From: Dinesh Bhandary <dbhandary@iii.com>
To: pgsql-admin@postgresql.org
Subject: Re: revoked permissions on table still allows users to see table's structure
Date: Fri, 22 Jul 2011 11:09:45 -0700
Message-ID: <4E29BCE9.2010301@iii.com> (raw)
In-Reply-To: <4E297457020000250003F708@gw.wicourts.gov>
References: <4E28BF6E.8090302@quality-telecom.net>
<CAOR=d=1Zoo6K55wfkBpb_rx2Jb2ox_Lp5WBN1dGmYMLD3x=ADg@mail.gmail.com>
<4E29B6B6.3020309@quality-telecom.net>
<4E297457020000250003F708@gw.wicourts.gov>
We had the same problem, and we still do not have an elegant solution,
we have a workaround which I really don't like.
I agree with Juan - it is a limitation. I understand that you can solve
this problem outside of a database, but it will be nice to have a
strictly read only user who can just see data of the assigned objects
and nothing else.
Dinesh
O-+n 7/22/2011 11:00 AM, Kevin Grittner wrote:
> "Juan Cuervo (Quality Telecom)"<juanrcuervo@quality-telecom.net>
> wrote:
>
>> Imagine you own a software development company,
>
> Not too hard for me. Been there, done that.
>
>> and decides to base the company's product on Postgresql databases.
>> Such a company surely dont want to expose his database design to
>> its customers, but in some time might want to provide 'select'
>> access to some users, so they can pull data to external datamining
>> or data analisys tools, for example. If this is not possible in
>> postgresql right now, then all users with connect privilege will
>> be able to see not only the table's structure, but also the stored
>> procedures code, wich in many cases, stores a business logic or
>> know-how.
>
> Imagine that the software is running on a machine under the client's
> control, where they have root access to the OS. They can then
> disassemble or debug through code to see how the encrypted procedure
> code is turned into something the database can compile, they can
> connect to the database as the superuser to view all details. The
> only protection provided by what you suggest is from those too inept
> to really pose a competitive threat. If you think some other
> product gives you protection beyond this, it is an illusion.
>
> The only way to protect your schema and logic from view is to offer
> "software as a service". While someone might still infer a lot
> about the structure of the data and the logic of the code from
> observing its displays and the procedures available to the user, you
> would have some insulation.
>
> -Kevin
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: dbhandary@iii.com
Subject: Re: revoked permissions on table still allows users to see table's structure
In-Reply-To: <4E29BCE9.2010301@iii.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox