Date: Fri, 08 May 2020 15:03:26 +0900 (JST)
Message-Id: <20200508.150326.909507514141434296.horikyota.ntt@gmail.com>
To: alvherre@2ndquadrant.com
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, chris+postgresql@qwirx.com,
 pgsql-docs@lists.postgresql.org, pgsql-hackers@lists.postgresql.org,
 peter.eisentraut@2ndquadrant.com
Subject: Re: Logical replication subscription owner
From: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
In-Reply-To: <20200508050211.GA6945@alvherre.pgsql>
References: <17709.1588908623@sss.pgh.pa.us>
	<20200508050211.GA6945@alvherre.pgsql>
User-Agent: Mew version 6.8 on Emacs 26.1
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Precedence: bulk

At Fri, 8 May 2020 01:02:11 -0400, Alvaro Herrera <alvherre@2ndquadrant.com> wrote in 
> On 2020-May-07, Tom Lane wrote:
> 
> > FWIW, I would argue that LOGIN permits logging in on a regular SQL
> > connection, while REPLICATION should permit logging in on a
> > replication connection, and there's no reason for either to depend on
> > or require the other.
> 
> I agree with this.

I agree, too.  Anyway, it is unreasonable that a user is banned for
the lack of replication-attribute after a successful *replication*
login.

LOG:  replication connection authorized: user=user1 application_name=psql
FATAL:  must be superuser or replication role to start walsender

> > >> Also- what about per-database connections?  Does having REPLICATION mean
> > >> you get to override the CONNECT privileges on a database, if you're
> > >> connecting for the purposes of doing logical replication?
> > 
> > No, why would it?  Should LOGIN privilege mean you can override
> > CONNECT?  That's nonsense.  You need the respective privilege
> > to connect with the protocol you want to connect with, and you
> > also need CONNECT on the DB you want to connect to.
> 
> And this.

A user can start physical replication without needing CONNECT on any
database if it has REPLICATION attribute.  That means any user that
is allowed logical replication on a specific database (or even no
databases) can replicate the whole cluster using physical replication.
I don't think it is a proper behavior from the security perspective.

It seems to me that we need to restrict physical replication to
require CONNECT privilege on all databases, or separate physical
replication privilege from logical replication privilege.

regards.

-- 
Kyotaro Horiguchi
NTT Open Source Software Center