public inbox for [email protected]
help / color / mirror / Atom feedFrom: Pavlo Golub <[email protected]>
To: pgsql-hackers <[email protected]>
Subject: [PATCH] allow pg_current_logfile() execution under pg_monitor role
Date: Fri, 9 Feb 2024 16:01:58 +0100
Message-ID: <CAK7ymcLmEYWyQkiCZ64WC-HCzXAB0omM=Ypj9B3rXe8vUAFMqw@mail.gmail.com> (raw)
Hello,
The patch attached fixes an oversight/inconsistency of disallowing the
pg_monitor system role to execute pg_current_logfile([text]).
pgwatch3=# create user joe;
CREATE ROLE
pgwatch3=# set role joe;
SET
pgwatch3=> select pg_current_logfile();
ERROR: permission denied for function pg_current_logfile
pgwatch3=> reset role;
RESET
pgwatch3=# grant pg_monitor to joe;
GRANT ROLE
pgwatch3=# set role joe;
SET
pgwatch3=> select pg_current_logfile();
ERROR: permission denied for function pg_current_logfile
pgwatch3=> select * FROM pg_ls_logdir();
name | size | modification
----------------------------------+----------+------------------------
postgresql-2024-02-08_130906.log | 652 | 2024-02-08 13:10:04+01
(5 rows)
Best regards,
Pavlo Golub
Attachments:
[application/octet-stream] 0001-allow-pg_current_logfile-execution-under-pg_monitor-.patch (960B, ../CAK7ymcLmEYWyQkiCZ64WC-HCzXAB0omM=Ypj9B3rXe8vUAFMqw@mail.gmail.com/3-0001-allow-pg_current_logfile-execution-under-pg_monitor-.patch)
download | inline diff:
From 9142cfd2c9c7a21a7b73a4c85ff662dade3c41e2 Mon Sep 17 00:00:00 2001
From: Pavlo Golub <[email protected]>
Date: Fri, 9 Feb 2024 15:42:43 +0100
Subject: [PATCH] allow pg_current_logfile() execution under pg_monitor role
---
src/backend/catalog/system_functions.sql | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/backend/catalog/system_functions.sql b/src/backend/catalog/system_functions.sql
index 346cfb98a0..37b8977670 100644
--- a/src/backend/catalog/system_functions.sql
+++ b/src/backend/catalog/system_functions.sql
@@ -761,6 +761,10 @@ REVOKE EXECUTE ON FUNCTION pg_ls_replslotdir(text) FROM PUBLIC;
-- We also set up some things as accessible to standard roles.
--
+GRANT EXECUTE ON FUNCTION pg_current_logfile() TO pg_monitor;
+
+GRANT EXECUTE ON FUNCTION pg_current_logfile(text) TO pg_monitor;
+
GRANT EXECUTE ON FUNCTION pg_ls_logdir() TO pg_monitor;
GRANT EXECUTE ON FUNCTION pg_ls_waldir() TO pg_monitor;
--
2.34.1
view thread (2+ messages)
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected]
Subject: Re: [PATCH] allow pg_current_logfile() execution under pg_monitor role
In-Reply-To: <CAK7ymcLmEYWyQkiCZ64WC-HCzXAB0omM=Ypj9B3rXe8vUAFMqw@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox