Date: Wed, 16 Mar 2022 10:26:59 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Bharath Rupireddy <bharath.rupireddyforpostgres@gmail.com>
Cc: Jeff Davis <pgsql@j-davis.com>, Robert Haas <robertmhaas@gmail.com>,
	Ashutosh Sharma <ashu.coek88@gmail.com>,
	Andrew Dunstan <andrew@dunslane.net>, Greg Stark <stark@mit.edu>,
	Jeremy Schneider <schneider@ardentperf.com>,
	Bruce Momjian <bruce@momjian.us>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
	SATYANARAYANA NARLAPURAM <satyanarlapuram@gmail.com>,
	marvin_liang@qq.com, actyzhang@outlook.com
Subject: Re: pg_walinspect - a new extension to get raw WAL data and WAL stats
Message-ID: <20220316142658.GS10577@tamriel.snowman.net>
References: <CALj2ACUtqWX95uAj2VNJED0PnixEeQ=0MEzpouLi+zd_iTugRA@mail.gmail.com>
 <CAE9k0Pn4H48D7iK=T-B2CtnCCab7DgQ4MUUCLfzFf345HmkrGQ@mail.gmail.com>
 <CALj2ACVY37ed+BT_WeM2KQS1TUM90HO9NjNktaKCX2G6X5iXsQ@mail.gmail.com>
 <39c13407c8b7311e9a3b24f2df814696bfa2ebff.camel@j-davis.com>
 <CA+TgmoY4HYy89sgWTWgB9FPZ=S28=CDpDO73X-J7wRgd542hOQ@mail.gmail.com>
 <20220310205424.GJ10577@tamriel.snowman.net>
 <ff684608037760af06a332c975a3414f0c67c458.camel@j-davis.com>
 <20220314145554.GP10577@tamriel.snowman.net>
 <CALj2ACX5E=qQmXMMgG_Hh7w7=gopFJ-Q67Q6Ve344x81b_Ak3Q@mail.gmail.com>
 <CALj2ACW3cT5NPrBWzdmXgjw59M4xLL7jcL8C3xu9W3i7wdOyaw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="/nncEjGTIZzdZRjW"
Content-Disposition: inline
In-Reply-To: <CALj2ACW3cT5NPrBWzdmXgjw59M4xLL7jcL8C3xu9W3i7wdOyaw@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: <https://www.postgresql.org/message-id/20220316142658.GS10577%40tamriel.snowman.net>
Precedence: bulk


--/nncEjGTIZzdZRjW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Bharath Rupireddy (bharath.rupireddyforpostgres@gmail.com) wrote:
> On Tue, Mar 15, 2022 at 7:21 AM Bharath Rupireddy
> <bharath.rupireddyforpostgres@gmail.com> wrote:
> >
> > On Mon, Mar 14, 2022 at 8:25 PM Stephen Frost <sfrost@snowman.net> wrot=
e:
> > >
> > > > As this patch is currently written, pg_monitor has access these
> > > > functions, though I don't think that's the right privilege level at
> > > > least for pg_get_raw_wal_record().
> > >
> > > Yeah, I agree that pg_monitor isn't the right thing for such a functi=
on
> > > to be checking.
> >
> > On Thu, Mar 10, 2022 at 1:52 PM Jeff Davis <pgsql@j-davis.com> wrote:
> > >
> > > * pg_get_raw_wal_record() seems too powerful for pg_monitor. Maybe th=
at
> > > function should require pg_read_server_files? Or at least
> > > pg_read_all_data?
> >
> > The v9 patch set posted at [1] grants execution on
> > pg_get_raw_wal_record() to the pg_monitor role.
> >
> > pg_read_all_data may not be the right choice, but pg_read_server_files
> > is as these functions do read the WAL files on the server. If okay,
> > I'm happy to grant execution on pg_get_raw_wal_record() to the
> > pg_read_server_files role.
> >
> > Thoughts?
> >
> > [1] https://www.postgresql.org/message-id/CALj2ACVRH-z8mZLyFkpLvY4qRhxQ=
CqU_BLkFTtwt%2BTPZNhfEVg%40mail.gmail.com
>=20
> Attaching v10 patch set which allows pg_get_raw_wal_record to be
> executed by either superuser or users with pg_read_server_files role,
> no other change from v9 patch set.

In a quick look, that seems reasonable to me.  If folks want to give out
access to this function individually they're also able to do so, which
is good.  Doesn't seem worthwhile to introduce a new predefined role for
this one function.

Thanks,

Stephen

--/nncEjGTIZzdZRjW
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJiMfOyAAoJEO1sijiDR2RVHCYP/0mtuyCd1glnFZLFMsPnqlgG
QSJvMAhF2YWSIwX1DGLCo89f5n4+PbULH5OBgRFX8cJK3ov+7UJlk0LJ0anSQf6k
C41+N2CHyJ4EIbM8zxcE/fS3/D4FJSrRmnWMuwB4MOd/1Xq26uWjPVLzeWOED9KY
e+1WgaiESlgBxI/emeJir4xt6KAfJZpG7ZyCKuOtkEajwkBuDzphIk3AEJXa82lC
lIF1ptwFiXmlCmz4+yh8wgCV8W/jzlfkhIyATGybi9FG2wLTtf55eFG4gfPyuUBx
4BIf9CTCdojhJEVaPOtLUyonHD52cU5KhfV9ZNaUaCk5F8AbDgXHZYATpdS5mVOD
5AX3l3xUjAMg/4CxBvt/niG+l+XzjClyKQg+HOy4Y7SupfeQql6oBoDXnbDTQs5p
m+digJS5teJblPJ3tqU6Dc3d6on7e2x8DwI7du2olKz3cGT9E3WnQXqhGxXyEWci
F9Lt2A7Te6fMekB65Ge/6d9542TkAMRFFCk1C7nmJWVTkR2pqNt2GISKUyb9MtEI
VlEcuwjU0o84GaD0dngECUIq4Bn9pIgQb9u/7s+N9w6Snf0NO9FhrwVPCVWTicrn
s6CrwhRhtVQBrp3k9cc6zUlOwNPvHOBm/VfR4MDJq2FqSLR0yxKWOBnpVm8L/aCX
irS8hO2gn12XM9yoStUR
=ANXx
-----END PGP SIGNATURE-----

--/nncEjGTIZzdZRjW--