Date: Wed, 22 Mar 2017 09:17:30 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Dave Page <dpage@pgadmin.org>, Robert Haas <robertmhaas@gmail.com>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Monitoring roles patch
Message-ID: <20170322131730.GD9812@tamriel.snowman.net>
References: 
 <CA+OCxoyRdsc1xyLfF9s698gUGyPXBs4CvJ+0Gwo8U65NmYJ7pw@mail.gmail.com>
 <CA+TgmobveXzVPytFOO3AkmsM+Y=YEG+UXcCvgwAt+SgYj85OCA@mail.gmail.com>
 <CA+OCxox9c9-1=bXxA6-gr-iWZbD5zdHYMz=cpC034RKB7zX40Q@mail.gmail.com>
 <c99cde7f-0aa7-ebaa-b9f4-ee75522554a4@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="6GWensC3ZIbVPQGH"
Content-Disposition: inline
In-Reply-To: <c99cde7f-0aa7-ebaa-b9f4-ee75522554a4@2ndquadrant.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--6GWensC3ZIbVPQGH
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Peter,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 3/22/17 07:48, Dave Page wrote:
> > With the patch, complex monitoring systems can easily be setup with
> > something like:
> >=20
> > CREATE ROLE monitoring_user LOGIN;
> > GRANT pg_monitor TO monitoring_role;
>=20
> That assumes that we have thought of all the ways in which people might
> want to monitor things.

I disagree.  The entire point of the pg_monitor role is to cover those
rights which we feel should be available to monitoring solutions, and
that *will* change over time.

> If we do it via GRANTs instead, then users can easily extend it.

The intent here is that users will *also* be able to do it via GRANTs if
they wish to.

> If we instead change the hardcoded superuser checks to hardcoded
> some-other-role checks, then the whole system instantly becomes unusable
> the moment someone wants to monitor something we haven't thought of.

Right, that's why we need specific roles for the cases where we have to
have a C-level check and the pg_monitor role should only be GRANT'd
those other roles or GRANTs on specific functions, all of which a
DBA/superuser could do themselves with their own role, if they wished to
do so, instead of using pg_monitor.

Thanks!

Stephen

--6GWensC3ZIbVPQGH
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJY0nlqAAoJEO1sijiDR2RVciAQAMM5OtUEOXffyISdQXva6cUg
IQJkpfu530rp9jjehqbfF6+ISvPi4dnmpuGC2yf/ms6nHduL18HrZhTg/P0zYxfo
g/yLoScKL5tWYhb3rFPXqDBrr909bMjy3i9JTGSvL+B32JOOVRdxyPYeNOz29bRv
l9WI0ena90QDtm99TMkrDmOfZ92X9AzHil5Kl4Nmq7ss30HPHEDAcN/qGjfB0/zq
mdSskfeEylBtP4E1ayQByz1Ftqi2TQqv7AR3BblRYm4rhxfxtG9nyqMYtM8Oger3
KPohgoNAAycL2q90QsMDBb8IXTzGu9+N4YQ74w3qCg4Qr1k87QJRQKD4ONXdXssf
Aya+hsULgC8oJUSgtb9a9k6q6+++W5ocdscGtG1IEoZbYNC9wvK/4uNplbb2wsOr
bZj7WHKHkdC6FU6VV5ttQbAOvt1Gr2/QZF4LzPi48WF7H6YsNOJWbUKjK/kgRIUi
YQCE6skHlJ6kIwHTco9RG5g8Pu/CsjCMx41b55090+PaQJAyNb1ODo3rAJG2Y5IU
voxH1zyeVjyF72xRF3uURXr979ZsaLT4vWQGdRs3sgcvK+S7ypyNF4vJ/e+/w/7+
jsdOA96JAy7ygsIRwHLH2hSpLadeYimQCAOLlJYTut0cAJ2kAPc0EiskPND+2I+0
J4RXFuvbr5yxqk059Wvb
=gp68
-----END PGP SIGNATURE-----

--6GWensC3ZIbVPQGH--