Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hqKrD-0001bc-FL for pgsql-admin@arkaria.postgresql.org; Wed, 24 Jul 2019 17:15:15 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hqKrC-0008N0-6A for pgsql-admin@arkaria.postgresql.org; Wed, 24 Jul 2019 17:15:14 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hqKrB-0008Mt-Pr for pgsql-admin@lists.postgresql.org; Wed, 24 Jul 2019 17:15:13 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1hqKr8-0001ZV-VP for pgsql-admin@lists.postgresql.org; Wed, 24 Jul 2019 17:15:12 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id C868F5F79F; Wed, 24 Jul 2019 13:15:10 -0400 (EDT) Date: Wed, 24 Jul 2019 13:15:10 -0400 From: Stephen Frost To: "David G. Johnston" Cc: Swanand Kshirsagar , "pgsql-admin@lists.postgresql.org" Subject: Re: Restrict permissions on schema to hide pl/pgsql code Message-ID: <20190724171510.GD29202@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="eIsIQJ2EnL/lgYAD" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --eIsIQJ2EnL/lgYAD Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * David G. Johnston (david.g.johnston@gmail.com) wrote: > You can consider this email to have accomplished both. Lacking someone > saying they they are working on it and pointing you to a patch you can > safely operate under the assumption that this behavior isn=E2=80=99t goin= g to > change. I suppose its possible with the recent row-level security feature > that a fresh look leveraging that facility could be considered but AFAIK > that hasn=E2=80=99t and isn=E2=80=99t being done. Actually, there was work specifically around that which it'd be nice if someone had time to pick up and work on. https://www.postgresql.org/message-id/CAJrrPGdCZEVxQTs49CqxjjyffHKPFtff+sa6= c6f5Z5grXztodw@mail.gmail.com One of the big questions around that is how much good is it to limit access when the catalog tables are queried directly when you can gather information about what's in them in other ways that we wouldn't want to be running through RLS (such as when we do direct catalog accesses as part of some DDL or such). That's a similar trade-off that application designers have to deal with when using RLS (eg: primary key violations could 'leak' the knowledge that a particular value exists even if you can't see it) and in many cases it's acceptable. Thanks, Stephen --eIsIQJ2EnL/lgYAD Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJdOJIeAAoJEO1sijiDR2RVfdEP/jhcsEw/2flHzoDW0bUDQdQx uVMZDv1h4470yfRmX3DWJlCUpa2XeshHsBZ3T7iHN1MoCLk2H1sMjxGrkHWbxYKe gfvm16zpJk1ZL9XI2Cu3TDaolqq6ILFg+Jn8GObrhn5fM5oWC0CjggezLLqZ2S99 cgYIjf4sloEav6m5dtzL5zhjv0AQ49Y4McSj5GLtg8ItiSeFkOTUaYfbPq4bxNXN uQA4JsZ4lOPecOIVcH/NXYPRLlhvMGbX1ZqbawwtvAYk1EvtTiXDMRVDHMrXKfdN CwoA4Qrpp++kSEQDwvcdUf/u8uuTPgPBOLM8ixoJO/fjyVI/dj6HJ68AmNrPr6N4 1oaXXFhETUb73odkm8rbi/RQoiFbMW1QYnwQQk2e+AwTV2tNtY/lPMYL6g4F3ywm DG3fQsSeVCGSeoRLge1/etcqeFWqbdkNJliyBYJ26QFgWaVtD8Rd0OS7uOL3OI7s xhifjhFJ7MN5VtXk9/3aEMD6WVhtNgauy/cnOsKaBZH/Y6RXcLW/FYYcvmqeVKQe 531nzT6S0TiL3zvDofDJVs9BwSGVXv0SWNG3SX7QXU+gbFfTlAZUKCxr0ZLxzRmi s/+sdPfcSCuvYLRie+AyXuPhXDUmXB55kwyTxEXFiFEXTOUkPN75/0SHSAdIpRRb 1gx4k/zpPwfNMqe3i+2q =fXra -----END PGP SIGNATURE----- --eIsIQJ2EnL/lgYAD--