From: Antonin Houska <ah@cybertec.at>
To: Amit Kapila <amit.kapila16@gmail.com>
cc: Euler Taveira <euler@eulerto.com>,
    PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Privileges on PUBLICATION
In-reply-to: 
 <CAA4eK1Lya6BoMa1m8cTZrQ8KvABQpn3EsHDKRurz8UJeHsGnZw@mail.gmail.com>
References: <20330.1652105397@antos>
 <8a00e0e1-dc4e-422c-9dcf-664b16b18625@www.fastmail.com>
 <CAA4eK1Lya6BoMa1m8cTZrQ8KvABQpn3EsHDKRurz8UJeHsGnZw@mail.gmail.com>
Comments: In-reply-to Amit Kapila <amit.kapila16@gmail.com>
   message dated "Tue, 10 May 2022 09:19:48 +0530."
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2809.1652171844.1@antos>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 10 May 2022 10:37:24 +0200
Message-ID: <2810.1652171844@antos>
Archived-At: <https://www.postgresql.org/message-id/2810.1652171844%40antos>
Precedence: bulk

Amit Kapila <amit.kapila16@gmail.com> wrote:

> On Tue, May 10, 2022 at 12:16 AM Euler Taveira <euler@eulerto.com> wrote=
:
> >
> > On Mon, May 9, 2022, at 11:09 AM, Antonin Houska wrote:
> >
> > Now that the user can specify rows and columns to be omitted from the =
logical
> > replication [1], I suppose hiding rows and columns from the subscriber=
 is an
> > important use case. However, since the subscription connection user (i=
.e. the
> > user specified in the CREATE SUBSCRIPTION ... CONNECTION ... command) =
needs
> > SELECT permission on the replicated table (on the publication side), h=
e can
> > just use another publication (which has different filters or no filter=
s at
> > all) to get the supposedly-hidden data replicated.
> >
> > The required privileges were not relaxed on publisher after the row fi=
lter and
> > column list features. It is not just to "create another publication". =
Create
> > publications require CREATE privilege on databases (that is *not* gran=
ted to
> > PUBLIC).If you have an untrusted user that could bypass your rules abo=
ut hidden
> > data, it is better to review your user privileges.
> >
> =

> Also, to create a subscription (which combines multiple publications
> to bypass rules), a user must be a superuser. So, isn't that a
> sufficient guarantee that users shouldn't be able to bypass such
> rules?

My understanding is that the rows/columns filtering is a way for the
*publisher* to control which data is available to particular replica. From
this point of view, the publication privileges would just make the control
complete.

-- =

Antonin Houska
Web: https://www.cybertec-postgresql.com