From: Stephen Frost <sfrost@snowman.net>
To: Gilberto Castillo <gilberto.castillo@etecsa.cu>
Cc: jesse.waters@gmail.com
Cc: pgsql-admin@postgresql.org
Subject: Re: Permission select pg_stat_replication
Date: Tue, 31 Mar 2015 09:44:40 -0400
Message-ID: <20150331134440.GL3663@tamriel.snowman.net> (raw)
In-Reply-To: <46009.192.168.207.54.1427812926.squirrel@webmail.etecsa.cu>
References: <CAL0F7ned0Lbcu_FnzcoLTRS8zpQsmkA0fyw7jXOz9X=WHyJTYw@mail.gmail.com>
<20150331131252.GI3663@tamriel.snowman.net>
<45998.192.168.207.54.1427812184.squirrel@webmail.etecsa.cu>
<20150331133130.GK3663@tamriel.snowman.net>
<46009.192.168.207.54.1427812926.squirrel@webmail.etecsa.cu>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Gilberto,
* Gilberto Castillo (gilberto.castillo@etecsa.cu) wrote:
> > * Gilberto Castillo (gilberto.castillo@etecsa.cu) wrote:
> >> > * jesse.waters@gmail.com (jesse.waters@gmail.com) wrote:
> >> >> Could someone tell me what permission is required to
> >> >> select * from pg_stat_replication; ?
> >> >
> >> > Currently, you're required to have superuser rights.
> >> >
> >> >> I like to setup a monitor to query database with minimal privileges
> >> >> necessary.
> >> >
> >> > I agree 110% and am actively working to fix exactly this issue. I
> >> hope
> >> > to have a patch in the next day or so which will allow you to GRANT
> >> > rights to such a monitor user which will allow that user to see all
> >> the
> >> > contents of pg_stat_replication.
> >> >
> >> > One thing which would be really great is if you have time to test with
> >> > the patch I'm working up (it's against 9.5, but this is strictly
> >> > functionality testing and should be just in in a dev/test environment,
> >> > I wouldn't suggest running 9.5 in production, of course!).
> > [...]
> >> SET SESSION AUTHORIZATION postgres;
> >>
> >> GRANT SELECT ON pg_stat_replication TO usuario1;
> >
> > This is (essentially) what I'm hoping to enable. Note that this won't
> > do anything for you today as the view is already available to all users
> > on the system and it's actually the function underneath which is
> > filtering the result set.
>
> ALTER DEFAULT PRIVILEGES FOR ROLE postgres GRANT SELECT ON VIEWS TO
> usuario1;
>
> Nor does it work?
No. Feel free to try, but there's an explicit check in the C code which
is what the SQL-level function that's under the view is calling. In
current 9.5/master, at least, it's at:
src/backend/replication/walsender.c:2797
if (!superuser())
{
/*
* Only superusers can see details. Other users only get the pid
* value to know it's a walsender, but no details.
*/
MemSet(&nulls[1], true, PG_STAT_GET_WAL_SENDERS_COLS - 1);
}
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, gilberto.castillo@etecsa.cu, jesse.waters@gmail.com
Subject: Re: Permission select pg_stat_replication
In-Reply-To: <20150331134440.GL3663@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox