| From: | Andrew Dunstan <andrew(at)dunslane(dot)net> |
|---|---|
| To: | Andrew Chernow <ac(at)esilo(dot)com> |
| Cc: | Grzegorz Jaskiewicz <gj(at)pointblue(dot)com(dot)pl>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: user-based query white list |
| Date: | 2008-12-06 21:13:41 |
| Message-ID: | 493AEB05.2000208@dunslane.net |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Andrew Chernow wrote:
>
> I don't think view-based security solves my problem. I need to limit
> a user to 20 fixed queries, for example. That means the user cannot
> execute "SELECT NOW()" or "SELECT 'hello world'". The user can only
> execute a pre-defined list of queries.
>
Put your queries in security definer functions and put those in a schema
that is the only one your user has access to. That should just about do
the trick, although s/he might still be able to do "select 'foo';"
cheers
andrew
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Bruce Momjian | 2008-12-06 23:21:13 | Re: Updates of SE-PostgreSQL 8.4devel patches (r1268) |
| Previous Message | James Mansion | 2008-12-06 20:38:29 | Re: Mostly Harmless: Welcoming our C++ friends |