From: Stephen Frost <sfrost@snowman.net>
To: Denish Patel <denish@omniti.com>
Cc: jesse.waters@gmail.com, "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: Permission select pg_stat_replication
Date: Wed, 1 Apr 2015 11:53:02 -0400
Message-ID: <20150401155302.GP3663@tamriel.snowman.net> (raw)
In-Reply-To: <CAFddxvOFPANK222gvLhnu-0GyAmd9DCBag_GMC26tfZ4rH-n1Q@mail.gmail.com>
References: <CAL0F7ned0Lbcu_FnzcoLTRS8zpQsmkA0fyw7jXOz9X=WHyJTYw@mail.gmail.com>
<CAFddxvOFPANK222gvLhnu-0GyAmd9DCBag_GMC26tfZ4rH-n1Q@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
* Denish Patel (denish@omniti.com) wrote:
> you should be able to use secure_check_postgres method to avoid granting
> SUPER permission on monitoring user.
[...]
Denish,
Please see my reply to Payal. This doesn't work. At the very least,
the permissions on the pg_stat_repl() function need to be adjusted to be
only GRANT'd to the monitoring user, otherwise the information is
available to everyone. If that's the intent, then the view might as
well be granted to PUBLIC.
Recall that, by defualt, EXECUTE on a function is granted to PUBLIC.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, denish@omniti.com
Subject: Re: Permission select pg_stat_replication
In-Reply-To: <20150401155302.GP3663@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox