| From: | Jeff Davis <pgsql(at)j-davis(dot)com> |
|---|---|
| To: | Andres Freund <andres(at)anarazel(dot)de>, Robert Haas <robertmhaas(at)gmail(dot)com> |
| Cc: | Mark Dilger <mark(dot)dilger(at)enterprisedb(dot)com>, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Non-superuser subscription owners |
| Date: | 2023-01-22 17:05:27 |
| Message-ID: | 0adf992619e7bf138eb4119622d37e3efb6515d5.camel@j-davis.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Sat, 2023-01-21 at 14:01 -0800, Andres Freund wrote:
> There are good reasons to have 'peer' authentication set up for the
> user
> running postgres, so admin scripts can connect without issues. Which
> unfortunately then also means that postgres_fdw etc can connect to
> the current
> database as superuser, without that check. Which imo clearly is an
> issue.
Perhaps we should have a way to directly turn on/off authentication
methods in libpq through API functions and/or options?
This reminds me of the "channel_binding=required" option. We considered
some similar alternatives for that feature.
> Why is this only about local files, rather than e.g. also using the
> local
> user?
It's not, but we happen to already have pg_read_server_files, and it
makes sense to use that at least for files referenced directly in the
connection string. You're right that it's incomplete, and also that it
doesn't make a lot of sense for files accessed indirectly.
--
Jeff Davis
PostgreSQL Contributor Team - AWS
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Jelte Fennema | 2023-01-22 17:20:49 | Re: run pgindent on a regular basis / scripted manner |
| Previous Message | Tom Lane | 2023-01-22 16:35:17 | Re: run pgindent on a regular basis / scripted manner |