Date: Mon, 14 Sep 2020 10:13:20 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Henry Francisco Garcia Cortez <garcortez@gmail.com>,
	pgsql-admin@lists.postgresql.org
Subject: Re: schema postgresql
Message-ID: <20200914141319.GF3063@tamriel.snowman.net>
References: 
 <CAJP2v3EK6Rwk4GQid9E23QfGeQFvTp3eCk9NzZMf1Sw6-j-8cA@mail.gmail.com>
 <20498602dbb12cb161e094a6c4dec3809267e47d.camel@cybertec.at>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="/QKKmeG/X/bPShih"
Content-Disposition: inline
In-Reply-To: <20498602dbb12cb161e094a6c4dec3809267e47d.camel@cybertec.at>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--/QKKmeG/X/bPShih
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Laurenz Albe (laurenz.albe@cybertec.at) wrote:
> On Fri, 2020-09-11 at 15:13 -0600, Henry Francisco Garcia Cortez wrote:
> > how to restrict a user from seeing a schema in postgresql
>=20
> It is easy to restrict access, but not really possible to keep a user
> from seeing the metadata.  We consider that a good thing.

I don't see why that is or should be the case.  If there's no reason or
need for someone to have access to that metadata, then they shouldn't
have access to it.  There was some work to implement RLS on the catalog
tables at one point but unfortunately that's not likely to actually be a
good solution since so much access to the catalog doesn't go through the
exectuor, but the general idea of limiting access to that information is
a good one.

If it was free to do so, or only impacted those who wanted that without
complicating the code a lot, it'd absolutely be a good improvement.
Unfortunately, there's no simple way to ensure that and I don't know of
anyone actively working to figure out a way, but I disagree with the
idea that the current state is 'a good thing'.

Thanks,

Stephen

--/QKKmeG/X/bPShih
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJfX3p/AAoJEO1sijiDR2RVX7sQAJAXDTJCULI9EcPxUH7oQ6Ru
kzRr41ZSKuGc0slehsFOREACYWHqssws5d0o80xi88kM+ohSeN3uIymvnnOKaCgh
+vZ8+Cy3S7UrM0QDKAi10nRNqw1HTci8SGtt+JRWrmJKtOrPoaErxuFpvJadw0sq
ZXzyFqaPq3aaO88ScULXCF5Kac4/9LcKlyupYplS+wEaSRhqmXnTN4gLjrezrUTL
90M3dsl0zXL1kmRpKlqf2FqZCUuL0Vqfm+rFaYetu1qIvEr0AduYhoFFEOadTdpw
2msjfYHhR8JmoyLkdwsYa1+f1GH05H8igXmxC5qrU/fBi0j9i6zyBpnl0Sy7KKD5
cFibj3LWwrsApbyWZYKtSngxn4K8pKcpi0bHwNLBznOfLddJAy6J5Ud0L0adDT4S
BbJTtOxJtgNtM/DvF4Z/bYb7b2D7hmnlPX+onLhpWtT/vZ4I5crAfS/suShUBCKL
PAz8E1QhMamTcgKseqLQIFAHIFr9/L7BS1J4Uhlt+kxz4gdCtnyRaggd1zHbZt3W
cUFotPRkBGgyDPzXg05kQQ81uMiJu4hiLqb8VWBvr6fLr5q5B576USCtNg9tm4py
iVu/KOFmYnWIMRVkBQpFQCDTFrLgvZLAMQmPQvj/3+Be0e8U5wyEXvJXRKUOC7F7
jM8strrE4sh2CsJFmLhZ
=j6Qp
-----END PGP SIGNATURE-----

--/QKKmeG/X/bPShih--