Re: Providing catalog view to pg_hba.conf file - Patch submission

pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  
help / color / mirror / Atom feed

From: Jim Nasby <Jim.Nasby@BlueTreble.com>
To: Amit Kapila <amit.kapila16@gmail.com>
Cc: Fabrízio Mello <fabriziomello@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Haribabu Kommi <kommi.haribabu@gmail.com>
Cc: Abhijit Menon-Sen <ams@2ndquadrant.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: Prabakaran, Vaishnavi <vaishnavip@fast.au.fujitsu.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Jaime Casanova <jaime@2ndquadrant.com>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch submission
Date: Fri, 30 Jan 2015 17:16:05 -0600
Message-ID: <54CC10B5.7090403@BlueTreble.com> (raw)
In-Reply-To: <CAA4eK1LYiaNvJczX4rropqm3o4YK=p_BJPYAX440Arn-FK7HEA@mail.gmail.com>
References: <F40B0968DB0A904DA78A924E633BE78645FE29@SYDEXCHTMP2.au.fjanz.com>
	<CABUevEwzKy5JR8papHw5Amk=Ok6uddYtwQ+gJntmLdrx2wOgbA@mail.gmail.com>
	<82897A1301080E4B8E461DDAA0FFCF14DDE1@SYD1216>
	<82897A1301080E4B8E461DDAA0FFCF14FD6E@SYD1216>
	<20140629165554.GA5984@toroid.org>
	<20140630070646.GY31357@toroid.org>
	<CAJrrPGe3sZWKFfsHDCJMXfBOqkf6_w6R_DpsUYn2vQK_tVeU1g@mail.gmail.com>
	<54C8156E.1080500@BlueTreble.com>
	<CAJrrPGcFk9_svvipFJeLBrVJYOmq6uNy38NsT8jtfo6Bks5RYw@mail.gmail.com>
	<CAFcNs+oOYYd5k6oE_YyE=AsW2zR0DwvBdjK2PDLQiip53Y0CiA@mail.gmail.com>
	<5661.1422473223@sss.pgh.pa.us>
	<CAFcNs+qHV_qMUxT2ebduLetzRoagMg=7Z_zk1ivQQ5s1y-ZVeQ@mail.gmail.com>
	<54CAAA34.8090302@BlueTreble.com>
	<CAA4eK1LYiaNvJczX4rropqm3o4YK=p_BJPYAX440Arn-FK7HEA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 1/29/15 9:13 PM, Amit Kapila wrote:
>  > Aside from Tom's concern about sets not being a good way to handle
> this (which I agree with), the idea of "editing" pg_hba.conf via SQL
> raises all the problems that were brought up when ALTER SYSTEM was being
> developed. One of the big problems is a question of how you can safely
> modify a text file that's full of comments and what-not. You'd need to
> address those issues if you hope to modify pg_hba.conf via SQL.
>  >
>
> I think the big problem you are mentioning can be resolved in
> a similar way as we have done for ALTER SYSTEM which is
> to have a separate file (.auto.conf) for settings done via
> ALTER SYSTEM command, do you see any major problem
> with that approach.

Yes I do. pg_hba.conf is completely depending on ordering, so there's no 
way you can simply toss another file into the mix. It's bad enough that 
we do that with postgresql.auto.conf, but at least that's a simple 
over-ride. With HBA a single ALTER SYSTEM could activate (or deactivate) 
a huge swath of pg_hba.conf. That makes for a system that's fragile, and 
since it's security related, dangerous.

I could maybe see an interface where we allowed users to perform 
line-level operations on pg_hba.conf via SQL: UPDATE line X, INSERT 
BEFORE/AFTER line X, DELETE line X. At least that would preserve the 
critical nature of rules ordering.
-- 
Jim Nasby, Data Architect, Blue Treble Consulting
Data in Trouble? Get it in Treble! http://BlueTreble.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

view thread (92+ messages)  latest in thread

Message-ID: <54CC10B5.7090403@BlueTreble.com>
Permalink:  ../54CC10B5.7090403@BlueTreble.com/
Also on:    postgresql.org/message-id/54CC10B5.7090403@BlueTreble.com

 ·

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: Jim.Nasby@BlueTreble.com, amit.kapila16@gmail.com, fabriziomello@gmail.com, tgl@sss.pgh.pa.us, kommi.haribabu@gmail.com, ams@2ndquadrant.com, vaishnavip@fast.au.fujitsu.com, magnus@hagander.net, jaime@2ndquadrant.com
  Subject: Re: Providing catalog view to pg_hba.conf file - Patch submission
  In-Reply-To: <54CC10B5.7090403@BlueTreble.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox