| From: | Mark Dilger <mark(dot)dilger(at)enterprisedb(dot)com> |
|---|---|
| To: | Amit Kapila <amit(dot)kapila16(at)gmail(dot)com> |
| Cc: | Jeff Davis <pgsql(at)j-davis(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>, Robert Haas <robertmhaas(at)gmail(dot)com> |
| Subject: | Re: Non-superuser subscription owners |
| Date: | 2021-12-03 13:31:46 |
| Message-ID: | 7A34E620-0D86-4720-91A3-624C0B8C1A6C@enterprisedb.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
> On Dec 2, 2021, at 1:29 AM, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com> wrote:
>
> If we want to maintain the property that subscriptions can only be
> owned by superuser for your first version then isn't a simple check
> like ((!superuser()) for each of the operations is sufficient?
As things stand today, nothing prevents a superuser subscription owner from having superuser revoked. The patch does nothing to change this.
> In (2), I am not clear what do you mean by "the old owner has
> privileges increased"? If the owners can only be superusers then what
> does it mean to increase the privileges.
The old owner may have had privileges reduced (no superuser, only permission to write into a specific schema, etc.) and the subscription enabled only after those privilege reductions were put in place. This is a usage pattern this patch is intended to support, by honoring those privilege restrictions.
—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Daniel Gustafsson | 2021-12-03 13:32:54 | Re: Is ssl_crl_file "SSL server cert revocation list"? |
| Previous Message | Amit Langote | 2021-12-03 13:27:43 | Re: pg_get_publication_tables() output duplicate relid |