Subject: Re: Effects of REVOKE SELECT ON ALL TABLES IN SCHEMA pg_catalog FROM PUBLIC

From: Greg Sabino Mullane <[email-masked]>
Date: Thu, 12 Sep 2024 09:58:53 -0400

On Thu, Sep 12, 2024 at 9:21 AM Andreas Joseph Krogh <[email-masked]>
wrote:

> Yes, it *is* theater, but that doesn't prevent “compliance people” to
> care about it. We have to take measures to prevent “information leaks”.
>

*shrug* Then the compliance people are not good at their jobs, frankly.

But if it works for you, go ahead. As Tom said, it will work 95% of the
time. But it will break things that should work, and it will not prevent
the ability to get the information in other ways. To be clear, we never
recommend messing with the system catalogs, and this falls under the
umbrella of messing with the system catalogs.

Cheers,
Greg

---

From: Christophe Pettus <[email-masked]>
Date: Thu, 12 Sep 2024 07:10:26 -0700

> On Sep 12, 2024, at 06:58, Greg Sabino Mullane <[email-masked]> wrote:
> 
> But if it works for you, go ahead. As Tom said, it will work 95% of the time. But it will break things that should work, and it will not prevent the ability to get the information in other ways. To be clear, we never recommend messing with the system catalogs, and this falls under the umbrella of messing with the system catalogs.

I can only echo that if the compliance people are taking a position that "you need to make an unsupported, ad-hoc modification to the database software's authentication system in order to meet this requirement," then the requirement is one that you should run, not walk, to get a waiver to, as that's a very unreasonable position for them to take.

---

From: Andreas Joseph Krogh <[email-masked]>
Date: Thu, 12 Sep 2024 16:13:26 +0200 (CEST)

> But if it works for you, go ahead. As Tom said, it will work 95% of the 
time. But it will break things that should work, and it will not prevent the 
ability to get the information in other ways. To be clear, we never recommend 
messing with the system catalogs, and this falls under the umbrella of messing 
with the system catalogs.

I can only echo that if the compliance people are taking a position that "you 
need to make an unsupported, ad-hoc modification to the database software's 
authentication system in order to meet this requirement," then the requirement 
is one that you should run, not walk, to get a waiver to, as that's a very 
unreasonable position for them to take.

We're probably going down the postgres_fdw route, that seems to do the job.

--
Andreas Joseph Krogh
CTO / Partner - Visena AS
Mobile: +47 909 56 963
[email-masked] <mailto:[email-masked]>
www.visena.com <https://www.visena.com>
 <https://www.visena.com>