Date: Tue, 31 Mar 2015 09:31:30 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Gilberto Castillo <gilberto.castillo@etecsa.cu>
Cc: jesse.waters@gmail.com, pgsql-admin@postgresql.org
Subject: Re: Permission select pg_stat_replication
Message-ID: <20150331133130.GK3663@tamriel.snowman.net>
References: 
 <CAL0F7ned0Lbcu_FnzcoLTRS8zpQsmkA0fyw7jXOz9X=WHyJTYw@mail.gmail.com>
 <20150331131252.GI3663@tamriel.snowman.net>
 <45998.192.168.207.54.1427812184.squirrel@webmail.etecsa.cu>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="CxSUI8jTRJ26tNoZ"
Content-Disposition: inline
In-Reply-To: <45998.192.168.207.54.1427812184.squirrel@webmail.etecsa.cu>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


--CxSUI8jTRJ26tNoZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Gilberto,

* Gilberto Castillo (gilberto.castillo@etecsa.cu) wrote:
> > * jesse.waters@gmail.com (jesse.waters@gmail.com) wrote:
> >>  Could someone tell me what permission is required to
> >> select * from pg_stat_replication; ?
> >
> > Currently, you're required to have superuser rights.
> >
> >> I like to setup a monitor to query database with minimal privileges
> >> necessary.
> >
> > I agree 110% and am actively working to fix exactly this issue.  I hope
> > to have a patch in the next day or so which will allow you to GRANT
> > rights to such a monitor user which will allow that user to see all the
> > contents of pg_stat_replication.
> >
> > One thing which would be really great is if you have time to test with
> > the patch I'm working up (it's against 9.5, but this is strictly
> > functionality testing and should be just in in a dev/test environment,
> > I wouldn't suggest running 9.5 in production, of course!).
[...]
> SET SESSION AUTHORIZATION postgres;
>=20
> GRANT SELECT ON pg_stat_replication TO usuario1;

This is (essentially) what I'm hoping to enable.  Note that this won't
do anything for you today as the view is already available to all users
on the system and it's actually the function underneath which is
filtering the result set.

	Thanks!

		Stephen

--CxSUI8jTRJ26tNoZ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVGqGyAAoJEO1sijiDR2RVeewQAJOJko8r0iFBqWODwxARiw9i
iri3AujqUWBlW8rN0UVmVC/9k3nLDPRlvRyymmPnqaFL971QeGM7dGuxU21wzMQo
t3Y55smwF3jffrUjxFmOo851VNru4uHhWp/g8pkCukqs9bq2x6WpBcnZDgOaZbvu
1Qao//R2eO1mXeahtSc1bWCffJBhkaNBkguK01qwdxfqIpmO/9yuh5szxqORQYNZ
Xk/9LHJvUk++pvUoW4C1gNnMzBVdTR8MFSmUSeRBA2ApDMMWBnG291xfhUPKwKwO
MORxNaBxCf2TRMWnx0BRpulZCJbW4XhXEclA9+LtifmrSf27bb0m+qaVfBj+VYCl
5I6VmtLFk28QwMSx8REmR7R+qYusqmyUtiHcsUeXiV7D1Jm/JTSAC1HJbdKc5jim
Scsha4RLR2kOxcrl6G4uSUmSfr1qYZMAt1jJqa7Rp7D3n0ZyKeCsihi/i6il7JvA
142eTBgnrdvy5Qd53CV1hZLuVaxWHpRq+BUrmac5rDOTrtfdXKhOqKWajMj8shxI
YI8+541BkDTP9gAiNj7Q2U6N9ibOOHVMGZo4m2GvSy2yEsmqVRcW1uZ7tT0vIF9m
M7ra6m9Qr2mSgm6e1TA6zc6z5TASyPFVaIVTE/qTMfpbLCSC2wgte5ANFt7BwwBu
jQYpCJgDnOAZzfABOcf2
=AhnI
-----END PGP SIGNATURE-----

--CxSUI8jTRJ26tNoZ--