pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Commit 5a2fed911a broke parallel query
Date: Mon, 23 Dec 2024 10:35:36 -0500
Message-ID: <1349368.1734968136@sss.pgh.pa.us> (raw)
In-Reply-To: <8befc845430ba1ae3748af900af298788e579c89.camel@cybertec.at>
References: <8befc845430ba1ae3748af900af298788e579c89.camel@cybertec.at>

Laurenz Albe <laurenz.albe@cybertec.at> writes:
> This is a script to reproduce the problem:

As commented in 73c9f91a1,

    This all seems very accidental and probably not the behavior we really
    want, but a security patch is no time to be redesigning things.

Perhaps this thread is a good place to start the discussion.

In the security-team discussion that led up to 73c9f91a1, I'd been
wondering why parallel worker start enforces any connection
restrictions at all.  If we'd like the use of parallelism to be
more-or-less transparent, we shouldn't apply these checks,
and not the !am_superuser ones in InitPostgres either.  If we do
want to apply permissions checks in parallel worker start, why
should we think that the failure in this example is wrong?

			regards, tom lane

view thread (4+ messages)  latest in thread

Message-ID: <1349368.1734968136@sss.pgh.pa.us>
Permalink:  ../1349368.1734968136@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/1349368.1734968136@sss.pgh.pa.us

copy link · copy postgr.es

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, laurenz.albe@cybertec.at, pgsql-bugs@lists.postgresql.org
  Subject: Re: Commit 5a2fed911a broke parallel query
  In-Reply-To: <1349368.1734968136@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox