From: Bill Moran <wmoran@collaborativefusion.com>
To: Roberts, Jon <Jon.Roberts@asurion.com>
Cc: 'pgsql-performance@postgresql.org' <pgsql-performance@postgresql.org>
Subject: Re: viewing source code
Date: Fri, 14 Dec 2007 10:25:26 -0500
Message-ID: <20071214102526.2bc08bc4.wmoran@collaborativefusion.com> (raw)
In-Reply-To: <1A6E6D554222284AB25ABE3229A927621129EA@nrtexcus702.int.asurion.com>
References: <1A6E6D554222284AB25ABE3229A927621129EA@nrtexcus702.int.asurion.com>
In response to "Roberts, Jon" <Jon.Roberts@asurion.com>:
> Is it possible yet in PostgreSQL to hide the source code of functions from
> users based on role membership? I would like to avoid converting the code
> to C to secure the source code and I don't want it obfuscated either.
>
> In an ideal world, if a user can't modify a function, he/she shouldn't be
> able to see the source code. If the user can execute the function, then the
> user should be able to see the signature of the function but not the body.
I doubt that's going to happen. Mainly because I disagree completely
with your ideal world description (any user who can execute a function
should have the right to examine it to see what it actually does).
I suspect that others would agree with me, the result being that there's
no universally-agreed-on approach. As a result, what _really_ needs to
be done is an extra permission bit added to functions so administrators
can control who can view the function body.
--
Bill Moran
Collaborative Fusion Inc.
http://people.collaborativefusion.com/~wmoran/
wmoran@collaborativefusion.com
Phone: 412-422-3463x4023
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: wmoran@collaborativefusion.com, Jon.Roberts@asurion.com
Subject: Re: viewing source code
In-Reply-To: <20071214102526.2bc08bc4.wmoran@collaborativefusion.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox