pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Antonin Houska <ah@cybertec.at>
Cc: Euler Taveira <euler@eulerto.com>
Cc: Amit Kapila <amit.kapila16@gmail.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Privileges on PUBLICATION
Date: Fri, 11 Nov 2022 15:08:16 +0100
Message-ID: <043c52a4-c001-0201-94fc-305dffb8313e@enterprisedb.com> (raw)
In-Reply-To: <2497.1667546930@antos>
References: <20330.1652105397@antos>
	<8a00e0e1-dc4e-422c-9dcf-664b16b18625@www.fastmail.com>
	<CAA4eK1Lya6BoMa1m8cTZrQ8KvABQpn3EsHDKRurz8UJeHsGnZw@mail.gmail.com>
	<2810.1652171844@antos>
	<d96103fe-99e2-4119-bd76-952d326b7539@www.fastmail.com>
	<5859.1652423797@antos>
	<e6025f13-fefa-4ff2-9364-24f4c77fcf7a@www.fastmail.com>
	<57022.1652867097@antos>
	<4c420c17-8570-4b52-b7f6-9ce3f53d7ef9@www.fastmail.com>
	<14292.1655733695@antos.home>
	<746c9a65-e2cc-2573-a50e-ab5ea884f680@enterprisedb.com>
	<1537.1667454192@antos>
	<a7b95f74-e3e3-adae-b472-2e8d24a4e4b8@enterprisedb.com>
	<2497.1667546930@antos>

On 04.11.22 08:28, Antonin Houska wrote:
> I thought about the whole concept a bit more and I doubt if the PUBLICATION
> privilege is the best approach. In particular, the user specified in CREATE
> SUBSCRIPTION ... CONNECTION ... (say "subscription user") needs to have SELECT
> privilege on the tables replicated. So if the DBA excludes some columns from
> the publication's column list and sets the (publication) privileges in such a
> way that the user cannot get the column values via other publications, the
> user still can connect to the database directly and get values of the excluded
> columns.

Why are the SELECT privileges needed?  Maybe that's something to think 
about and maybe change.

> As an alternative to the publication privileges, I think that the CREATE
> SUBSCRIPTION command could grant ACL_SELECT automatically to the subscription
> user on the individual columns contained in the publication column list, and
> DROP SUBSCRIPTION would revoke that privilege.

I think that approach is weird and unusual.  Privileges and object 
creation should be separate operations.






view thread (34+ messages)  latest in thread

Message-ID: <043c52a4-c001-0201-94fc-305dffb8313e@enterprisedb.com>
Permalink:  ../043c52a4-c001-0201-94fc-305dffb8313e@enterprisedb.com/
Also on:    postgresql.org/message-id/043c52a4-c001-0201-94fc-305dffb8313e@enterprisedb.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: peter.eisentraut@enterprisedb.com, ah@cybertec.at, euler@eulerto.com, amit.kapila16@gmail.com, pgsql-hackers@lists.postgresql.org
  Subject: Re: Privileges on PUBLICATION
  In-Reply-To: <043c52a4-c001-0201-94fc-305dffb8313e@enterprisedb.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox