From: Bossart, Nathan <bossartn@amazon.com>
To: Bharath Rupireddy <bharath.rupireddyforpostgres@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Jeff Davis <pgsql@j-davis.com>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: Allow pg_signal_backend members to use pg_log_backend_memory_stats().
Date: Mon, 25 Oct 2021 16:15:20 +0000
Message-ID: <5B3B3232-14FC-4A90-84BD-4ABA78D2898B@amazon.com> (raw)
In-Reply-To: <CALj2ACX873E4yEO-ef82EVSRy1QcW0PFu3UmEA46Ccyhr7xdPg@mail.gmail.com>
References: <e5cf6684d17c8d1ef4904ae248605ccd6da03e72.camel@j-davis.com>
<33F34F0C-BB16-48DE-B125-95D340A54AE8@amazon.com>
<d87b3a4fa3dacb103a8f3f50751ec9e638b2e2b1.camel@j-davis.com>
<20211025.115333.563958443822411952.horikyota.ntt@gmail.com>
<ab46bf8a5158d27cdbb6901f49a6e38dd23e619e.camel@j-davis.com>
<YXZYVw7JF0mNtPue@paquier.xyz>
<CALj2ACX873E4yEO-ef82EVSRy1QcW0PFu3UmEA46Ccyhr7xdPg@mail.gmail.com>
On 10/25/21, 2:21 AM, "Bharath Rupireddy" <bharath.rupireddyforpostgres@gmail.com> wrote:
> On Mon, Oct 25, 2021 at 12:40 PM Michael Paquier <michael@paquier.xyz> wrote:
>> Hmm. Why don't you split the patch into two parts that can be
>> discussed separately then? There would be one to remove all the
>> superuser() checks you can think of, and a potential second to grant
>> those function's execution to some system role.
>
> IMO, in this thread we can focus on remvong the
> pg_log_backend_memory_contexts()'s superuser() check and +1 to start a
> separate thread to remove superuser() checks for the other functions
> and REVOKE the permissions in appropriate places, for system functins
> system_functions.sql files, for extension functions, the extension
> installation .sql files. See [1] and [2].
I like the general idea of removing hard-coded superuser checks first
and granting execution to predefined roles second. I don't have any
strong opinion about what should be done in this thread and what
should be done elsewhere.
Nathan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bossartn@amazon.com, bharath.rupireddyforpostgres@gmail.com, michael@paquier.xyz, pgsql@j-davis.com, horikyota.ntt@gmail.com
Subject: Re: Allow pg_signal_backend members to use pg_log_backend_memory_stats().
In-Reply-To: <5B3B3232-14FC-4A90-84BD-4ABA78D2898B@amazon.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox