From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: restrict pg_stat_ssl to superuser?
Date: Fri, 15 Feb 2019 14:04:59 +0100
Message-ID: <71319f2d-a073-0499-4562-6003e026307e@2ndquadrant.com> (raw)
In-Reply-To: <20190212064007.GN1475@paquier.xyz>
References: <63117976-d02c-c8e2-3aef-caa31a5ab8d3@2ndquadrant.com>
<20190212064007.GN1475@paquier.xyz>
On 2019-02-12 07:40, Michael Paquier wrote:
> On Thu, Feb 07, 2019 at 09:30:38AM +0100, Peter Eisentraut wrote:
>> If so, is there anything in that view that should be made available to
>> non-superusers? If not, then we could perhaps do this via a simple
>> permission change instead of going the route of blanking out individual
>> columns.
>
> Hm. It looks sensible to move to a per-permission approach for that
> view. Now, pg_stat_get_activity() is not really actually restricted,
> and would still return the information on direct calls, so the idea
> would be to split the SSL-related data into its own function?
We could remove default privileges from pg_stat_get_activity(). Would
that be a problem?
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com, michael@paquier.xyz
Subject: Re: restrict pg_stat_ssl to superuser?
In-Reply-To: <71319f2d-a073-0499-4562-6003e026307e@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox