agora inbox for pgsql-hackers@postgresql.org
help / color / mirror / Atom feedFrom: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: shihao zhong <zhong950419@gmail.com>
Cc: Jim Jones <jim.jones@uni-muenster.de>
Cc: pgsql-hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Add a permission check to pg_stat_get_backend_subxact()
Date: Tue, 22 Sep 2026 10:03:10 +0000
Message-ID: <arJSXjs6szWXIr0H@bdtpg> (raw)
In-Reply-To: <arJJVOo1mOKvK8US@paquier.xyz>
References: <CAGRkXqTBZ+zbVuDC8xGEB6Btj61hsui5H5nGqzFBDyOXc=4bjQ@mail.gmail.com>
<ef48668c-cf8e-4f4b-bf39-4b3b9fb9b85a@uni-muenster.de>
<aqOzYr0It5sP7eFF@paquier.xyz>
<c7a0be5d-5328-41dd-a7bf-6b964e9f7a06@uni-muenster.de>
<aqSXMjhwFFzz_zyo@paquier.xyz>
<CAGRkXqRGVNvvkY7a7X=3Bn=WgfLuFZ5iVsBf+t6HSfm2RwVC+g@mail.gmail.com>
<aqec3MF_GDsMdadl@paquier.xyz>
<arD/w47Ug1GaObfq@bdtpg>
<arJJVOo1mOKvK8US@paquier.xyz>
Hi,
On Tue, Sep 22, 2026 at 06:24:36PM +0900, Michael Paquier wrote:
> On Mon, Sep 21, 2026 at 09:58:27AM +0000, Bertrand Drouvot wrote:
> > One thing I noticed while looking at this is that with stats_fetch_consistency = snapshot,
> > pgstat_fetch_stat_backend_by_pid() could validate the PID and user from one backend
> > while returning cumulative statistics cached for an older backend that used the
> > same ProcNumber.
>
> I'd slightly prefer storing a user ID, I think, because it means that
> the ACL check is done only based on the stats data, and there would be
> no cross-dependency between the data in the beentry and the stats
> data. Perhaps you have a different view or more ideas?
Yeah, storing the user ID in PgStat_Backend and using it for the ACL check
makes sense to me.
I'm not sure the user ID alone is enough though: if B reuses A's ProcNumber,
pg_stat_get_backend_wal(B_pid) could still return A's cached statistics when
the caller is allowed to see A's data.
I'd keep the PID check from 0002 as well. A generation would be more robust
against PID reuse, as done for example for AIO handles, but introducing a
backend generation seems like too much for this case.
So storing both seems like the simplest approach: the user ID for the ACL
check and the PID for matching the statistics to the requested backend.
Thoughts?
Regards,
--
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
view thread (21+ messages) latest in thread
Message-ID: <arJSXjs6szWXIr0H@bdtpg>
Permalink: ../arJSXjs6szWXIr0H@bdtpg/
Also on: postgresql.org/message-id/arJSXjs6szWXIr0H@bdtpg
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bertranddrouvot.pg@gmail.com, michael@paquier.xyz, zhong950419@gmail.com, jim.jones@uni-muenster.de, pgsql-hackers@lists.postgresql.org
Subject: Re: Add a permission check to pg_stat_get_backend_subxact()
In-Reply-To: <arJSXjs6szWXIr0H@bdtpg>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox