Re: Two-phase commit security restrictions

Heikki Linnakangas <hlinnaka(at)iki(dot)fi> writes:
> What kind of security restrictions do we want for prepared transactions?
> Who has the right to finish a transaction that was started by user A? At
> least the original user, I suppose, but who else?

I would say the original user, any superuser, and nobody else. This
conforms to Postgres' usual practices (compare to the right to DROP
an object).

> Do we need a "GRANT TRANSACTION" command to give permission to finish 2PC
> transcations?

Overkill.

> Another approach I've been thinking about is to allow anyone that knows
> the (user-supplied) global transaction identifier to finish the
> transaction, and hide the gids of running transactions from regular users.

Security-by-obscurity isn't really security, and I think that hiding the
GIDs is likely to make things noticeably more painful to manage.

regards, tom lane