From: Merlin Moncure <mmoncure@gmail.com>
To: Roberts, Jon <Jon.Roberts@asurion.com>
Cc: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Trevor Talbot <quension@gmail.com>
Cc: Joshua D. Drake <jd@commandprompt.com>
Cc: Kris Jurka <books@ejurka.com>
Cc: Jonah H. Harris <jonah.harris@gmail.com>
Cc: Bill Moran <wmoran@collaborativefusion.com>
Cc: pgsql-performance@postgresql.org
Subject: Re: viewing source code
Date: Thu, 20 Dec 2007 09:30:07 -0500
Message-ID: <b42b73150712200630k5b53ded7o45bbd86798906174@mail.gmail.com> (raw)
In-Reply-To: <1A6E6D554222284AB25ABE3229A92762112A42@nrtexcus702.int.asurion.com>
References: <1A6E6D554222284AB25ABE3229A92762112A42@nrtexcus702.int.asurion.com>
On Dec 20, 2007 9:07 AM, Roberts, Jon <Jon.Roberts@asurion.com> wrote:
> So your suggestion is first to come up with a query that dynamically checks
> permissions and create a view for it. Secondly, change pgAdmin to reference
> this view in place of pg_proc. Actually, it should be extended to all
This solution will not work. It requires cooperation from pgAdmin
which is not going to happen and does nothing about psql or direct
queries from within pgadmin. Considered from a security/obfuscation
perspective, its completely ineffective. As I've said many times,
there are only two solutions to this problem:
1. disable permissions to pg_proc and deal with the side effects
(mainly, pgadmin being broken).
2. wrap procedure languages in encrypted handler (pl/pgsql_s) so that
the procedure code is encrypted in pg_proc. this is an ideal
solution, but the most work.
merlin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: mmoncure@gmail.com, Jon.Roberts@asurion.com, alvherre@commandprompt.com, quension@gmail.com, jd@commandprompt.com, books@ejurka.com, jonah.harris@gmail.com, wmoran@collaborativefusion.com
Subject: Re: viewing source code
In-Reply-To: <b42b73150712200630k5b53ded7o45bbd86798906174@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox