pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Scott Ribe <scott_ribe@elevated-dev.com>
To: Bruce Momjian <bruce@momjian.us>
Cc: Evan Rempel <erempel@uvic.ca>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Date: Wed, 15 Aug 2018 15:03:41 -0600
Message-ID: <25586049-C24B-4231-8179-714683AA4536@elevated-dev.com> (raw)
In-Reply-To: <20180815205758.GC5005@momjian.us>
References: <CAKFQuwa0SyyzaKEtQzBc008HvtR7GVzv4Nd75Qe_OXtAqzgGGA@mail.gmail.com>
	<20180810194105.GD7840@momjian.us>
	<CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
	<20180814195919.GA29140@momjian.us>
	<20180815145912.GA11573@momjian.us>
	<10cde505-db4b-bbeb-7d8a-7c4e145c6042@uvic.ca>
	<20180815192838.GA5005@momjian.us>
	<c6ef7b1d-2ed1-623a-ea9e-e6470aca1da7@uvic.ca>
	<20180815202646.GB5005@momjian.us>
	<d02f124e-ae91-c085-217d-ddb4a98a9349@uvic.ca>
	<20180815205758.GC5005@momjian.us>

> On Aug 15, 2018, at 2:57 PM, Bruce Momjian <bruce@momjian.us> wrote:
> 
> On Wed, Aug 15, 2018 at 01:52:43PM -0700, Evan Rempel wrote:
>> There are just a ton of configuration elements that the DBAs need to decide on and implement that require
>> configuration of components that are outside of the database proper.
>> 
>> It was a worthwhile discussion. One needs to trust the data stewards.
> 
> Agreed.  I just wish it had a more positive outcome.  ;-)

Well, it probably elucidated the issues enough that an expert in SELinux could configure a server such that DBAs could not disable logging. Of course, you still have to trust somebody with that configuration, but it is possible to separate responsibilities if you work hard enough at it.



view thread (40+ messages)  latest in thread

Message-ID: <25586049-C24B-4231-8179-714683AA4536@elevated-dev.com>
Permalink:  ../25586049-C24B-4231-8179-714683AA4536@elevated-dev.com/
Also on:    postgresql.org/message-id/25586049-C24B-4231-8179-714683AA4536@elevated-dev.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: scott_ribe@elevated-dev.com, bruce@momjian.us, erempel@uvic.ca, pgsql-admin@lists.postgresql.org
  Subject: Re: How to revoke privileged from PostgreSQL's superuser
  In-Reply-To: <25586049-C24B-4231-8179-714683AA4536@elevated-dev.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox