public inbox for [email protected]
help / color / mirror / Atom feedFrom: Ron Johnson <[email protected]>
To: pgsql-general <[email protected]>
Subject: Re: Prevent users from executing pg_dump against tables
Date: Thu, 2 May 2024 08:32:34 -0400
Message-ID: <CANzqJaC8eCBMttR9AEREi8E9ZXtGLoRQEfyDo0fGOJRKDwWU+g@mail.gmail.com> (raw)
In-Reply-To: <CAFzdntvuzVvyj48V-bmo09ui8THtkMY-h5xaFqBOh5e_16nc3g@mail.gmail.com>
References: <CAFzdntvuzVvyj48V-bmo09ui8THtkMY-h5xaFqBOh5e_16nc3g@mail.gmail.com>
On Thu, May 2, 2024 at 1:47 AM RAJAMOHAN <[email protected]> wrote:
> Hello all,
>
> In our production db infrastructure, we have one read_only role which has
> read privileges against all tables in schema A.
>
> We are planning to grant this role to some developers for viewing the
> data, but also I want to limit the users from executing statements like
> copy or using pg_dump. Main reason being I don't want the data to be copied
> from the database to their local machines.
>
> I tried by implementing triggers, but was not able to figure out a way to
> restrict the pg_dump and allow only select statements.
>
> Is there a way to implement this? Please advise.
> <[email protected]>
>
If you can query a table, then you can save the query contents to your
local context. That's a fundamental law of nature, since you gave them
read privs.
For example:
psql --host=SomeEC2Node $DB -Xc "SELECT * FROM read_only_table;" >
read_only_table.txt
That even works on Windows.
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected]
Subject: Re: Prevent users from executing pg_dump against tables
In-Reply-To: <CANzqJaC8eCBMttR9AEREi8E9ZXtGLoRQEfyDo0fGOJRKDwWU+g@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox