pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Scott Ribe <scott_ribe@elevated-dev.com>
To: Bruce Momjian <bruce@momjian.us>
Cc: Evan Rempel <erempel@uvic.ca>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: How to revoke privileged from PostgreSQL's superuser
Date: Wed, 15 Aug 2018 15:16:28 -0600
Message-ID: <FC9458E4-122A-4729-84D2-5EA6DDFBE664@elevated-dev.com> (raw)
In-Reply-To: <20180815210926.GD5005@momjian.us>
References: <CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
	<20180814195919.GA29140@momjian.us>
	<20180815145912.GA11573@momjian.us>
	<10cde505-db4b-bbeb-7d8a-7c4e145c6042@uvic.ca>
	<20180815192838.GA5005@momjian.us>
	<c6ef7b1d-2ed1-623a-ea9e-e6470aca1da7@uvic.ca>
	<20180815202646.GB5005@momjian.us>
	<d02f124e-ae91-c085-217d-ddb4a98a9349@uvic.ca>
	<20180815205758.GC5005@momjian.us>
	<25586049-C24B-4231-8179-714683AA4536@elevated-dev.com>
	<20180815210926.GD5005@momjian.us>

> On Aug 15, 2018, at 3:09 PM, Bruce Momjian <bruce@momjian.us> wrote:
> 
> Well, since the superuser can start the server with whatever arguments
> they want, I am not sure how SELinux would help here.

root, yes, postgres "superuser", no--assuming things being locked down enough




view thread (40+ messages)  latest in thread

Message-ID: <FC9458E4-122A-4729-84D2-5EA6DDFBE664@elevated-dev.com>
Permalink:  ../FC9458E4-122A-4729-84D2-5EA6DDFBE664@elevated-dev.com/
Also on:    postgresql.org/message-id/FC9458E4-122A-4729-84D2-5EA6DDFBE664@elevated-dev.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: scott_ribe@elevated-dev.com, bruce@momjian.us, erempel@uvic.ca, pgsql-admin@lists.postgresql.org
  Subject: Re: How to revoke privileged from PostgreSQL's superuser
  In-Reply-To: <FC9458E4-122A-4729-84D2-5EA6DDFBE664@elevated-dev.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox