Received: from malur.postgresql.org ([2a02:16a8:dc51::56])
	by arkaria.postgresql.org with esmtps
 (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1fq39s-0006Zy-Bi
	for pgsql-admin@arkaria.postgresql.org; Wed, 15 Aug 2018 21:16:48 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.89)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1fq39q-0000S0-Fk
	for pgsql-admin@arkaria.postgresql.org; Wed, 15 Aug 2018 21:16:46 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <scott_ribe@elevated-dev.com>)
	id 1fq39q-0000Rt-6P
	for pgsql-admin@lists.postgresql.org; Wed, 15 Aug 2018 21:16:46 +0000
Received: from mailout.easymail.ca ([64.68.200.34])
	by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <scott_ribe@elevated-dev.com>)
	id 1fq39g-00045j-7m
	for pgsql-admin@lists.postgresql.org; Wed, 15 Aug 2018 21:16:43 +0000
Received: from localhost (localhost [127.0.0.1])
	by mailout.easymail.ca (Postfix) with ESMTP id F30A7C0FA5;
	Wed, 15 Aug 2018 21:16:33 +0000 (UTC)
Received: from mailout.easymail.ca ([127.0.0.1])
	by localhost (emo01-pco.easydns.vpn [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id tCp3s0lF6LfF; Wed, 15 Aug 2018 21:16:33 +0000 (UTC)
Received: from [192.168.2.16] (unknown [8.39.228.117])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mailout.easymail.ca (Postfix) with ESMTPSA id CF15CC0F8F;
	Wed, 15 Aug 2018 21:16:30 +0000 (UTC)
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Subject: Re: How to revoke privileged from PostgreSQL's superuser
From: Scott Ribe <scott_ribe@elevated-dev.com>
In-Reply-To: <20180815210926.GD5005@momjian.us>
Date: Wed, 15 Aug 2018 15:16:28 -0600
Cc: Evan Rempel <erempel@uvic.ca>,
 pgsql-admin@lists.postgresql.org
Content-Transfer-Encoding: 7bit
Message-Id: <FC9458E4-122A-4729-84D2-5EA6DDFBE664@elevated-dev.com>
References: 
 <CAD+mzow89NrETPt57G21BN9cdf90uHYGnCiC_8wR8REoudnt5g@mail.gmail.com>
 <20180814195919.GA29140@momjian.us> <20180815145912.GA11573@momjian.us>
 <10cde505-db4b-bbeb-7d8a-7c4e145c6042@uvic.ca>
 <20180815192838.GA5005@momjian.us>
 <c6ef7b1d-2ed1-623a-ea9e-e6470aca1da7@uvic.ca>
 <20180815202646.GB5005@momjian.us>
 <d02f124e-ae91-c085-217d-ddb4a98a9349@uvic.ca>
 <20180815205758.GC5005@momjian.us>
 <25586049-C24B-4231-8179-714683AA4536@elevated-dev.com>
 <20180815210926.GD5005@momjian.us>
To: Bruce Momjian <bruce@momjian.us>
X-Mailer: Apple Mail (2.3445.9.1)
List-Id: <pgsql-admin.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-admin@lists.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-admin>
Precedence: bulk

> On Aug 15, 2018, at 3:09 PM, Bruce Momjian <bruce@momjian.us> wrote:
> 
> Well, since the superuser can start the server with whatever arguments
> they want, I am not sure how SELinux would help here.

root, yes, postgres "superuser", no--assuming things being locked down enough