From: Stephen Frost <sfrost@snowman.net>
To: Pavel Stehule <pavel.stehule@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Tomas Vondra <tomas.vondra@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch submission
Date: Fri, 27 Feb 2015 19:41:01 -0500
Message-ID: <20150228004101.GV29780@tamriel.snowman.net> (raw)
In-Reply-To: <CAFj8pRBctY5wDOfQB+anSd-EkqJV4usJMLiiMk2GXZeeOAWMdw@mail.gmail.com>
References: <CAJrrPGcFk9_svvipFJeLBrVJYOmq6uNy38NsT8jtfo6Bks5RYw@mail.gmail.com>
<54C95C4B.2080901@BlueTreble.com>
<54F09D68.2090700@2ndquadrant.com>
<20150227165950.GP29780@tamriel.snowman.net>
<CAFj8pRBo6n4gEQV8J72R0_iXiCa-kZ+j1Ecwk+LrjZRJFN4PhQ@mail.gmail.com>
<20150227183236.GQ29780@tamriel.snowman.net>
<CAFj8pRD0GmDAf-4M8U=JyuDRUn5n1W3HCbL2oaKDbasLKwU4zw@mail.gmail.com>
<20150227195529.GS29780@tamriel.snowman.net>
<12545.1425072391@sss.pgh.pa.us>
<CAFj8pRBctY5wDOfQB+anSd-EkqJV4usJMLiiMk2GXZeeOAWMdw@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Pavel,
* Pavel Stehule (pavel.stehule@gmail.com) wrote:
> 2015-02-27 22:26 GMT+01:00 Tom Lane <tgl@sss.pgh.pa.us>:
> > Stephen Frost <sfrost@snowman.net> writes:
> > > Right, we also need a view (or function, or both) which provides what
> > > the *active* configuration of the running postmaster is. This is
> > > exactly what I was proposing (or what I was intending to, at least) with
> > > pg_hba_active, so, again, I think we're in agreement here.
> >
> > I think that's going to be a lot harder than you realize, and it will have
> > undesirable security implications, in that whatever you do to expose the
> > postmaster's internal state to backends will also make it visible to other
> > onlookers; not to mention probably adding new failure modes.
>
> we can do copy of pg_hba.conf somewhere when postmaster starts or when it
> is reloaded.
Please see my reply to Tom. There's no trivial way to reach into the
postmaster from a backend- but we do get a copy of whatever the
postmaster had when we forked, and the postmaster only reloads
pg_hba.conf on a sighup and that sighup is passed down to the children,
so we simply need to also reload the pg_hba.conf in the children when
they get a sighup.
That's how postgresql.conf is handled, which is what pg_settings is
based off of, and I believe is the behavior folks are really looking
for.
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../20150228004101.GV29780@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, pavel.stehule@gmail.com, tgl@sss.pgh.pa.us, tomas.vondra@2ndquadrant.com
Subject: Re: Providing catalog view to pg_hba.conf file - Patch submission
In-Reply-To: <20150228004101.GV29780@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox