Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
Subject: Re: running logical replication as the subscription owner
From: Mark Dilger <mark.dilger@enterprisedb.com>
In-Reply-To: <CA+TgmoaE35kKS3-zSvGiZszXP9Tb9rNfYzT=+fO8Ehk5EDKrag@mail.gmail.com>
Date: Fri, 24 Mar 2023 09:58:57 -0700
Cc: Jeff Davis <pgsql@j-davis.com>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
 Andres Freund <andres@anarazel.de>,
 Noah Misch <noah@leadboat.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <AF8607E7-A303-4ACD-A749-8ACF122751EA@enterprisedb.com>
References: <CA+TgmoaSCkg9ww9oppPqqs+9RVqCexYCE6Aq=UsYPfnOoDeFkw@mail.gmail.com>
 <68d5974b80e54672b59ff13e59d046c1e982fcd8.camel@j-davis.com>
 <CA+TgmoaE35kKS3-zSvGiZszXP9Tb9rNfYzT=+fO8Ehk5EDKrag@mail.gmail.com>
To: Robert Haas <robertmhaas@gmail.com>
Archived-At: <https://www.postgresql.org/message-id/AF8607E7-A303-4ACD-A749-8ACF122751EA%40enterprisedb.com>
Precedence: bulk


> On Mar 24, 2023, at 7:00 AM, Robert Haas <robertmhaas@gmail.com> =
wrote:
>=20
> More generally, Stephen Frost has elsewhere argued that we should want
> the subscription owner to be a very low-privilege user, so that if
> their privileges get stolen, it's no big deal. I disagree with that. I
> think it's always a problem if one user can get unauthorized access to
> another user's account, regardless of exactly what those accounts can
> do. I think our goal should be to make it safe for the subscription
> owner to be a very high-privilege user, because you're going to need
> to be a very high-privilege user to set up replication. And if you do
> have that level of privilege, it's more convenient and simpler if you
> can just own the subscription yourself, rather than having to make a
> dummy account to own it. To put that another way, I think that what
> people are going to want to do in a lot of cases is have the superuser
> own the subscription, so I think we need to make that case safe,
> whatever it takes.

I also think the subscription owner should be a low-privileged user, =
owing to the risk of the publisher injecting malicious content into the =
publication.  I think you are focused on all the bad actors on the =
subscription-side database and what they can do to each other.  That's =
also valid, but I get the impression that you're losing sight of the =
risk posed by malicious publishers.  Or maybe you aren't, and can =
explain?

=E2=80=94
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company