From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: Joshua D. Drake <jd@commandprompt.com>
Cc: Bill Moran <wmoran@collaborativefusion.com>
Cc: Roberts, Jon <Jon.Roberts@asurion.com>
Cc: 'pgsql-performance@postgresql.org' <pgsql-performance@postgresql.org>
Subject: Re: viewing source code
Date: Fri, 14 Dec 2007 14:11:27 -0300
Message-ID: <20071214171127.GE6269@alvh.no-ip.org> (raw)
In-Reply-To: <20071214090433.08f241c1@commandprompt.com>
References: <1A6E6D554222284AB25ABE3229A927621129EC@nrtexcus702.int.asurion.com>
<20071214111849.b8788ce4.wmoran@collaborativefusion.com>
<20071214090433.08f241c1@commandprompt.com>
Joshua D. Drake wrote:
> > > However, in the current configuration, all users with permission to
> > > log in can see all source code. They don't have rights to execute
> > > the functions but they can see the source code for them. Shouldn't
> > > I be able to revoke both the ability to execute and the ability to
> > > see functions?
>
> Yes and know. If your functions are interpreted then no, I don't see
> any reason for this feature, e.g; python,perl,plpgsql,sql,ruby. I can
> read them on disk anyway.
If you have access to the files, which is not necessarily the case.
Random users, in particular, won't.
Maybe this can be done by revoking privileges to pg_proc. I am sure it
can be made to work. It does work for pg_auth_id, and nobody says that
"they can read the passwords from disk anyway."
--
Alvaro Herrera Developer, http://www.PostgreSQL.org/
"We're here to devour each other alive" (Hobbes)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: alvherre@alvh.no-ip.org, jd@commandprompt.com, wmoran@collaborativefusion.com, Jon.Roberts@asurion.com
Subject: Re: viewing source code
In-Reply-To: <20071214171127.GE6269@alvh.no-ip.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox