Re: Recognizing superuser in pg_hba.conf

Andrew Gierth <andrew(at)tao11(dot)riddles(dot)org(dot)uk> writes:
> "Tom" == Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> writes:
> Tom> Meh. If the things aren't actually roles, I think this'd just add
> Tom> confusion. Or were you proposing to implement them as roles? I'm
> Tom> not sure if that would be practical in every case.

> In fact my original suggestion when this idea was discussed on IRC was
> to remove the current superuser flag and turn it into a role; but the
> issue then is that role membership is inherited and superuserness
> currently isn't, so that's a more intrusive change.

To cover the proposed functionality, you'd still need some way to
select not-superuser. So I don't think this fully answers the need
even if we wanted to do it.

It's possible that role-ifying everything and then allowing "!role"
in the pg_hba.conf syntax would be enough. Not sure though.

More generally, allowing inheritance of superuser scares me a bit
from a security standpoint. I wouldn't mind turning all the other
legacy role properties into grantable roles, but I *like* the fact
that that one is special.

regards, tom lane