From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
---|---|
To: | Magnus Hagander <magnus(at)hagander(dot)net> |
Cc: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Peter Eisentraut <peter_e(at)gmx(dot)net>, Stephen Frost <sfrost(at)snowman(dot)net>, Florian Pflug <fgp(at)phlo(dot)org>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Streaming replication as a separate permissions |
Date: | 2011-01-05 03:24:20 |
Message-ID: | AANLkTi=hWTN-YfH+F7WrXsp4AjddvmDP_SYH5BS=2vmD@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Mon, Jan 3, 2011 at 5:50 PM, Magnus Hagander <magnus(at)hagander(dot)net> wrote:
> On Mon, Jan 3, 2011 at 17:23, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
>> On Mon, Jan 3, 2011 at 11:20 AM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>>> Robert Haas <robertmhaas(at)gmail(dot)com> writes:
>>>> On the other hand, the REPLICATION privilege is denying you the right to
>>>> perform an operation *even though you already are authenticated as a
>>>> superuser*. I don't think there's anywhere else in the system where
>>>> we allow a privilege to non-super-users but deny that same privilege
>>>> to super-users, and I don't think we should be starting now.
>>>
>>> You might want to reflect on rolcatupdate a bit before asserting that
>>> there are no cases where privileges are ever denied to superusers.
>>
>> Oh, huh. I wasn't aware of that.
>>
>>> However, that precedent would suggest that the default should be to
>>> grant the replication bit to superusers.
>>
>> Yes it would.
>
> Just to be clear: are we saying that "CREATE ROLE foo SUPERUSER"
> should grant both superuser and replication, as well as the default
> "postgres" user also having replication as well?
I think that's what we're saying.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
From | Date | Subject | |
---|---|---|---|
Next Message | Rob Wultsch | 2011-01-05 03:56:52 | Re: making an unlogged table logged |
Previous Message | Robert Haas | 2011-01-05 03:16:26 | Re: SQL/MED - core functionality |