  					fprintf(stderr,
--- 464,471 ----
  					outputNoTablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
! 				else if (strcmp(optarg, "no-security-label") == 0)
! 					no_security_label = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 653,663 **** main(int argc, char **argv)
  	/*
  	 * Disables security label support if server version < v9.1.x
  	 */
! 	if (security_label && g_fout->remoteVersion < 90100)
! 	{
! 		write_msg(NULL, "Server does not support security labels\n");
! 		security_label = 0;
! 	}
  
  	/*
  	 * Start serializable transaction to dump consistent data.
--- 663,670 ----
  	/*
  	 * Disables security label support if server version < v9.1.x
  	 */
! 	if (!no_security_label && g_fout->remoteVersion < 90100)
! 		no_security_label = 1;
  
  	/*
  	 * Start serializable transaction to dump consistent data.
***************
*** 856,862 **** help(const char *progname)
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
! 	printf(_("  --security-label            also dump security labels\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
--- 863,869 ----
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
! 	printf(_("  --no-security-label         do not dump security label assignments\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
***************
*** 2076,2081 **** dumpBlob(Archive *AH, BlobInfo *binfo)
--- 2083,2093 ----
  				NULL, binfo->rolname,
  				binfo->dobj.catId, 0, binfo->dobj.dumpId);
  
+ 	/* Dump security label if any */
+ 	dumpSecLabel(AH, cquery->data,
+ 				 NULL, binfo->rolname,
+ 				 binfo->dobj.catId, 0, binfo->dobj.dumpId);
+ 
  	/* Dump ACL if any */
  	if (binfo->blobacl)
  		dumpACL(AH, binfo->dobj.catId, binfo->dobj.dumpId, "LARGE OBJECT",
***************
*** 6587,6598 **** dumpNamespace(Archive *fout, NamespaceInfo *nspinfo)
  				 nspinfo->dobj.dependencies, nspinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Schema Comments */
  	resetPQExpBuffer(q);
  	appendPQExpBuffer(q, "SCHEMA %s", qnspname);
  	dumpComment(fout, q->data,
  				NULL, nspinfo->rolname,
  				nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId);
  
  	dumpACL(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, "SCHEMA",
  			qnspname, NULL, nspinfo->dobj.name, NULL,
--- 6599,6613 ----
  				 nspinfo->dobj.dependencies, nspinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Schema Comments and Security Labels */
  	resetPQExpBuffer(q);
  	appendPQExpBuffer(q, "SCHEMA %s", qnspname);
  	dumpComment(fout, q->data,
  				NULL, nspinfo->rolname,
  				nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 				 NULL, nspinfo->rolname,
+ 				 nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId);
  
  	dumpACL(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, "SCHEMA",
  			qnspname, NULL, nspinfo->dobj.name, NULL,
***************
*** 6717,6729 **** dumpEnumType(Archive *fout, TypeInfo *tyinfo)
  				 tyinfo->dobj.dependencies, tyinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Type Comments */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "TYPE %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	PQclear(res);
  	destroyPQExpBuffer(q);
--- 6732,6747 ----
  				 tyinfo->dobj.dependencies, tyinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Type Comments and Security Labels */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "TYPE %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 				 tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
+ 				 tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	PQclear(res);
  	destroyPQExpBuffer(q);
***************
*** 7093,7105 **** dumpBaseType(Archive *fout, TypeInfo *tyinfo)
  				 tyinfo->dobj.dependencies, tyinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Type Comments */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "TYPE %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	PQclear(res);
  	destroyPQExpBuffer(q);
--- 7111,7126 ----
  				 tyinfo->dobj.dependencies, tyinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Type Comments and Security Labels */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "TYPE %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 				 tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
+ 				 tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	PQclear(res);
  	destroyPQExpBuffer(q);
***************
*** 7217,7229 **** dumpDomain(Archive *fout, TypeInfo *tyinfo)
  				 tyinfo->dobj.dependencies, tyinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Domain Comments */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "DOMAIN %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	destroyPQExpBuffer(q);
  	destroyPQExpBuffer(delq);
--- 7238,7253 ----
  				 tyinfo->dobj.dependencies, tyinfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Domain Comments and Security Labels */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "DOMAIN %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 				 tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
+ 				 tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	destroyPQExpBuffer(q);
  	destroyPQExpBuffer(delq);
***************
*** 7323,7335 **** dumpCompositeType(Archive *fout, TypeInfo *tyinfo)
  				 NULL, NULL);
  
  
! 	/* Dump Type Comments */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "TYPE %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	PQclear(res);
  	destroyPQExpBuffer(q);
--- 7347,7362 ----
  				 NULL, NULL);
  
  
! 	/* Dump Type Comments and Security Labels */
  	resetPQExpBuffer(q);
  
  	appendPQExpBuffer(q, "TYPE %s", fmtId(tyinfo->dobj.name));
  	dumpComment(fout, q->data,
  				tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
  				tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 				 tyinfo->dobj.namespace->dobj.name, tyinfo->rolname,
+ 				 tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId);
  
  	PQclear(res);
  	destroyPQExpBuffer(q);
***************
*** 7647,7658 **** dumpProcLang(Archive *fout, ProcLangInfo *plang)
  				 plang->dobj.dependencies, plang->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Proc Lang Comments */
  	resetPQExpBuffer(defqry);
  	appendPQExpBuffer(defqry, "LANGUAGE %s", qlanname);
  	dumpComment(fout, defqry->data,
  				NULL, "",
  				plang->dobj.catId, 0, plang->dobj.dumpId);
  
  	if (plang->lanpltrusted)
  		dumpACL(fout, plang->dobj.catId, plang->dobj.dumpId, "LANGUAGE",
--- 7674,7688 ----
  				 plang->dobj.dependencies, plang->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Proc Lang Comments and Security Labels */
  	resetPQExpBuffer(defqry);
  	appendPQExpBuffer(defqry, "LANGUAGE %s", qlanname);
  	dumpComment(fout, defqry->data,
  				NULL, "",
  				plang->dobj.catId, 0, plang->dobj.dumpId);
+ 	dumpSecLabel(fout, defqry->data,
+ 				 NULL, "",
+ 				 plang->dobj.catId, 0, plang->dobj.dumpId);
  
  	if (plang->lanpltrusted)
  		dumpACL(fout, plang->dobj.catId, plang->dobj.dumpId, "LANGUAGE",
***************
*** 8208,8219 **** dumpFunc(Archive *fout, FuncInfo *finfo)
  				 finfo->dobj.dependencies, finfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Function Comments */
  	resetPQExpBuffer(q);
  	appendPQExpBuffer(q, "FUNCTION %s", funcsig);
  	dumpComment(fout, q->data,
  				finfo->dobj.namespace->dobj.name, finfo->rolname,
  				finfo->dobj.catId, 0, finfo->dobj.dumpId);
  
  	dumpACL(fout, finfo->dobj.catId, finfo->dobj.dumpId, "FUNCTION",
  			funcsig, NULL, funcsig_tag,
--- 8238,8252 ----
  				 finfo->dobj.dependencies, finfo->dobj.nDeps,
  				 NULL, NULL);
  
! 	/* Dump Function Comments and Security Labels */
  	resetPQExpBuffer(q);
  	appendPQExpBuffer(q, "FUNCTION %s", funcsig);
  	dumpComment(fout, q->data,
  				finfo->dobj.namespace->dobj.name, finfo->rolname,
  				finfo->dobj.catId, 0, finfo->dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 				 finfo->dobj.namespace->dobj.name, finfo->rolname,
+ 				 finfo->dobj.catId, 0, finfo->dobj.dumpId);
  
  	dumpACL(fout, finfo->dobj.catId, finfo->dobj.dumpId, "FUNCTION",
  			funcsig, NULL, funcsig_tag,
***************
*** 9711,9716 **** dumpAgg(Archive *fout, AggInfo *agginfo)
--- 9744,9752 ----
  	dumpComment(fout, q->data,
  			agginfo->aggfn.dobj.namespace->dobj.name, agginfo->aggfn.rolname,
  				agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId);
+ 	dumpSecLabel(fout, q->data,
+ 			agginfo->aggfn.dobj.namespace->dobj.name, agginfo->aggfn.rolname,
+ 				 agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId);
  
  	/*
  	 * Since there is no GRANT ON AGGREGATE syntax, we have to make the ACL
***************
*** 10461,10566 **** dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId,
  /*
   * dumpSecLabel 
   *
!  * It dumps any security labels associated with the object handed
!  * to this routine. The routine takes a constant character string
!  * for the target part of the security-label command, plus the
!  * namespace and owner of the object (for labeling the ArchiveEntry),
!  * plus catalogId which is lookup key for pg_seclabel, and dumpId
!  * for the object.
   * If a matching pg_seclabel entry is found, it is dumped.
   */
  static void
! dumpSecLabel(Archive *fout, CatalogId objCatId, DumpId objDumpId,
! 			 const char *type, const char *target,
! 			 const char *nspname, const char *owner)
  {
! 	PGresult	   *res;
! 	PQExpBuffer		lquery;
! 	PQExpBuffer		cquery;
! 	PQExpBuffer		tgbuf;
! 	int				i_attname;
! 	int				i_provider;
! 	int				i_label;
! 	int				i, ntups;
  
! 	/* do nothing, if security label dump is not enabled */
! 	if (!security_label)
! 		return;
! 
! 	/* --data-only skips security labels *except* large object */
! 	if (dataOnly && strcmp(type, "LARGE OBJECT") != 0)
  		return;
  
! 	/*
! 	 * Fetch security labels associated with the object
! 	 */
! 	lquery = createPQExpBuffer();
! 	cquery = createPQExpBuffer();
! 	tgbuf = createPQExpBuffer();
! 
! 	appendPQExpBuffer(lquery,
! 					  "SELECT a.attname, s.provider, s.label"
! 					  "  FROM pg_catalog.pg_seclabel s"
! 					  "       LEFT OUTER JOIN"
! 					  "       pg_catalog.pg_attribute a"
! 					  "       ON s.objoid = a.attrelid AND"
! 					  "          s.objsubid = a.attnum"
! 					  "  WHERE classoid = %u AND objoid = %u",
! 					  objCatId.tableoid, objCatId.oid);
! 
! 	res = PQexec(g_conn, lquery->data);
! 	check_sql_result(res, g_conn, lquery->data, PGRES_TUPLES_OK);
  
! 	i_attname = PQfnumber(res, "attname");
! 	i_provider = PQfnumber(res, "provider");
! 	i_label	= PQfnumber(res, "label");
  
! 	ntups = PQntuples(res);
  
! 	for (i = 0; i < ntups; i++)
  	{
- 		if (strcmp(type, "TABLE") == 0 &&
- 			!PQgetisnull(res, i, i_attname))
- 		{
- 			appendPQExpBuffer(cquery,
- 							  "SECURITY LABEL FOR '%s'"
- 							  " ON COLUMN %s.%s IS '%s';\n",
- 							  PQgetvalue(res, i, i_provider),
- 							  target,
- 							  fmtId(PQgetvalue(res, i, i_attname)),
- 							  PQgetvalue(res, i, i_label));
- 			continue;
- 		}
- 
  		/*
! 		 * a.attname can be available only when type = "TABLE",
! 		 * so we expect it will be always NULL. Elsewhere, we assume
! 		 * it as a data corruption, so simply ignored.
  		 */
! 		if (!PQgetisnull(res, i, i_attname))
  			continue;
  
! 		appendPQExpBuffer(cquery,
! 						  "SECURITY LABEL FOR '%s' ON %s %s IS '%s';\n",
! 						  PQgetvalue(res, i, i_provider),
! 						  type, target,
! 						  PQgetvalue(res, i, i_label));
  	}
- 	PQclear(res);
  
! 	if (cquery->len > 0)
  	{
- 		appendPQExpBuffer(tgbuf, "%s %s", type, target);
  		ArchiveEntry(fout, nilCatalogId, createDumpId(),
! 					 tgbuf->data, nspname, NULL, owner,
  					 false, "SECURITY LABEL", SECTION_NONE,
! 					 cquery->data, "", NULL,
! 					 &(objDumpId), 1,
  					 NULL, NULL);
  	}
! 	destroyPQExpBuffer(lquery);
! 	destroyPQExpBuffer(cquery);
! 	destroyPQExpBuffer(tgbuf);
  }
  
  /*
--- 10497,10796 ----
  /*
   * dumpSecLabel 
   *
!  * This routine is used to dump any security labels associated with the
!  * object handed to this routine. The routine takes a constant character
!  * string for the target part of the security-label command, plus
!  * the namespace and owner of the object (for labeling the ArchiveEntry),
!  * plus catalog ID and subid which are the lookup key for pg_seclabel,
!  * plus the dump ID for the object (for setting a dependency).
   * If a matching pg_seclabel entry is found, it is dumped.
+  *
+  * Note: although this routine takes a dumpId for dependency purposes,
+  * that purpose is just to mark the dependency in the emitted dump file
+  * for possible future use by pg_restore.  We do NOT use it for determining
+  * ordering of the label in the dump file, because this routine is called
+  * after dependency sorting occurs.  This routine should be called just after
+  * calling ArchiveEntry() for the specified object.
   */
  static void
! dumpSecLabel(Archive *fout, const char *target,
! 			 const char *namespace, const char *owner,
! 			 CatalogId catalogId, int subid, DumpId dumpId)
  {
! 	SecLabelItem   *labels;
! 	int				nlabels;
! 	int				i;
! 	PQExpBuffer		query;
  
! 	/* do nothing, if --no-security-label is supplied */
! 	if (no_security_label)
  		return;
  
! 	/* Comments are schema not data ... except blob comments are data */
! 	if (strncmp(target, "LARGE OBJECT ", 13) != 0)
! 	{
! 		if (dataOnly)
! 			return;
! 	}
! 	else
! 	{
! 		if (schemaOnly)
! 			return;
! 	}
  
! 	/* Search for security labels associated with catalogId, using table */
! 	nlabels = findSecLabels(fout, catalogId.tableoid, catalogId.oid, &labels);
  
! 	query = createPQExpBuffer();
  
! 	for (i = 0; i < nlabels; i++)
  	{
  		/*
! 		 * Ignore label entries which does not match with the supplied subid.
! 		 * However, only relations have objsubid except for zero, and we dump
! 		 * security labels of relations at dumpTableSecLabel(), so it might
! 		 * be a bug if labels[i].objsubid has any values except for zero.
  		 */
! 		if (labels[i].objsubid != subid)
  			continue;
  
! 		appendPQExpBuffer(query,
! 						  "SECURITY LABEL FOR '%s' ON %s IS ",
! 						  labels[i].provider, target);
! 		appendStringLiteralAH(query, labels[i].label, fout);
! 		appendPQExpBuffer(query, ";\n");
  	}
  
! 	if (query->len > 0)
  	{
  		ArchiveEntry(fout, nilCatalogId, createDumpId(),
! 					 target, namespace, NULL, owner,
  					 false, "SECURITY LABEL", SECTION_NONE,
! 					 query->data, "", NULL,
! 					 &(dumpId), 1,
  					 NULL, NULL);
  	}
! 	destroyPQExpBuffer(query);
! }
! 
! /*
!  * dumpTableSecLabel
!  *
!  * As above, but dump security label for both the specified table (or view)
!  * and its columns.
!  */
! static void
! dumpTableSecLabel(Archive *fout, TableInfo *tbinfo, const char *reltypename)
! {
! 	SecLabelItem   *labels;
! 	int				nlabels;
! 	int				i;
! 	PQExpBuffer		query;
!     PQExpBuffer		target;
! 
! 	/* do nothing, if --no-security-label is supplied */
! 	if (no_security_label)
! 		return;
! 
! 	/* SecLabel are SCHEMA not data */
! 	if (dataOnly)
! 		return;
! 
! 	/* Search for comments associated with relation, using table */
! 	nlabels = findSecLabels(fout,
! 							tbinfo->dobj.catId.tableoid,
! 							tbinfo->dobj.catId.oid,
! 							&labels);
! 
! 	/* If comments exist, build SECURITY LABEL statements */
! 	if (nlabels <= 0)
! 		return;
! 
! 	query = createPQExpBuffer();
! 	target = createPQExpBuffer();
! 
! 	for (i = 0; i < nlabels; i++)
! 	{
! 		const char *colname;
! 		const char *provider	= labels[i].provider;
! 		const char *label		= labels[i].label;
! 		int			objsubid	= labels[i].objsubid;
! 
! 		resetPQExpBuffer(target);
! 		if (objsubid == 0)
! 		{
! 			appendPQExpBuffer(target, "%s %s", reltypename,
! 							  fmtId(tbinfo->dobj.name));
! 		}
! 		else
! 		{
! 			colname = getAttrName(objsubid, tbinfo);
! 			appendPQExpBuffer(target, "COLUMN %s.%s",
! 							  fmtId(tbinfo->dobj.name),
! 							  fmtId(colname));
! 		}
! 		appendPQExpBuffer(query, "SECURITY LABEL FOR %s ON %s IS ",
! 						  provider, target->data);
! 		appendStringLiteralAH(query, label, fout);
! 		appendPQExpBuffer(query, ";\n");
! 	}
! 	if (query->len > 0)
! 	{
! 		resetPQExpBuffer(target);
! 		appendPQExpBuffer(target, "%s %s", reltypename,
! 						  fmtId(tbinfo->dobj.name));
! 		ArchiveEntry(fout, nilCatalogId, createDumpId(),
! 					 target->data,
! 					 tbinfo->dobj.namespace->dobj.name,
! 					 NULL, tbinfo->rolname,
! 					 false, "SECURITY LABEL", SECTION_NONE,
! 					 query->data, "", NULL,
! 					 &(tbinfo->dobj.dumpId), 1,
! 					 NULL, NULL);
! 	}
! 	destroyPQExpBuffer(query);
! 	destroyPQExpBuffer(target);
! }
! 
! /*
!  * findSecLabels
!  *
!  * Find the security label(s), if any, associated with the given object.
!  * All the objsubid values associated with the given classoid/objoid are
!  * found with one search.
!  */
! static int
! findSecLabels(Archive *fout, Oid classoid, Oid objoid, SecLabelItem **items)
! {
! 	/* static storage for table of security labels */
! 	static SecLabelItem *labels = NULL;
! 	static int			 nlabels = -1;
! 
! 	SecLabelItem		*middle = NULL;
! 	SecLabelItem		*low;
! 	SecLabelItem		*high;
! 	int					 nmatch;
! 
! 	/* Get security labels if we didn't already */
! 	if (nlabels < 0)
! 		nlabels = collectSecLabels(fout, &labels);
! 
! 	/*
! 	 * Do binary search to find some item matching the object.
! 	 */
! 	low = &labels[0];
! 	high = &labels[nlabels - 1];
! 	while (low <= high)
! 	{
! 		middle = low + (high - low) / 2;
! 
! 		if (classoid < middle->classoid)
! 			high = middle - 1;
! 		else if (classoid > middle->classoid)
! 			low = middle + 1;
! 		else if (objoid < middle->objoid)
! 			high = middle - 1;
! 		else if (objoid > middle->objoid)
! 			low = middle + 1;
! 		else
! 			break;			/* found a match */
! 	}
! 
! 	if (low > high)			/* no matches */
! 	{
! 		*items = NULL;
! 		return 0;
! 	}
! 
! 	/*
! 	 * Now determine how many items match the object.  The search loop
! 	 * invariant still holds: only items between low and high inclusive could
! 	 * match.
! 	 */
! 	nmatch = 1;
! 	while (middle > low)
! 	{
! 		if (classoid != middle[-1].classoid ||
! 			objoid != middle[-1].objoid)
! 			break;
! 		middle--;
! 		nmatch++;
! 	}
! 
! 	*items = middle;
! 
! 	middle += nmatch;
! 	while (middle <= high)
! 	{
! 		if (classoid != middle->classoid ||
! 			objoid != middle->objoid)
! 			break;
! 		middle++;
! 		nmatch++;
! 	}
! 
! 	return nmatch;
! }
! 
! /*
!  * collectSecLabels
!  *
!  * Construct a table of all security labels available for database objects.
!  * We used to do per-object queries for the comments, but it's much faster
!  * to pull them all over at once, and on most databases the memory cost
!  * isn't high.
!  *
!  * The table is sorted by classoid/objid/objsubid for speed in lookup.
!  */
! static int
! collectSecLabels(Archive *fout, SecLabelItem **items)
! {
! 	PGresult	   *res;
! 	PQExpBuffer		query;
! 	int				i_label;
! 	int				i_provider;
! 	int				i_classoid;
! 	int				i_objoid;
! 	int				i_objsubid;
! 	int				ntups;
! 	int				i;
! 	SecLabelItem   *labels;
! 
! 	query = createPQExpBuffer();
! 
! 	appendPQExpBuffer(query,
! 					  "SELECT label, provider, classoid, objoid, objsubid "
! 					  "FROM pg_catalog.pg_seclabel "
! 					  "ORDER BY classoid, objoid, objsubid");
! 
! 	res = PQexec(g_conn, query->data);
! 	check_sql_result(res, g_conn, query->data, PGRES_TUPLES_OK);
! 
! 	/* Construct lookup table containing OIDs in numeric form */
! 	i_label		= PQfnumber(res, "label");
! 	i_provider	= PQfnumber(res, "provider");
! 	i_classoid	= PQfnumber(res, "classoid");
! 	i_objoid	= PQfnumber(res, "objoid");
! 	i_objsubid	= PQfnumber(res, "objsubid");
! 
! 	ntups = PQntuples(res);
! 
! 	labels = (SecLabelItem *) malloc(ntups * sizeof(SecLabelItem));
! 
! 	for (i = 0; i < ntups; i++)
! 	{
! 		labels[i].label		= PQgetvalue(res, i, i_label);
! 		labels[i].provider	= PQgetvalue(res, i, i_provider);
! 		labels[i].classoid = atooid(PQgetvalue(res, i, i_classoid));
! 		labels[i].objoid = atooid(PQgetvalue(res, i, i_objoid));
! 		labels[i].objsubid = atoi(PQgetvalue(res, i, i_objsubid));
! 	}
! 
! 	/* Do NOT free the PGresult since we are keeping pointers into it */
!     destroyPQExpBuffer(query);
! 
! 	*items = labels;
! 	return ntups;
  }
  
  /*
***************
*** 10587,10599 **** dumpTable(Archive *fout, TableInfo *tbinfo)
  				tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
  				tbinfo->relacl);
  
- 		/* Handle the security label here */
- 		dumpSecLabel(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId,
- 					 (tbinfo->relkind == RELKIND_SEQUENCE ? "SEQUENCE" :
- 					  (tbinfo->relkind == RELKIND_VIEW ? "VIEW" : "TABLE")),
- 					 namecopy,
- 					 tbinfo->dobj.namespace->dobj.name,
- 					 tbinfo->rolname);
  		/*
  		 * Handle column ACLs, if any.	Note: we pull these with a separate
  		 * query rather than trying to fetch them during getTableAttrs, so
--- 10817,10822 ----
***************
*** 11086,11091 **** dumpTableSchema(Archive *fout, TableInfo *tbinfo)
--- 11309,11317 ----
  	/* Dump Table Comments */
  	dumpTableComment(fout, tbinfo, reltypename);
  
+ 	/* Dump Table Security Labels */
+ 	dumpTableSecLabel(fout, tbinfo, reltypename);
+ 
  	/* Dump comments on inlined table constraints */
  	for (j = 0; j < tbinfo->ncheck; j++)
  	{
***************
*** 11799,11810 **** dumpSequence(Archive *fout, TableInfo *tbinfo)
  			}
  		}
  
! 		/* Dump Sequence Comments */
  		resetPQExpBuffer(query);
  		appendPQExpBuffer(query, "SEQUENCE %s", fmtId(tbinfo->dobj.name));
  		dumpComment(fout, query->data,
  					tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
  					tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId);
  	}
  
  	if (!schemaOnly)
--- 12025,12039 ----
  			}
  		}
  
! 		/* Dump Sequence Comments and Security Labels */
  		resetPQExpBuffer(query);
  		appendPQExpBuffer(query, "SEQUENCE %s", fmtId(tbinfo->dobj.name));
  		dumpComment(fout, query->data,
  					tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
  					tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId);
+ 		dumpSecLabel(fout, query->data,
+ 					 tbinfo->dobj.namespace->dobj.name, tbinfo->rolname,
+ 					 tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId);
  	}
  
  	if (!schemaOnly)
*** a/src/bin/pg_dump/pg_dumpall.c
--- b/src/bin/pg_dump/pg_dumpall.c
***************
*** 69,75 **** static int	disable_triggers = 0;
  static int	inserts = 0;
  static int	no_tablespaces = 0;
  static int	use_setsessauth = 0;
! static int	security_label = 0;
  static int	server_version;
  
  static FILE *OPF;
--- 69,75 ----
  static int	inserts = 0;
  static int	no_tablespaces = 0;
  static int	use_setsessauth = 0;
! static int	no_security_label = 0;
  static int	server_version;
  
  static FILE *OPF;
***************
*** 134,140 **** main(int argc, char *argv[])
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
! 		{"security-label", no_argument, &security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
--- 134,140 ----
  		{"quote-all-identifiers", no_argument, &quote_all_identifiers, 1},
  		{"role", required_argument, NULL, 3},
  		{"use-set-session-authorization", no_argument, &use_setsessauth, 1},
! 		{"no-security-label", no_argument, &no_security_label, 1},
  
  		{NULL, 0, NULL, 0}
  	};
***************
*** 288,295 **** main(int argc, char *argv[])
  					no_tablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
! 				else if (strcmp(optarg, "security-label") == 0)
! 					security_label = 1;
  				else
  				{
  					fprintf(stderr,
--- 288,295 ----
  					no_tablespaces = 1;
  				else if (strcmp(optarg, "use-set-session-authorization") == 0)
  					use_setsessauth = 1;
! 				else if (strcmp(optarg, "no-security-label") == 0)
! 					no_security_label = 1;
  				else
  				{
  					fprintf(stderr,
***************
*** 375,382 **** main(int argc, char *argv[])
  		appendPQExpBuffer(pgdumpopts, " --quote-all-identifiers");
  	if (use_setsessauth)
  		appendPQExpBuffer(pgdumpopts, " --use-set-session-authorization");
! 	if (security_label)
! 		appendPQExpBuffer(pgdumpopts, " --security-label");
  
  	/*
  	 * If there was a database specified on the command line, use that,
--- 375,382 ----
  		appendPQExpBuffer(pgdumpopts, " --quote-all-identifiers");
  	if (use_setsessauth)
  		appendPQExpBuffer(pgdumpopts, " --use-set-session-authorization");
! 	if (no_security_label)
! 		appendPQExpBuffer(pgdumpopts, " --no-security-label");
  
  	/*
  	 * If there was a database specified on the command line, use that,
***************
*** 573,579 **** help(void)
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
! 	printf(_("  --security-label            also dump security labels\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
--- 573,579 ----
  	printf(_("  --no-tablespaces            do not dump tablespace assignments\n"));
  	printf(_("  --quote-all-identifiers     quote all identifiers, even if not keywords\n"));
  	printf(_("  --role=ROLENAME             do SET ROLE before dump\n"));
! 	printf(_("  --no-security-label         do not dump security label assignments\n"));
  	printf(_("  --use-set-session-authorization\n"
  			 "                              use SET SESSION AUTHORIZATION commands instead of\n"
  	"                              ALTER OWNER commands to set ownership\n"));
*** a/src/test/regress/GNUmakefile
--- b/src/test/regress/GNUmakefile
***************
*** 109,115 **** installdirs-tests: installdirs
  
  # Get some extra C modules from contrib/spi...
  
! all: refint$(DLSUFFIX) autoinc$(DLSUFFIX)
  
  refint$(DLSUFFIX): $(top_builddir)/contrib/spi/refint$(DLSUFFIX)
  	cp $< $@
--- 109,115 ----
  
  # Get some extra C modules from contrib/spi...
  
! all: refint$(DLSUFFIX) autoinc$(DLSUFFIX) dummy_esp$(DLSUFFIX)
  
  refint$(DLSUFFIX): $(top_builddir)/contrib/spi/refint$(DLSUFFIX)
  	cp $< $@
***************
*** 117,128 **** refint$(DLSUFFIX): $(top_builddir)/contrib/spi/refint$(DLSUFFIX)
--- 117,133 ----
  autoinc$(DLSUFFIX): $(top_builddir)/contrib/spi/autoinc$(DLSUFFIX)
  	cp $< $@
  
+ dummy_esp$(DLSUFFIX): $(top_builddir)/contrib/dummy_esp/dummy_esp$(DLSUFFIX)
+ 	cp $< $@
+ 
  $(top_builddir)/contrib/spi/refint$(DLSUFFIX): $(top_srcdir)/contrib/spi/refint.c
  	$(MAKE) -C $(top_builddir)/contrib/spi refint$(DLSUFFIX)
  
  $(top_builddir)/contrib/spi/autoinc$(DLSUFFIX): $(top_srcdir)/contrib/spi/autoinc.c
  	$(MAKE) -C $(top_builddir)/contrib/spi autoinc$(DLSUFFIX)
  
+ $(top_builddir)/contrib/dummy_esp/dummy_esp$(DLSUFFIX): $(top_builddir)/contrib/dummy_esp/dummy_esp.c
+ 	$(MAKE) -C $(top_builddir)/contrib/dummy_esp dummy_esp$(DLSUFFIX)
  
  # Tablespace setup
  
***************
*** 171,177 **** bigcheck: all
  
  clean distclean maintainer-clean: clean-lib
  # things built by `all' target
! 	rm -f $(OBJS) refint$(DLSUFFIX) autoinc$(DLSUFFIX) pg_regress_main.o pg_regress.o pg_regress$(X)
  # things created by various check targets
  	rm -f $(output_files) $(input_files)
  	rm -rf testtablespace
--- 176,183 ----
  
  clean distclean maintainer-clean: clean-lib
  # things built by `all' target
! 	rm -f $(OBJS) refint$(DLSUFFIX) autoinc$(DLSUFFIX) dummy_esp$(DLSUFFIX)
! 	rm -f pg_regress_main.o pg_regress.o pg_regress$(X)
  # things created by various check targets
  	rm -f $(output_files) $(input_files)
  	rm -rf testtablespace
*** a/src/test/regress/expected/rules.out
--- b/src/test/regress/expected/rules.out
***************
*** 1276,1283 **** drop table cchild;
  -- Check that ruleutils are working
  --
  SELECT viewname, definition FROM pg_views WHERE schemaname <> 'information_schema' ORDER BY viewname;
!           viewname           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            definition                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
! -----------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   iexit                       | SELECT ih.name, ih.thepath, interpt_pp(ih.thepath, r.thepath) AS exit FROM ihighway ih, ramp r WHERE (ih.thepath ## r.thepath);
   pg_cursors                  | SELECT c.name, c.statement, c.is_holdable, c.is_binary, c.is_scrollable, c.creation_time FROM pg_cursor() c(name, statement, is_holdable, is_binary, is_scrollable, creation_time);
   pg_group                    | SELECT pg_authid.rolname AS groname, pg_authid.oid AS grosysid, ARRAY(SELECT pg_auth_members.member FROM pg_auth_members WHERE (pg_auth_members.roleid = pg_authid.oid)) AS grolist FROM pg_authid WHERE (NOT pg_authid.rolcanlogin);
--- 1276,1283 ----
  -- Check that ruleutils are working
  --
  SELECT viewname, definition FROM pg_views WHERE schemaname <> 'information_schema' ORDER BY viewname;
!           viewname           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         definition                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
! -----------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   iexit                       | SELECT ih.name, ih.thepath, interpt_pp(ih.thepath, r.thepath) AS exit FROM ihighway ih, ramp r WHERE (ih.thepath ## r.thepath);
   pg_cursors                  | SELECT c.name, c.statement, c.is_holdable, c.is_binary, c.is_scrollable, c.creation_time FROM pg_cursor() c(name, statement, is_holdable, is_binary, is_scrollable, creation_time);
   pg_group                    | SELECT pg_authid.rolname AS groname, pg_authid.oid AS grosysid, ARRAY(SELECT pg_auth_members.member FROM pg_auth_members WHERE (pg_auth_members.roleid = pg_authid.oid)) AS grolist FROM pg_authid WHERE (NOT pg_authid.rolcanlogin);
***************
*** 1287,1292 **** SELECT viewname, definition FROM pg_views WHERE schemaname <> 'information_schem
--- 1287,1293 ----
   pg_prepared_xacts           | SELECT p.transaction, p.gid, p.prepared, u.rolname AS owner, d.datname AS database FROM ((pg_prepared_xact() p(transaction, gid, prepared, ownerid, dbid) LEFT JOIN pg_authid u ON ((p.ownerid = u.oid))) LEFT JOIN pg_database d ON ((p.dbid = d.oid)));
   pg_roles                    | SELECT pg_authid.rolname, pg_authid.rolsuper, pg_authid.rolinherit, pg_authid.rolcreaterole, pg_authid.rolcreatedb, pg_authid.rolcatupdate, pg_authid.rolcanlogin, pg_authid.rolconnlimit, '********'::text AS rolpassword, pg_authid.rolvaliduntil, s.setconfig AS rolconfig, pg_authid.oid FROM (pg_authid LEFT JOIN pg_db_role_setting s ON (((pg_authid.oid = s.setrole) AND (s.setdatabase = (0)::oid))));
   pg_rules                    | SELECT n.nspname AS schemaname, c.relname AS tablename, r.rulename, pg_get_ruledef(r.oid) AS definition FROM ((pg_rewrite r JOIN pg_class c ON ((c.oid = r.ev_class))) LEFT JOIN pg_namespace n ON ((n.oid = c.relnamespace))) WHERE (r.rulename <> '_RETURN'::name);
+  pg_seclabels                | (((((SELECT l.objoid, l.classoid, l.objsubid, CASE WHEN (rel.relkind = 'r'::"char") THEN 'table'::text WHEN (rel.relkind = 'v'::"char") THEN 'view'::text WHEN (rel.relkind = 'S'::"char") THEN 'sequence'::text ELSE NULL::text END AS objtype, rel.relnamespace AS objnamespace, CASE WHEN pg_table_is_visible(rel.oid) THEN quote_ident((rel.relname)::text) ELSE ((quote_ident((nsp.nspname)::text) || '.'::text) || quote_ident((rel.relname)::text)) END AS objname, l.provider, l.label FROM ((pg_seclabel l JOIN pg_class rel ON (((l.classoid = rel.tableoid) AND (l.objoid = rel.oid)))) JOIN pg_namespace nsp ON ((rel.relnamespace = nsp.oid))) WHERE (l.objsubid = 0) UNION ALL SELECT l.objoid, l.classoid, l.objsubid, 'column'::text AS objtype, rel.relnamespace AS objnamespace, ((CASE WHEN pg_table_is_visible(rel.oid) THEN quote_ident((rel.relname)::text) ELSE ((quote_ident((nsp.nspname)::text) || '.'::text) || quote_ident((rel.relname)::text)) END || '.'::text) || (att.attname)::text) AS objname, l.provider, l.label FROM (((pg_seclabel l JOIN pg_class rel ON (((l.classoid = rel.tableoid) AND (l.objoid = rel.oid)))) JOIN pg_attribute att ON (((rel.oid = att.attrelid) AND (l.objsubid = att.attnum)))) JOIN pg_namespace nsp ON ((rel.relnamespace = nsp.oid))) WHERE (l.objsubid <> 0)) UNION ALL SELECT l.objoid, l.classoid, l.objsubid, CASE WHEN (pro.proisagg = true) THEN 'aggregate'::text WHEN (pro.proisagg = false) THEN 'function'::text ELSE NULL::text END AS objtype, pro.pronamespace AS objnamespace, (((CASE WHEN pg_function_is_visible(pro.oid) THEN quote_ident((pro.proname)::text) ELSE ((quote_ident((nsp.nspname)::text) || '.'::text) || quote_ident((pro.proname)::text)) END || '('::text) || pg_get_function_arguments(pro.oid)) || ')'::text) AS objname, l.provider, l.label FROM ((pg_seclabel l JOIN pg_proc pro ON (((l.classoid = pro.tableoid) AND (l.objoid = pro.oid)))) JOIN pg_namespace nsp ON ((pro.pronamespace = nsp.oid))) WHERE (l.objsubid = 0)) UNION ALL SELECT l.objoid, l.classoid, l.objsubid, CASE WHEN (typ.typtype = 'd'::"char") THEN 'domain'::text ELSE 'type'::text END AS objtype, typ.typnamespace AS objnamespace, CASE WHEN pg_type_is_visible(typ.oid) THEN quote_ident((typ.typname)::text) ELSE ((quote_ident((nsp.nspname)::text) || '.'::text) || quote_ident((typ.typname)::text)) END AS objname, l.provider, l.label FROM ((pg_seclabel l JOIN pg_type typ ON (((l.classoid = typ.tableoid) AND (l.objoid = typ.oid)))) JOIN pg_namespace nsp ON ((typ.typnamespace = nsp.oid))) WHERE (l.objsubid = 0)) UNION ALL SELECT l.objoid, l.classoid, l.objsubid, 'large object'::text AS objtype, NULL::oid AS objnamespace, (l.objoid)::text AS objname, l.provider, l.label FROM (pg_seclabel l JOIN pg_largeobject_metadata lom ON ((l.objoid = lom.oid))) WHERE ((l.classoid = (SELECT pg_class.oid FROM pg_class WHERE ((pg_class.relname = 'pg_largeobject'::name) AND (pg_class.relnamespace = (SELECT pg_namespace.oid FROM pg_namespace WHERE (pg_namespace.nspname = 'pg_catalog'::name)))))) AND (l.objsubid = 0))) UNION ALL SELECT l.objoid, l.classoid, l.objsubid, 'language'::text AS objtype, NULL::oid AS objnamespace, quote_ident((lan.lanname)::text) AS objname, l.provider, l.label FROM (pg_seclabel l JOIN pg_language lan ON (((l.classoid = lan.tableoid) AND (l.objoid = lan.oid)))) WHERE (l.objsubid = 0)) UNION ALL SELECT l.objoid, l.classoid, l.objsubid, 'schema'::text AS objtype, nsp.oid AS objnamespace, quote_ident((nsp.nspname)::text) AS objname, l.provider, l.label FROM (pg_seclabel l JOIN pg_namespace nsp ON (((l.classoid = nsp.tableoid) AND (l.objoid = nsp.oid)))) WHERE (l.objsubid = 0);
   pg_settings                 | SELECT a.name, a.setting, a.unit, a.category, a.short_desc, a.extra_desc, a.context, a.vartype, a.source, a.min_val, a.max_val, a.enumvals, a.boot_val, a.reset_val, a.sourcefile, a.sourceline FROM pg_show_all_settings() a(name, setting, unit, category, short_desc, extra_desc, context, vartype, source, min_val, max_val, enumvals, boot_val, reset_val, sourcefile, sourceline);
   pg_shadow                   | SELECT pg_authid.rolname AS usename, pg_authid.oid AS usesysid, pg_authid.rolcreatedb AS usecreatedb, pg_authid.rolsuper AS usesuper, pg_authid.rolcatupdate AS usecatupd, pg_authid.rolpassword AS passwd, (pg_authid.rolvaliduntil)::abstime AS valuntil, s.setconfig AS useconfig FROM (pg_authid LEFT JOIN pg_db_role_setting s ON (((pg_authid.oid = s.setrole) AND (s.setdatabase = (0)::oid)))) WHERE pg_authid.rolcanlogin;
   pg_stat_activity            | SELECT s.datid, d.datname, s.procpid, s.usesysid, u.rolname AS usename, s.application_name, s.client_addr, s.client_port, s.backend_start, s.xact_start, s.query_start, s.waiting, s.current_query FROM pg_database d, pg_stat_get_activity(NULL::integer) s(datid, procpid, usesysid, application_name, current_query, waiting, xact_start, query_start, backend_start, client_addr, client_port), pg_authid u WHERE ((s.datid = d.oid) AND (s.usesysid = u.oid));
***************
*** 1333,1339 **** SELECT viewname, definition FROM pg_views WHERE schemaname <> 'information_schem
   shoelace_obsolete           | SELECT shoelace.sl_name, shoelace.sl_avail, shoelace.sl_color, shoelace.sl_len, shoelace.sl_unit, shoelace.sl_len_cm FROM shoelace WHERE (NOT (EXISTS (SELECT shoe.shoename FROM shoe WHERE (shoe.slcolor = shoelace.sl_color))));
   street                      | SELECT r.name, r.thepath, c.cname FROM ONLY road r, real_city c WHERE (c.outline ## r.thepath);
   toyemp                      | SELECT emp.name, emp.age, emp.location, (12 * emp.salary) AS annualsal FROM emp;
! (55 rows)
  
  SELECT tablename, rulename, definition FROM pg_rules 
  	ORDER BY tablename, rulename;
--- 1334,1340 ----
   shoelace_obsolete           | SELECT shoelace.sl_name, shoelace.sl_avail, shoelace.sl_color, shoelace.sl_len, shoelace.sl_unit, shoelace.sl_len_cm FROM shoelace WHERE (NOT (EXISTS (SELECT shoe.shoename FROM shoe WHERE (shoe.slcolor = shoelace.sl_color))));
   street                      | SELECT r.name, r.thepath, c.cname FROM ONLY road r, real_city c WHERE (c.outline ## r.thepath);
   toyemp                      | SELECT emp.name, emp.age, emp.location, (12 * emp.salary) AS annualsal FROM emp;
! (56 rows)
  
  SELECT tablename, rulename, definition FROM pg_rules 
  	ORDER BY tablename, rulename;
*** /dev/null
--- b/src/test/regress/input/security_label.source
***************
*** 0 ****
--- 1,66 ----
+ --
+ -- Test for facilities of security label
+ --
+ 
+ -- initial setups
+ SET client_min_messages TO 'warning';
+ 
+ DROP ROLE IF EXISTS esp_user1;
+ DROP ROLE IF EXISTS esp_user2;
+ 
+ DROP TABLE IF EXISTS esp_tbl1;
+ DROP TABLE IF EXISTS esp_tbl2;
+ DROP TABLE IF EXISTS esp_tbl3;
+ 
+ CREATE USER esp_user1;
+ CREATE USER esp_user2;
+ 
+ CREATE TABLE esp_tbl1 (a int, b text);
+ CREATE TABLE esp_tbl2 (x int, y text);
+ 
+ ALTER TABLE esp_tbl1 OWNER TO esp_user1;
+ ALTER TABLE esp_tbl2 OWNER TO esp_user2;
+ 
+ RESET client_min_messages;
+ 
+ --
+ -- Test of SECURITY LABEL statement without a plugin
+ --
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'classified';			-- fail
+ SECURITY LABEL FOR 'dummy' ON TABLE esp_tbl1 IS 'classified';		-- fail
+ SECURITY LABEL ON TABLE esp_tbl1 IS '...invalid label...';		-- fail
+ SECURITY LABEL ON TABLE esp_tbl3 IS 'unclassified';			-- fail
+ 
+ -- Load dummy external security provider
+ LOAD '@abs_builddir@/dummy_esp';
+ 
+ --
+ -- Test of SECURITY LABEL statement with a plugin
+ --
+ SET SESSION AUTHORIZATION esp_user1;
+ 
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'classified';			-- OK
+ SECURITY LABEL ON COLUMN esp_tbl1.a IS 'unclassified';			-- OK
+ SECURITY LABEL ON TABLE esp_tbl1 IS '...invalid label...';		-- fail
+ SECURITY LABEL FOR 'dummy' ON TABLE esp_tbl1 IS 'unclassified';		-- OK
+ SECURITY LABEL FOR 'unknown_esp' ON TABLE esp_tbl1 IS 'classified';	-- fail
+ SECURITY LABEL ON TABLE esp_tbl2 IS 'unclassified';			-- fail (not owner)
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'secret';				-- fail (not superuser)
+ SECURITY LABEL ON TABLE esp_tbl3 IS 'unclassified';			-- fail (not found)
+ 
+ SET SESSION AUTHORIZATION esp_user2;
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'unclassified';			-- fail
+ SECURITY LABEL ON TABLE esp_tbl2 IS 'classified';			-- OK
+ 
+ RESET SESSION AUTHORIZATION;
+ 
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'top secret';			-- OK
+ 
+ SELECT objtype, objname, provider, label FROM pg_seclabels
+ 	WHERE objname in ('esp_tbl1', 'esp_tbl2');
+ 
+ -- clean up objects
+ DROP TABLE esp_tbl1;
+ DROP TABLE esp_tbl2;
+ DROP USER esp_user1;
+ DROP USER esp_user2;
*** /dev/null
--- b/src/test/regress/output/security_label.source
***************
*** 0 ****
--- 1,66 ----
+ --
+ -- Test for facilities of security label
+ --
+ -- initial setups
+ SET client_min_messages TO 'warning';
+ DROP ROLE IF EXISTS esp_user1;
+ DROP ROLE IF EXISTS esp_user2;
+ DROP TABLE IF EXISTS esp_tbl1;
+ DROP TABLE IF EXISTS esp_tbl2;
+ DROP TABLE IF EXISTS esp_tbl3;
+ CREATE USER esp_user1;
+ CREATE USER esp_user2;
+ CREATE TABLE esp_tbl1 (a int, b text);
+ CREATE TABLE esp_tbl2 (x int, y text);
+ ALTER TABLE esp_tbl1 OWNER TO esp_user1;
+ ALTER TABLE esp_tbl2 OWNER TO esp_user2;
+ RESET client_min_messages;
+ --
+ -- Test of SECURITY LABEL statement without a plugin
+ --
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'classified';			-- fail
+ ERROR:  security label providers have been loaded
+ SECURITY LABEL FOR 'dummy' ON TABLE esp_tbl1 IS 'classified';		-- fail
+ ERROR:  security label provider "dummy" is not loaded
+ SECURITY LABEL ON TABLE esp_tbl1 IS '...invalid label...';		-- fail
+ ERROR:  security label providers have been loaded
+ SECURITY LABEL ON TABLE esp_tbl3 IS 'unclassified';			-- fail
+ ERROR:  security label providers have been loaded
+ -- Load dummy external security provider
+ LOAD '@abs_builddir@/dummy_esp';
+ --
+ -- Test of SECURITY LABEL statement with a plugin
+ --
+ SET SESSION AUTHORIZATION esp_user1;
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'classified';			-- OK
+ SECURITY LABEL ON COLUMN esp_tbl1.a IS 'unclassified';			-- OK
+ SECURITY LABEL ON TABLE esp_tbl1 IS '...invalid label...';		-- fail
+ ERROR:  '...invalid label...' is not a valid security label
+ SECURITY LABEL FOR 'dummy' ON TABLE esp_tbl1 IS 'unclassified';		-- OK
+ SECURITY LABEL FOR 'unknown_esp' ON TABLE esp_tbl1 IS 'classified';	-- fail
+ ERROR:  security label provider "unknown_esp" is not loaded
+ SECURITY LABEL ON TABLE esp_tbl2 IS 'unclassified';			-- fail (not owner)
+ ERROR:  must be owner of relation esp_tbl2
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'secret';				-- fail (not superuser)
+ ERROR:  only superuser can set 'secret' label
+ SECURITY LABEL ON TABLE esp_tbl3 IS 'unclassified';			-- fail (not found)
+ ERROR:  relation "esp_tbl3" does not exist
+ SET SESSION AUTHORIZATION esp_user2;
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'unclassified';			-- fail
+ ERROR:  must be owner of relation esp_tbl1
+ SECURITY LABEL ON TABLE esp_tbl2 IS 'classified';			-- OK
+ RESET SESSION AUTHORIZATION;
+ SECURITY LABEL ON TABLE esp_tbl1 IS 'top secret';			-- OK
+ SELECT objtype, objname, provider, label FROM pg_seclabels
+ 	WHERE objname in ('esp_tbl1', 'esp_tbl2');
+  objtype | objname  | provider |   label    
+ ---------+----------+----------+------------
+  table   | esp_tbl1 | dummy    | top secret
+  table   | esp_tbl2 | dummy    | classified
+ (2 rows)
+ 
+ -- clean up objects
+ DROP TABLE esp_tbl1;
+ DROP TABLE esp_tbl2;
+ DROP USER esp_user1;
+ DROP USER esp_user2;
*** a/src/test/regress/parallel_schedule
--- b/src/test/regress/parallel_schedule
***************
*** 76,82 **** ignore: random
  # ----------
  test: select_into select_distinct select_distinct_on select_implicit select_having subselect union case join aggregates transactions random portals arrays btree_index hash_index update namespace prepared_xacts delete
  
! test: privileges
  test: misc
  # rules cannot run concurrently with any test that creates a view
  test: rules
--- 76,82 ----
  # ----------
  test: select_into select_distinct select_distinct_on select_implicit select_having subselect union case join aggregates transactions random portals arrays btree_index hash_index update namespace prepared_xacts delete
  
! test: privileges security_label
  test: misc
  # rules cannot run concurrently with any test that creates a view
  test: rules
*** a/src/test/regress/serial_schedule
--- b/src/test/regress/serial_schedule
***************
*** 88,93 **** test: delete
--- 88,94 ----
  test: namespace
  test: prepared_xacts
  test: privileges
+ test: security_label
  test: misc
  test: rules
  test: select_views