From: Nathan Bossart <nathandbossart@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Ian Lawrence Barwick <barwick@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: docs: mention "pg_read_all_stats" in "track_activities" description
Date: Sun, 22 May 2022 13:26:08 -0700
Message-ID: <20220522202608.GA892371@nathanxps13> (raw)
In-Reply-To: <YomLAynQiordq3lg@paquier.xyz>
References: <CAB8KJ=jhPyYFu-A5r-ZGP+Ax715mUKsMxAGcEQ9Cx_mBAmrPow@mail.gmail.com>
<20220520230837.GB877934@nathanxps13>
<YohcelRv74nuHC9Z@paquier.xyz>
<20220521185743.GA886636@nathanxps13>
<YomLAynQiordq3lg@paquier.xyz>
On Sun, May 22, 2022 at 09:59:47AM +0900, Michael Paquier wrote:
> + visible to superusers, roles with privileges of the
> + <literal>pg_read_all_stats</literal> role, and roles with privileges of
> + the user owning the session being reported on, so it should not
> + represent a security risk. Only superusers and users with the
> + appropriate <literal>SET</literal> privilege can change this setting.
>
> Regarding the fact that a user can see its own information, the last
> part of the description would be right, still a bit confusing perhaps
> when it comes to one's own information?
Yeah, this crossed my mind. I thought that "superusers, roles with
privileges of the pg_read_all_stats_role, roles with privileges of the user
owning the session being reported on, and the user owning the session being
reported on" might be too long-winded and redundant. But I see your point
that it might be a bit confusing. Perhaps it could be trimmed down to
something like this:
... superusers, roles with privileges of the pg_read_all_stats role,
and roles with privileges of the user owning the session being reported
on (including the session owner).
--
Nathan Bossart
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com, michael@paquier.xyz, barwick@gmail.com
Subject: Re: docs: mention "pg_read_all_stats" in "track_activities" description
In-Reply-To: <20220522202608.GA892371@nathanxps13>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox