Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1no450-0005TM-Te for pgsql-hackers@arkaria.postgresql.org; Mon, 09 May 2022 14:09:42 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1no44z-0006eF-PS for pgsql-hackers@arkaria.postgresql.org; Mon, 09 May 2022 14:09:41 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1no44z-0006e5-CK for pgsql-hackers@lists.postgresql.org; Mon, 09 May 2022 14:09:41 +0000 Received: from mail-ej1-x633.google.com ([2a00:1450:4864:20::633]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1no44w-0004uf-Oo for pgsql-hackers@lists.postgresql.org; Mon, 09 May 2022 14:09:41 +0000 Received: by mail-ej1-x633.google.com with SMTP id j6so27038100ejc.13 for ; Mon, 09 May 2022 07:09:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec-at.20210112.gappssmtp.com; s=20210112; h=from:to:subject:mime-version:content-id:date:message-id; bh=WyYkMTArvHre+XKFbkRxrW3cdi7hGciVE9rORIpS3L8=; b=Gj9D2zbhdYfxdbA9cnaNW5wqYvmZgnDA2f9P4TPAyKO9jVFW1HPOtFoQkYBflW8UVS q3u+m7oetYNW8aNlk77rE6Ft1qjJslwE8u4lJNdcKUKzLSgoKH3ga6/miL/RFvsFJaEj vlitzB0DHEsnmKAsAi7FWXO8VUa2+HZ0VTLlR9PJpdMgeoLMwURhfpv6XKZBXnND5Iww iTlrp3cgy56BobzJD9V9NDF7Hj7daZc8vfzDvKy3n4bxQICTPMXQNwZExuo+Tz/6Rq6V OSA1AGMCmCG2mhy7//qxfeK1AU9NES+grJd3w1aqMPMe383rQTsURodv1TlWZmMX/hZj DtLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:mime-version:content-id:date :message-id; bh=WyYkMTArvHre+XKFbkRxrW3cdi7hGciVE9rORIpS3L8=; b=N3CyjXZm9+i0yFNS9FNu/j1HBrQiBc/pejaCbG7zoVqM8t/USEZUVXzXmUCwo4MBLf seFchRMDGQ8sjUmUkuYGZ7bN+2TzdS+D4XqSCsYIRJTt0TamjKIptkFS392yjPuwHFMG t/sMmKEcsXTdGYaFJkW6PHW0md+x5q9OTU/2lv85sEXeFwvy2o/0haWYDB7TjZGB0CTp EdJ6dHCapF/Cenbnhu/qUe38LiEsVBcy0KWtVmzDJppk5Zs0anu3tj4TfVIv6+ztsCP1 LZgGW5W0k3BoPHo4+G9wKP79ZkJaKF6UpgIIyLFWEpbeYG7GO8D07aJ+Yo3b/3Isu4H9 aPrw== X-Gm-Message-State: AOAM532hoaWAXmFVp3Ir1W/CT3H1DzJIVtUEN2VfRfmRUxZWUla68b2H iLLNlU+JnJsJEKs6ihNRRJk5ZpdBJcDoXA== X-Google-Smtp-Source: ABdhPJw7dw75uHCdfkRIWpJ1epGPT+vv0jCLKsR8dbno4AjETgDFEAE6hpO8/95HHCRirnrvtwh5aQ== X-Received: by 2002:a17:907:215b:b0:6f4:d91c:ef53 with SMTP id rk27-20020a170907215b00b006f4d91cef53mr14133176ejb.175.1652105376850; Mon, 09 May 2022 07:09:36 -0700 (PDT) Received: from antos (85-207-121-76.static.bluetone.cz. [85.207.121.76]) by smtp.gmail.com with ESMTPSA id cm9-20020a0564020c8900b00428148d19besm6306239edb.14.2022.05.09.07.09.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 May 2022 07:09:36 -0700 (PDT) From: Antonin Houska To: pgsql-hackers@lists.postgresql.org Subject: Privileges on PUBLICATION X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 27.2.50 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <20329.1652105397.1@antos> Date: Mon, 09 May 2022 16:09:57 +0200 Message-ID: <20330.1652105397@antos> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk Now that the user can specify rows and columns to be omitted from the logical replication [1], I suppose hiding rows and columns from the subscriber is an important use case. However, since the subscription connection user (i.e. the user specified in the CREATE SUBSCRIPTION ... CONNECTION ... command) needs SELECT permission on the replicated table (on the publication side), he can just use another publication (which has different filters or no filters at all) to get the supposedly-hidden data replicated. Don't we need privileges on publication (e.g GRANT USAGE ON PUBLICATION ...) now? [1] https://www.postgresql.org/docs/devel/sql-createpublication.html -- Antonin Houska Web: https://www.cybertec-postgresql.com