From: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
To: alvherre@2ndquadrant.com
Cc: tgl@sss.pgh.pa.us
Cc: sfrost@snowman.net
Cc: chris+postgresql@qwirx.com
Cc: pgsql-docs@lists.postgresql.org
Cc: pgsql-hackers@lists.postgresql.org
Cc: peter.eisentraut@2ndquadrant.com
Subject: Re: Logical replication subscription owner
Date: Fri, 08 May 2020 15:03:26 +0900 (JST)
Message-ID: <20200508.150326.909507514141434296.horikyota.ntt@gmail.com> (raw)
In-Reply-To: <20200508050211.GA6945@alvherre.pgsql>
References: <17709.1588908623@sss.pgh.pa.us>
<20200508050211.GA6945@alvherre.pgsql>
At Fri, 8 May 2020 01:02:11 -0400, Alvaro Herrera <alvherre@2ndquadrant.com> wrote in
> On 2020-May-07, Tom Lane wrote:
>
> > FWIW, I would argue that LOGIN permits logging in on a regular SQL
> > connection, while REPLICATION should permit logging in on a
> > replication connection, and there's no reason for either to depend on
> > or require the other.
>
> I agree with this.
I agree, too. Anyway, it is unreasonable that a user is banned for
the lack of replication-attribute after a successful *replication*
login.
LOG: replication connection authorized: user=user1 application_name=psql
FATAL: must be superuser or replication role to start walsender
> > >> Also- what about per-database connections? Does having REPLICATION mean
> > >> you get to override the CONNECT privileges on a database, if you're
> > >> connecting for the purposes of doing logical replication?
> >
> > No, why would it? Should LOGIN privilege mean you can override
> > CONNECT? That's nonsense. You need the respective privilege
> > to connect with the protocol you want to connect with, and you
> > also need CONNECT on the DB you want to connect to.
>
> And this.
A user can start physical replication without needing CONNECT on any
database if it has REPLICATION attribute. That means any user that
is allowed logical replication on a specific database (or even no
databases) can replicate the whole cluster using physical replication.
I don't think it is a proper behavior from the security perspective.
It seems to me that we need to restrict physical replication to
require CONNECT privilege on all databases, or separate physical
replication privilege from logical replication privilege.
regards.
--
Kyotaro Horiguchi
NTT Open Source Software Center
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: horikyota.ntt@gmail.com, alvherre@2ndquadrant.com, tgl@sss.pgh.pa.us, sfrost@snowman.net, chris+postgresql@qwirx.com, pgsql-docs@lists.postgresql.org, pgsql-hackers@lists.postgresql.org, peter.eisentraut@2ndquadrant.com
Subject: Re: Logical replication subscription owner
In-Reply-To: <20200508.150326.909507514141434296.horikyota.ntt@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox