From: Stephen Frost <sfrost@snowman.net>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Henry Francisco Garcia Cortez <garcortez@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: schema postgresql
Date: Mon, 14 Sep 2020 10:13:20 -0400
Message-ID: <20200914141319.GF3063@tamriel.snowman.net> (raw)
In-Reply-To: <20498602dbb12cb161e094a6c4dec3809267e47d.camel@cybertec.at>
References: <CAJP2v3EK6Rwk4GQid9E23QfGeQFvTp3eCk9NzZMf1Sw6-j-8cA@mail.gmail.com>
<20498602dbb12cb161e094a6c4dec3809267e47d.camel@cybertec.at>
Greetings,
* Laurenz Albe (laurenz.albe@cybertec.at) wrote:
> On Fri, 2020-09-11 at 15:13 -0600, Henry Francisco Garcia Cortez wrote:
> > how to restrict a user from seeing a schema in postgresql
>
> It is easy to restrict access, but not really possible to keep a user
> from seeing the metadata. We consider that a good thing.
I don't see why that is or should be the case. If there's no reason or
need for someone to have access to that metadata, then they shouldn't
have access to it. There was some work to implement RLS on the catalog
tables at one point but unfortunately that's not likely to actually be a
good solution since so much access to the catalog doesn't go through the
exectuor, but the general idea of limiting access to that information is
a good one.
If it was free to do so, or only impacted those who wanted that without
complicating the code a lot, it'd absolutely be a good improvement.
Unfortunately, there's no simple way to ensure that and I don't know of
anyone actively working to figure out a way, but I disagree with the
idea that the current state is 'a good thing'.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, laurenz.albe@cybertec.at, garcortez@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: schema postgresql
In-Reply-To: <20200914141319.GF3063@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox