Message-ID: <54F2376E.9080501@gmx.net>
Date: Sat, 28 Feb 2015 16:47:26 -0500
From: Peter Eisentraut <peter_e@gmx.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Stephen Frost <sfrost@snowman.net>
CC: Adam Brightwell <adam.brightwell@crunchydatasolutions.com>,
 Noah Misch <noah@leadboat.com>, Tom Lane <tgl@sss.pgh.pa.us>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: CATUPDATE confusion?
References: <20141227080926.GA2035611@tornado.leadboat.com>
 <20141227151034.GU3062@tamriel.snowman.net> <28382.1419703324@sss.pgh.pa.us>
 <20141227231829.GX3062@tamriel.snowman.net> <1952.1419722762@sss.pgh.pa.us>
 <20141227233150.GA2046947@tornado.leadboat.com>
 <CAKRt6CTrOf6w5sE5GDRQAJ+JQrfK4h8VM=jVCtiGC+mdFsmXGg@mail.gmail.com>
 <54E65000.8030304@gmx.net> <20150225203955.GY29780@tamriel.snowman.net>
 <54EE8C6E.8090506@gmx.net> <20150226030541.GG29780@tamriel.snowman.net>
In-Reply-To: <20150226030541.GG29780@tamriel.snowman.net>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 2/25/15 10:05 PM, Stephen Frost wrote:
> * Peter Eisentraut (peter_e@gmx.net) wrote:
>> On 2/25/15 3:39 PM, Stephen Frost wrote:
>>>> I'd get rid of that whole check, not just replace rolcatupdate by rolsuper.
>>>
>>> Err, wouldn't this make it possible to grant normal users the ability to
>>> modify system catalogs?  I realize that they wouldn't have that
>>> initially, but I'm not sure we want the superuser to be able to grant
>>> that to non-superusers..
>>
>> Why not?  I thought we are trying to get rid of special superuser behavior.
> 
> Agreed, but I'd also like to get rid of any reason, beyond emergency
> cases, for people to modify the catalog directly.  There's a few places
> which we aren't yet doing that, but I'd rather fix those cases than
> encourage people to give out rights to modify them and end up making
> things like:
> 
> "UPDATE pg_database SET datallowconn = false where datname = 'xyz';"
> 
> an accepted interface.

I'm not sure those things are related.

Getting rid of the *reasons* for updating catalogs directly might be
worthwhile, but I don't see why we need to install (or maintain) a
special invisible permission trap for it.  We have a permission system,
and it works pretty well.

The Unix kernels don't have special traps for someone to modify
/etc/shadow or similar directly.  That file has appropriate permissions,
and that's it.  I think that works pretty well.


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers