Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
Subject: Re: Non-superuser subscription owners
From: Mark Dilger <mark.dilger@enterprisedb.com>
In-Reply-To: <aa28945f9f348307c8ac833a937b5fca732668b8.camel@j-davis.com>
Date: Wed, 17 Nov 2021 07:44:27 -0800
Cc: Andrew Dunstan <andrew@dunslane.net>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>,
 Robert Haas <robertmhaas@gmail.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <6A2B0FF6-CC86-48CE-B0D3-5401AA5CFEA9@enterprisedb.com>
References: <9DFC88D3-1300-4DE8-ACBC-4CEF84399A53@enterprisedb.com>
 <c1c334a2-5d85-687f-f0dc-0ac8c422ca1a@dunslane.net>
 <CD02D159-7260-4247-888F-2CFA7AD3798D@enterprisedb.com>
 <6BB4451E-7B1B-474C-BD1F-DB7531E720C6@enterprisedb.com>
 <aa28945f9f348307c8ac833a937b5fca732668b8.camel@j-davis.com>
To: Jeff Davis <pgsql@j-davis.com>
Archived-At: 
 <https://www.postgresql.org/message-id/6A2B0FF6-CC86-48CE-B0D3-5401AA5CFEA9%40enterprisedb.com>
Precedence: bulk


> On Nov 16, 2021, at 8:11 PM, Jeff Davis <pgsql@j-davis.com> wrote:
>=20
> On Wed, 2021-11-03 at 12:50 -0700, Mark Dilger wrote:
>> The first two patches are virtually unchanged.  The third updates the
>> behavior of the apply workers, and updates the documentation to
>> match.
>=20
> v2-0001 corrects some surprises, but may create others. Why is =
renaming
> allowed, but not changing the options? What if we add new options, and
> some of them seem benign for a non-superuser to change?

The patch cannot anticipate which logical replication options may be =
added to the project in some later commit.  We can let that commit =
adjust the behavior to allow the option if we agree it is sensible for =
non-superusers to do so.

> The commit message part of the patch says that it's to prevent non-
> superusers from being able to (effectively) create subscriptions, but
> don't we want privileged non-superusers to be able to create
> subscriptions?

Perhaps, but I don't think merely owning a subscription should entitle a =
role to create new subscriptions.  Administrators may quite =
intentionally create low-power users, ones without access to anything =
but a single table, or a single schema, as a means of restricting the =
damage that a subscription might do (or more precisely, what the =
publisher might do via the subscription.)  It would be surprising if =
that low-power user was then able to recreate the subscription into =
something different.

We should probably come back to this topic in a different patch, perhaps =
a patch that introduces a new pg_manage_subscriptions role or such.

=E2=80=94
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company