| From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
|---|---|
| To: | Michael Paquier <michael(dot)paquier(at)gmail(dot)com> |
| Cc: | Andres Freund <andres(at)anarazel(dot)de>, Joe Conway <mail(at)joeconway(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: exposing pg_controldata and pg_config as functions |
| Date: | 2016-01-19 17:24:05 |
| Message-ID: | CA+TgmoZ7sLfij2z+66wDKWNcMt41P0NWz0WtaYqkMD5ON7E8Tw@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Mon, Jan 18, 2016 at 7:42 PM, Michael Paquier
<michael(dot)paquier(at)gmail(dot)com> wrote:
>> Yeah, I really don't see anything in the pg_controldata output that
>> looks sensitive. The WAL locations are the closest of anything,
>> AFAICS.
>
> The system identifier perhaps? I honestly don't have on top of my head
> a way to exploit this information but leaking that at SQL level seems
> sensible: that's a unique identifier of a Postgres instance used when
> setting up a cluster after all.
I think you are confusing useful information with security-sensitive
information. The system identifier may be useful, but if you can't
use it to compromise something, it's not security-sensitive.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Joe Conway | 2016-01-19 17:32:35 | Re: exposing pg_controldata and pg_config as functions |
| Previous Message | Robert Haas | 2016-01-19 17:18:52 | Re: [Proposal] Table partition + join pushdown |