insufficient privilege with pg_read_all_stats granted

From: Costa Alexoglou <costa(at)dbtune(dot)com>
To: pgsql-general(at)lists(dot)postgresql(dot)org
Subject: insufficient privilege with pg_read_all_stats granted
Date: 2024-08-20 20:50:09
Message-ID: CAJ+5Ff4rRJabEP5Qz=XkRrq+4zc7b9Ai3+zqCA+GYSurFsgvjg@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Hey folks,

I run PostgreSQL v15.8 (docker official image), and there is an issue when
reading pg_stat_staments table with a result of query most of the times
having `<insufficient privilege>` value.

I have created the user that I use to fetch the data with the following way:
```
CREATE USER abcd WITH NOSUPERUSER NOCREATEROLE NOINHERIT LOGIN;

GRANT pg_read_all_stats, pg_stat_scan_tables, pg_read_all_settings to abcd;

GRANT pg_monitor to abcd;
```

I explicitly gave `pg_read_all_stats` and also called `pg_monitor` just to
be on the safe side, but stil I get the insufficient privilege error.

```
SELECT
r.rolname AS member,
m.rolname AS role
FROM
pg_auth_members am
JOIN
pg_roles r ON r.oid = am.member
JOIN
pg_roles m ON m.oid = am.roleid
WHERE
m.rolname = 'pg_read_all_stats'
AND r.rolname = 'abcd';

member | role
--------+-------------------
abcd | pg_read_all_stats
(1 row)
```

I also tried with PostgreSQL v14.13, and this was not the case, it was
working fine as expected.
Then I tried v16.4 and v17beta3, and I faced the <insufficient privilege>
issue, so I guess something changed v15 onwards?

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Pavel Luzanov 2024-08-21 07:50:02 Re: insufficient privilege with pg_read_all_stats granted
Previous Message H 2024-08-20 18:17:49 Re: Looking for pg_config for postgresql 13.16