Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YdKx4-0000uX-6Q for pgsql-admin@arkaria.postgresql.org; Wed, 01 Apr 2015 15:53:10 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YdKx3-00088m-La for pgsql-admin@arkaria.postgresql.org; Wed, 01 Apr 2015 15:53:09 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YdKx2-00086S-Bj for pgsql-admin@postgresql.org; Wed, 01 Apr 2015 15:53:08 +0000 Received: from tamriel.snowman.net ([2001:4830:167b::11]) by magus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YdKwy-00029a-Ce for pgsql-admin@postgresql.org; Wed, 01 Apr 2015 15:53:06 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 7896B5F7AD; Wed, 1 Apr 2015 11:53:02 -0400 (EDT) Date: Wed, 1 Apr 2015 11:53:02 -0400 From: Stephen Frost To: Denish Patel Cc: jesse.waters@gmail.com, "pgsql-admin@postgresql.org" Subject: Re: Permission select pg_stat_replication Message-ID: <20150401155302.GP3663@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="yV94raM4eJLN8srE" Content-Disposition: inline In-Reply-To: X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-46-generic (x86_64) X-Uptime: 11:51:21 up 12 days, 21:40, 4 users, load average: 0.09, 0.11, 0.09 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --yV94raM4eJLN8srE Content-Type: text/plain; charset=us-ascii Content-Disposition: inline * Denish Patel (denish@omniti.com) wrote: > you should be able to use secure_check_postgres method to avoid granting > SUPER permission on monitoring user. [...] Denish, Please see my reply to Payal. This doesn't work. At the very least, the permissions on the pg_stat_repl() function need to be adjusted to be only GRANT'd to the monitoring user, otherwise the information is available to everyone. If that's the intent, then the view might as well be granted to PUBLIC. Recall that, by defualt, EXECUTE on a function is granted to PUBLIC. Thanks, Stephen --yV94raM4eJLN8srE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVHBReAAoJEO1sijiDR2RVRT0P/035Lcb26bnMlVBFaMEl5ew0 iic/RGGcLb5gSA0FpYWuTG0cYxjwbC9TpYgEwJddpYZMaoAb9ITyyCLgytEs+feu 3iUxXS7CByhiWCweUATn4wgJWM0XoNbMOlqWdnV3CRXylQjq/UByXcxK0qs9SCDa /aCJFVHzg/ZAk5w0i7s3WH+DTb8oHfj5ax+46Ft/wJvaGB8oTR/clqrTYW72jUbk +IREAGy8/4zMQjcxzy3e+jBxUuwT2z1maZVzMwYb46ZWgj3zOek2KQ1pJu6GJhg1 1HYmaj/GV+zWBgbThQ7+Yf3WInq08W8P0MR6H5OePkP+7Z+tx2au4k4HFjFWxDYa cZi6dCK5ogAtlGci0xD3MElx8drCdn4DAAhvdtAYX/6e6d5NmVA87GhjfGvC3H4u 3KtXJ41pvWl9oukvfLa5YvSkkxijnMNnJzGSqWLhx5A0xImk8a+dMBhnlH3vQPVL UsuJII6sQPB4/Dtuetg+LNsG1pE3hkquJ9JBYPRZ/kDXjYsw61MI06IoRCwpSKJV 7qAkBiuD1QgpW0ttk9ydTsZwKvLCA7b0V5QIgMhC9IE35p3o4S5uu3Hjjw5xl/wt IE+qWtCgs3R8hSsLqzPknhxCqdy6T9aW154h4ZE/YhgIbLfWs5JBVOn4Xt6qp/yP 6aXUAjzJpXrm/kU6cXiV =ajHj -----END PGP SIGNATURE----- --yV94raM4eJLN8srE--