Date: Fri, 27 Feb 2015 21:06:41 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Pavel Stehule <pavel.stehule@gmail.com>,
 Tomas Vondra <tomas.vondra@2ndquadrant.com>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch
 submission
Message-ID: <20150228020641.GX29780@tamriel.snowman.net>
References: <54C95C4B.2080901@BlueTreble.com>
 <54F09D68.2090700@2ndquadrant.com>
 <20150227165950.GP29780@tamriel.snowman.net>
 <CAFj8pRBo6n4gEQV8J72R0_iXiCa-kZ+j1Ecwk+LrjZRJFN4PhQ@mail.gmail.com>
 <20150227183236.GQ29780@tamriel.snowman.net>
 <CAFj8pRD0GmDAf-4M8U=JyuDRUn5n1W3HCbL2oaKDbasLKwU4zw@mail.gmail.com>
 <20150227195529.GS29780@tamriel.snowman.net>
 <12545.1425072391@sss.pgh.pa.us>
 <20150228003749.GU29780@tamriel.snowman.net>
 <29710.1425087618@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="B5JjOzmn0Nsc+m1x"
Content-Disposition: inline
In-Reply-To: <29710.1425087618@sss.pgh.pa.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--B5JjOzmn0Nsc+m1x
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > I understand that there may be objections to that on the basis that it's
> > work that's (other than for this case) basically useless,
>=20
> Got it in one.

Meh.  It's hardly all that difficult and it's not useless if the user
wants to look at it.

> I'm also not terribly happy about leaving security-relevant data sitting
> around in backend memory 100% of the time.  We have had bugs that exposed
> backend memory contents for reading without also granting the ability to
> execute arbitrary code, so I think doing this does represent a
> quantifiable decrease in the security of pg_hba.conf.

How is that any different from today?  The only time it's not *already*
in backend memory is when the user has happened to go through and make a
change and used reload (instead of restart) and then it's not so much
that the security sensetive information isn't there, it's just out of
date.

I'm not entirely against the idea of changing how things are today, but
this argument simply doesn't apply to the current state of things.

	Thanks!

		Stephen

--B5JjOzmn0Nsc+m1x
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJU8SKwAAoJEO1sijiDR2RV75sQAJuQBusGfKDZCI+Ms2sLwY18
jTyu2rvOs8PtW6l3h5AHhPMdT+Xrfeg9JlJu8FZdKs+4GY3Af3ESuQUHqzH908no
JTRD+HjOfkB5WX7GEcogcBHzJtkYXmuI9iTqfrPz7QVKzt4x3OSNWbGISCbyGs0l
gYTuoVV+S+7/QStv3MVP90nu5B+g7x8aaxI9nE30vMffOFFiJ8bu5kRg9OxMdwSf
vwNzKGryfdKzSDCcxpoBY8grWfP5+e1nlvjKK9mYObSpUfYGDPJ7V9rNbemZ/cFG
jit1ZLJJuVGC/l8SJL7atb9FnxQwmt2Bmi0ZJ54CqSbekLvGncXQ5QmDexHwlY7r
wCFrk5bQs/SaZ9+ALDhEXWI2rTdDPwjEMEc5HzhW8daUWzF2tnzOU+95cEio28VO
KEOG/4QlXsb9DhsVLDIjcECKCrm9udQx/iL1/pXRBJ7zHE/8WMoewjOfgvLdDijc
yucCmZaIT/RJR9M1bbJeav3MsldlIykYIjPdAjSZxv2Pojy3oqtzdNJJHglkPfKS
KFypEmqM8VlBu82CZC6t28UJmRgE60e849r5QubYdmNIWQbShVPgKPWnnzSJPXCB
NEczG3QPixFifrOGBqrqjbgoJcoOVdDGBu7YAgIcxS5rw3z2lmK4P+AXA4+ahjeF
x5uUWitnp9Gln3ZUQslu
=hu+G
-----END PGP SIGNATURE-----

--B5JjOzmn0Nsc+m1x--