From: Michael Paquier <michael@paquier.xyz>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: restrict pg_stat_ssl to superuser?
Date: Thu, 21 Feb 2019 17:11:24 +0900
Message-ID: <20190221081124.GS15532@paquier.xyz> (raw)
In-Reply-To: <3018acd9-e5d8-1e85-5ed7-47276cd77569@2ndquadrant.com>
References: <63117976-d02c-c8e2-3aef-caa31a5ab8d3@2ndquadrant.com>
<20190212064007.GN1475@paquier.xyz>
<71319f2d-a073-0499-4562-6003e026307e@2ndquadrant.com>
<20190218035813.GH15532@paquier.xyz>
<1d1bf3a7-955e-ce6b-de99-b900136ca789@2ndquadrant.com>
<3018acd9-e5d8-1e85-5ed7-47276cd77569@2ndquadrant.com>
On Wed, Feb 20, 2019 at 11:51:08AM +0100, Peter Eisentraut wrote:
> So here is a patch doing it the "normal" way of nulling out all the rows
> the user shouldn't see.
That looks fine to me.
> I haven't found any documentation of these access restrictions in the
> context of pg_stat_activity. Is there something that I'm not seeing or
> something that should be added?
Yes, there is nothing. I agree that it would be good to mention that
some fields are set to NULL and only visible to superusers or members of
pg_read_all_stats with a note for pg_stat_activity and
pg_stat_get_activity(). Here is an idea:
"Backend and SSL information are restricted to superusers and members
of the <literal>pg_read_all_stats</literal> role. Access may be
granted to others using <command>GRANT</command>.
Getting that back-patched would be nice where pg_read_all_stats was
introduced.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20190221081124.GS15532@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: michael@paquier.xyz, peter.eisentraut@2ndquadrant.com
Subject: Re: restrict pg_stat_ssl to superuser?
In-Reply-To: <20190221081124.GS15532@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox