Date: Wed, 15 Aug 2018 17:09:26 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Scott Ribe <scott_ribe@elevated-dev.com>
Cc: Evan Rempel <erempel@uvic.ca>, pgsql-admin@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Message-ID: <20180815210926.GD5005@momjian.us>
References: 
 <CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
 <20180814195919.GA29140@momjian.us>
 <20180815145912.GA11573@momjian.us>
 <10cde505-db4b-bbeb-7d8a-7c4e145c6042@uvic.ca>
 <20180815192838.GA5005@momjian.us>
 <c6ef7b1d-2ed1-623a-ea9e-e6470aca1da7@uvic.ca>
 <20180815202646.GB5005@momjian.us>
 <d02f124e-ae91-c085-217d-ddb4a98a9349@uvic.ca>
 <20180815205758.GC5005@momjian.us>
 <25586049-C24B-4231-8179-714683AA4536@elevated-dev.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <25586049-C24B-4231-8179-714683AA4536@elevated-dev.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Precedence: bulk

On Wed, Aug 15, 2018 at 03:03:41PM -0600, Scott Ribe wrote:
> > On Aug 15, 2018, at 2:57 PM, Bruce Momjian <bruce@momjian.us> wrote:
> >
> > On Wed, Aug 15, 2018 at 01:52:43PM -0700, Evan Rempel wrote:
> >> There are just a ton of configuration elements that the DBAs need
> >> to decide on and implement that require configuration of components
> >> that are outside of the database proper.
> >>
> >> It was a worthwhile discussion. One needs to trust the data
> >> stewards.
> >
> > Agreed.  I just wish it had a more positive outcome. ;-)
>
> Well, it probably elucidated the issues enough that an expert in
> SELinux could configure a server such that DBAs could not disable
> logging. Of course, you still have to trust somebody with that
> configuration, but it is possible to separate responsibilities if you
> work hard enough at it.

Well, since the superuser can start the server with whatever arguments
they want, I am not sure how SELinux would help here.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

+ As you are, so once was I.  As I am, so you will be. +
+                      Ancient Roman grave inscription +