From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Dave Page <dpage@pgadmin.org>
To: Robert Haas <robertmhaas@gmail.com>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Monitoring roles patch
Date: Wed, 22 Mar 2017 08:55:07 -0400
Message-ID: <c99cde7f-0aa7-ebaa-b9f4-ee75522554a4@2ndquadrant.com> (raw)
In-Reply-To: <CA+OCxox9c9-1=bXxA6-gr-iWZbD5zdHYMz=cpC034RKB7zX40Q@mail.gmail.com>
References: <CA+OCxoyRdsc1xyLfF9s698gUGyPXBs4CvJ+0Gwo8U65NmYJ7pw@mail.gmail.com>
<CA+TgmobveXzVPytFOO3AkmsM+Y=YEG+UXcCvgwAt+SgYj85OCA@mail.gmail.com>
<CA+OCxox9c9-1=bXxA6-gr-iWZbD5zdHYMz=cpC034RKB7zX40Q@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 3/22/17 07:48, Dave Page wrote:
> With the patch, complex monitoring systems can easily be setup with
> something like:
>
> CREATE ROLE monitoring_user LOGIN;
> GRANT pg_monitor TO monitoring_role;
That assumes that we have thought of all the ways in which people might
want to monitor things.
If we do it via GRANTs instead, then users can easily extend it.
If we instead change the hardcoded superuser checks to hardcoded
some-other-role checks, then the whole system instantly becomes unusable
the moment someone wants to monitor something we haven't thought of.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com, dpage@pgadmin.org, robertmhaas@gmail.com
Subject: Re: Monitoring roles patch
In-Reply-To: <c99cde7f-0aa7-ebaa-b9f4-ee75522554a4@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox