Date: Fri, 28 Aug 2020 10:52:19 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Gilles Darold <gilles@darold.net>
Cc: Magnus Hagander <magnus@hagander.net>,
	PostgreSQL Developers <pgsql-hackers@lists.postgresql.org>
Subject: Re: New default role- 'pg_read_all_data'
Message-ID: <20200828145219.GA29590@tamriel.snowman.net>
References: <20200828003023.GU29590@tamriel.snowman.net>
 <CABUevEy9QAnx5h_BmSk4j6K9AfS9=co15RUFda0kknMHO9NJOg@mail.gmail.com>
 <20200828123847.GV29590@tamriel.snowman.net>
 <CABUevEx5akfNeSrHsinCRWfXzSYFNRTnBc4vHKMgum8hLrr=yg@mail.gmail.com>
 <20200828132645.GZ29590@tamriel.snowman.net>
 <6a78c0d5-d010-f2b5-198f-b35eb152f3c4@darold.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="bcYi5jFlpxeIYd0E"
Content-Disposition: inline
In-Reply-To: <6a78c0d5-d010-f2b5-198f-b35eb152f3c4@darold.net>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--bcYi5jFlpxeIYd0E
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Gilles Darold (gilles@darold.net) wrote:
> Le 28/08/2020 =E0 15:26, Stephen Frost a =E9crit=A0:
> >* Magnus Hagander (magnus@hagander.net) wrote:
> >>On Fri, Aug 28, 2020 at 2:38 PM Stephen Frost <sfrost@snowman.net> wrot=
e:
> >>>* Magnus Hagander (magnus@hagander.net) wrote:
> >>>>Without having actually looked at the code, definite +1 for this feat=
ure.
> >>>>It's much requested...
> >>>Thanks.
> >>>
> >>>>But, should we also have a pg_write_all_data to go along with it?
> >>>Perhaps, but could certainly be a different patch, and it'd need to be
> >>>better defined, it seems to me...  read_all is pretty straight-forward
> >>>(the general goal being "make pg_dumpall/pg_dump work"), what would
> >>>write mean?  INSERT?  DELETE?  TRUNCATE?  ALTER TABLE?  System catalog=
s?
> >>Well, it's pg_write_all_*data*, so it certainly wouldn't be alter table=
 or
> >>system catalogs.
> >>
> >>I'd say insert/update/delete yes.
> >>
> >>TRUNCATE is always an outlier.Given it's generally classified as DDL, I
> >>wouldn't include it.
> >Alright, that seems like it'd be pretty easy.  We already have a check
> >in pg_class_aclmask to disallow modification of system catalogs w/o
> >being a superuser, so we should be alright to add a similar check for
> >insert/update/delete just below where I added the SELECT check.
> >
> >>>Doesn't seem like you could just declare it to be 'allow pg_restore'
> >>>either, as that might include creating untrusted functions, et al.
> >>No definitely not. That wouldn't be the usecase at all :)
> >Good. :)
> >
> >>(and fwiw to me the main use case for read_all_data also isn't pg_dump,
> >>because most people using pg_dump are already db owner or higher in my
> >>experience. But it is nice that it helps with that too)
> >Glad to have confirmation that there's other use-cases this helps with.
> >
> >I'll post an updated patch with that added in a day or two.
>=20
> Looking at this thread I was thinking about the FDW. Does role
> pg_read_all_data will allow to execute pg_dump with --include-foreign-data
> option? If this is the case how about priviledge on fdw and foreign serve=
r?
> If this is the behavior we want I guess that the modification should be
> applied to pg_foreign_data_wrapper_aclmask() and pg_foreign_server_aclmas=
k()
> too.

Using an FDW will often also require having a user mapping and there's
no way for that to be accomplished through only GRANT'ing a default
role, so I don't think we should mix this specific role with the FDW
permissions system.

Thanks,

Stephen

--bcYi5jFlpxeIYd0E
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJfSRojAAoJEO1sijiDR2RVXYYP/0/zTKhjpVAkSeBXYkPO/MrQ
l05SB3Dy9xgUChEBIhM3hutN7haIkBWV5xqAiuVZM1nkjqtSnxH1uryR64w2bvtd
8VCo4MTwAOxCwtwMbDWCY4uPXt0VK8kjwcc8QIrzfiuQ0/cCYR2a50vue/+hy7oI
SA4sfQ7oW0soSmKofhvZsVTH30NYlNPMwO9wyfAhVbuYoPAl4yH47qMRc4xQYMin
Bg5d5h8u6c9da8F8KjaAkRisIaeKFsGjVb/RlhD9ux+rRX+7EjSf4Qx5d2RRQjWg
fVwIxzaYSQnwvv4RaSkqJ8FdwhfZU3WQIdufs8/YdihUEW0MQL9W4U3ME9ZzFUmB
nsiWmwR7BHd20fH63kb8spTZTmIgHQ0zWNXXw/YJyjGdfoc1xz3cI+5D9GhccOon
DdLUVdCIXvGV++MXQ15k/auy8h9rLN2jfkTfOhARxdACuD9Orcy1Nj2sAa1ThoAx
LgYXh03zowMI0cbWpZxSoEpH4mMbEHk7JW/yPuNQNnsn6ENwaCeSlBNsqHGJihuX
fEVeNPBFKDf33+KCSkgvZ1IhYW3yKAfQKaDLMWC1NULQF8EggNKVuLS/RLQD8gzl
xSSUofjAR+Q8CVBQ2pMCkbMPX39ZJYNMg3MOqDye201IBjB5QGdkJgA/35nJpV/R
o8eLXmamfiG+lI2tIKNh
=bKX/
-----END PGP SIGNATURE-----

--bcYi5jFlpxeIYd0E--