public inbox for [email protected]
help / color / mirror / Atom feedFrom: Mark Dilger <[email protected]>
To: Robert Haas <[email protected]>
Cc: Amit Kapila <[email protected]>
Cc: Jeff Davis <[email protected]>
Cc: Andrew Dunstan <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Subject: Re: Non-superuser subscription owners
Date: Thu, 9 Dec 2021 09:48:59 -0800
Message-ID: <[email protected]> (raw)
In-Reply-To: <CA+TgmoZtUVsECkAHMkkBTcupmWQL+dqJSSU3kC4ikynyWZmuhQ@mail.gmail.com>
References: <[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CAA4eK1KHE_xmxk==CqTcTzceC_n00tRWBLm3DGUWhaaPTguz3A@mail.gmail.com>
<[email protected]>
<CAA4eK1LBjtqHH2h4TO7FHG=FJRfygfkeEb7AFj-dh6rqg3xqUA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<CAA4eK1KnEptxtJTzo9LNb2VgRBYcBWxY+NSx2hJR8iUM8JXktw@mail.gmail.com>
<[email protected]>
<CAA4eK1K1=DbXCNfA32urxZga6YxeiCvcTHvJu-+BtLCtVgqJ2w@mail.gmail.com>
<[email protected]>
<CAA4eK1JJsBzJsStA_LYrJu0WmOG+tWXcS9G4mY1G4CsQVBcaQw@mail.gmail.com>
<[email protected]>
<CAA4eK1K9ghq8GxWMwN6=yKXTRJz7xbws+s2HiuyTV0oPokFTnQ@mail.gmail.com>
<[email protected]>
<CAA4eK1JP+361o0QW8SP_hF3=DJatwqH+ECVk=HTsctqoTJzh6Q@mail.gmail.com>
<[email protected]>
<CAA4eK1Jh2xSMvZWzqNxjduyRoExHAL4c7ZVeESYdPHJxcqo8Bw@mail.gmail.com>
<[email protected]>
<CAA4eK1KdsoVCpregR8BymGfwhp38WnnX5hP-ZLdynZS78E2ZRQ@mail.gmail.com>
<[email protected]>
<CAA4eK1LBu2kw87dVDJrYY7DXD=_gYqCU17Qa-YsdMwUbw=BAEQ@mail.gmail.com>
<CA+TgmoZtUVsECkAHMkkBTcupmWQL+dqJSSU3kC4ikynyWZmuhQ@mail.gmail.com>
> On Dec 9, 2021, at 7:47 AM, Robert Haas <[email protected]> wrote:
>
> 1 and 2B seem to require changing the same code, or related code. 1A
> seems to require a completely different set of changes. If I'm right
> about that, it seems like a good reason for doing 1+2B first and
> leaving 2A for a separate patch.
There are unresolved problems with 2A and 3 which were discussed upthread. I don't want to include fixes for them in this patch, as it greatly expands the scope of this patch, and is a logically separate effort. We can come back to those problems after this first patch is committed.
Specifically, a non-superuser owner can perform ALTER SUBSCRIPTION and do things that are morally equivalent to creating a new subscription. This is problematic where things like the connection string are concerned, because it means the non-superuser owner can connect out to entirely different servers, without any access control checks to make sure the owner should be able to connect to these servers.
This problem already exists, right now. I'm not fixing it in this first patch, but I'm also not making it any worse.
The solution Jeff Davis proposed seems right to me. We change subscriptions to use a foreign server rather than a freeform connection string. When creating or altering a subscription, the role performing the action must have privileges on any foreign server they use.
—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
view thread (68+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: Re: Non-superuser subscription owners
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox