pg.ddx.io pgsql-admin@postgresql.org mailing list archivehelp / color / mirror / Atom feed
privilege shedding 2+ messages / 2 participants [nested] [flat]
* privilege shedding @ 2008-08-21 12:35 dkeeney <dvkeeney@gmail.com> 2008-08-21 14:10 ` Re: privilege shedding Kevin Grittner <Kevin.Grittner@wicourts.gov> 0 siblings, 1 reply; 2+ messages in thread From: dkeeney @ 2008-08-21 12:35 UTC (permalink / raw) To: pgsql-admin Is there a way to non-reversibly shed privilige within a PostgreSQL session? I would like to start a session as a superuser role, set up some views and triggers as superuser, and then change role to a lesser role for the remainder of the session. It seems that if you use 'set role' for this, you get the lesser role, but the original (superuser) role can be restored by another 'set role' statement, without any re-authentication. I would like the role change to persist through the life of the session, without the option of restoring the superuser role. Thank you, David ^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: privilege shedding 2008-08-21 12:35 privilege shedding dkeeney <dvkeeney@gmail.com> @ 2008-08-21 14:10 ` Kevin Grittner <Kevin.Grittner@wicourts.gov> 0 siblings, 0 replies; 2+ messages in thread From: Kevin Grittner @ 2008-08-21 14:10 UTC (permalink / raw) To: dkeeney <dvkeeney@gmail.com>; pgsql-admin >>> dkeeney <dvkeeney@gmail.com> wrote: > Is there a way to non-reversibly shed privilige within a PostgreSQL > session? > I would like the role > change to persist through the life of the session, without the option > of restoring the superuser role. We could use this in certain circumstances. How about SET AUTHORIZATION ROLE as syntax? (I was trying to find a reserved word to use where LOCAL and SESSION are now allowed which would have the right connotations. I'm entirely happy with this, but it doesn't seem too bad....) -Kevin ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2008-08-21 14:10 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2008-08-21 12:35 privilege shedding dkeeney <dvkeeney@gmail.com> 2008-08-21 14:10 ` Kevin Grittner <Kevin.Grittner@wicourts.gov>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox