Date: Fri, 27 Feb 2015 19:41:01 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Pavel Stehule <pavel.stehule@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Tomas Vondra <tomas.vondra@2ndquadrant.com>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch
 submission
Message-ID: <20150228004101.GV29780@tamriel.snowman.net>
References: 
 <CAJrrPGcFk9_svvipFJeLBrVJYOmq6uNy38NsT8jtfo6Bks5RYw@mail.gmail.com>
 <54C95C4B.2080901@BlueTreble.com>
 <54F09D68.2090700@2ndquadrant.com>
 <20150227165950.GP29780@tamriel.snowman.net>
 <CAFj8pRBo6n4gEQV8J72R0_iXiCa-kZ+j1Ecwk+LrjZRJFN4PhQ@mail.gmail.com>
 <20150227183236.GQ29780@tamriel.snowman.net>
 <CAFj8pRD0GmDAf-4M8U=JyuDRUn5n1W3HCbL2oaKDbasLKwU4zw@mail.gmail.com>
 <20150227195529.GS29780@tamriel.snowman.net>
 <12545.1425072391@sss.pgh.pa.us>
 <CAFj8pRBctY5wDOfQB+anSd-EkqJV4usJMLiiMk2GXZeeOAWMdw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="OGBBnVs4XFPv5LQD"
Content-Disposition: inline
In-Reply-To: 
 <CAFj8pRBctY5wDOfQB+anSd-EkqJV4usJMLiiMk2GXZeeOAWMdw@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--OGBBnVs4XFPv5LQD
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Pavel,

* Pavel Stehule (pavel.stehule@gmail.com) wrote:
> 2015-02-27 22:26 GMT+01:00 Tom Lane <tgl@sss.pgh.pa.us>:
> > Stephen Frost <sfrost@snowman.net> writes:
> > > Right, we also need a view (or function, or both) which provides what
> > > the *active* configuration of the running postmaster is.  This is
> > > exactly what I was proposing (or what I was intending to, at least) w=
ith
> > > pg_hba_active, so, again, I think we're in agreement here.
> >
> > I think that's going to be a lot harder than you realize, and it will h=
ave
> > undesirable security implications, in that whatever you do to expose the
> > postmaster's internal state to backends will also make it visible to ot=
her
> > onlookers; not to mention probably adding new failure modes.
>=20
> we can do copy of pg_hba.conf somewhere when postmaster starts or when it
> is reloaded.

Please see my reply to Tom.  There's no trivial way to reach into the
postmaster from a backend- but we do get a copy of whatever the
postmaster had when we forked, and the postmaster only reloads
pg_hba.conf on a sighup and that sighup is passed down to the children,
so we simply need to also reload the pg_hba.conf in the children when
they get a sighup.

That's how postgresql.conf is handled, which is what pg_settings is
based off of, and I believe is the behavior folks are really looking
for.

	Thanks,

		Stephen

--OGBBnVs4XFPv5LQD
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJU8Q6dAAoJEO1sijiDR2RV3XkQALBS8gd5cBqRPyt8cs1fohxU
Tfz2G7I/zlSSCjZGGa7aj0s/HN/4n7CPs7CIHFe05oyOEKP1l5SDKXDi8cq9QOAA
Iknb/kCEPDp9VfkzF3pQwnKVdvmwiytMO9Q1qA0ctAnUQ4+of6tDMVbrpew7PHe+
fphV5Nr99Qwo2yHl7JHOvtKUzepAgKsBeG7rRvHASKMeQ2Z3G+iQ6FEJu9ykQ5tj
+1z6DewNmnnm+SfjO9CYds8l6WrQbi0NBZbaLYhAP+FKK6xGVAdAi9xGmsjTInDV
CYysFXsFDx5k17ghNbN0K1n5n44nSsuGCKC6A5GfjqYotma6QX9RjHpDAsdUdfad
w6wTxAex/b7150cpU3QKQ/HVNUZo5P0aeTkLBmhMHT6A3kBH4qxn0UqRHX4UOr2p
7qtVmtgwY2h4fhwkKHOi2lh97sokWCOkBHS+zusl8nAd4QXiLQ/LbzPYGv9+Id0Z
AMFOUc/NGrz2RI6awsDM0QRUgnEQnbafUzatCMGJTp584qV2YD0CDWlTa7Se145l
tSAl7q5wSdwe1uL/H1vXznMF3Kln07TzjUwCS1ltFDCVu6gp4H/sc0fcYDhmr7t1
Ye50gPwIHML3dm6mvshCe7JdEaw6ZhT7eMXWwGSdUCDdqj1W+B6hdYKwIJpOf+Cb
RqvBlqdUi/pIIeoqtprz
=177u
-----END PGP SIGNATURE-----

--OGBBnVs4XFPv5LQD--