From: Michael Paquier <michael@paquier.xyz>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: masahiko.sawada@2ndquadrant.com
Cc: martin@2ndquadrant.com
Cc: sfrost@snowman.net
Cc: pgsql-hackers@postgresql.org
Subject: Re: Read access for pg_monitor to pg_replication_origin_status view
Date: Tue, 9 Jun 2020 15:11:04 +0900
Message-ID: <20200609061104.GD38342@paquier.xyz> (raw)
In-Reply-To: <20200608.174456.238992210909952383.horikyota.ntt@gmail.com>
References: <20200604.161033.1845732016784727041.horikyota.ntt@gmail.com>
<CAPdiE1wUt3WQZq30Wa1Xz0NM7rtVPZdK15PKRd0zS3ugZsCsow@mail.gmail.com>
<CA+fd4k6ybp7M=GXKrJG0h4eg9XehmtGtKBxwwA9auHUuTNk+Kg@mail.gmail.com>
<20200608.174456.238992210909952383.horikyota.ntt@gmail.com>
On Mon, Jun 08, 2020 at 05:44:56PM +0900, Kyotaro Horiguchi wrote:
> Mmm. Right.
Yep. I bumped on that myself. I am not sure about 0002 and 0004 yet,
and IMO they are not mandatory pieces, but from what I can see in the
set 0001 and 0003 can just be squashed together to remove those
superuser checks, and no spots within the twelve functions calling
replorigin_check_prerequisites() are missing a REVOKE. So something
like the attached could just happen first, no? If the rights of
pg_read_all_stats need to be extended, it would always be possible to
do so once the attached is done with a custom script.
Also, why don't we use this occation to do the same thing for the
functions working on replication slots? While we are looking at this
area, we may as well just do it. Here is the set of functions that
would be involved:
- pg_create_physical_replication_slot
- pg_create_logical_replication_slot
- pg_replication_slot_advance
- pg_drop_replication_slot
- pg_copy_logical_replication_slot (3 functions)
- pg_copy_physical_replication_slot (2 functions)
--
Michael
Attachments:rep-origin-superuser-v6.patch (text/x-diff, 3.0K) downloaddiff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sqlindex 56420bbc9d..5314e9348f 100644--- a/src/backend/catalog/system_views.sql+++ b/src/backend/catalog/system_views.sql@@ -1463,6 +1463,19 @@ REVOKE EXECUTE ON FUNCTION pg_read_binary_file(text) FROM public;
REVOKE EXECUTE ON FUNCTION pg_read_binary_file(text,bigint,bigint) FROM public;
REVOKE EXECUTE ON FUNCTION pg_read_binary_file(text,bigint,bigint,boolean) FROM public;
+REVOKE EXECUTE ON FUNCTION pg_replication_origin_advance(text, pg_lsn) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_create(text) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_drop(text) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_oid(text) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_progress(text, boolean) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_session_is_setup() FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_session_progress(boolean) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_session_reset() FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_session_setup(text) FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_xact_reset() FROM public;+REVOKE EXECUTE ON FUNCTION pg_replication_origin_xact_setup(pg_lsn, timestamp with time zone) FROM public;+REVOKE EXECUTE ON FUNCTION pg_show_replication_origin_status() FROM public;+
REVOKE EXECUTE ON FUNCTION pg_stat_file(text) FROM public;
REVOKE EXECUTE ON FUNCTION pg_stat_file(text,boolean) FROM public;
diff --git a/src/backend/replication/logical/origin.c b/src/backend/replication/logical/origin.cindex 1ca4479605..bc50106070 100644--- a/src/backend/replication/logical/origin.c+++ b/src/backend/replication/logical/origin.c@@ -182,11 +182,6 @@ static ReplicationState *session_replication_state = NULL;
static void
replorigin_check_prerequisites(bool check_slots, bool recoveryOK)
{
- if (!superuser())- ereport(ERROR,- (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),- errmsg("only superusers can query or manipulate replication origins")));-
if (check_slots && max_replication_slots == 0)
ereport(ERROR,
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgmlindex a8d57f4e39..b65aa28f34 100644--- a/doc/src/sgml/func.sgml+++ b/doc/src/sgml/func.sgml@@ -24614,7 +24614,9 @@ postgres=# SELECT * FROM pg_walfile_name_offset(pg_stop_backup());
<xref linkend="streaming-replication-slots"/>, and
<xref linkend="replication-origins"/>
for information about the underlying features.
- Use of functions for replication origin is restricted to superusers.+ Use of functions for replication origin is only allowed to the+ superuser by default, but may be allowed to other users by using the+ <literal>GRANT</literal> command.
Use of functions for replication slots is restricted to superusers
and users having <literal>REPLICATION</literal> privilege.
</para>
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: michael@paquier.xyz, horikyota.ntt@gmail.com, masahiko.sawada@2ndquadrant.com, martin@2ndquadrant.com, sfrost@snowman.net
Subject: Re: Read access for pg_monitor to pg_replication_origin_status view
In-Reply-To: <20200609061104.GD38342@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox