Received: from localhost (unknown [200.46.204.182]) by postgresql.org (Postfix) with ESMTP id 3EBE42E3A32 for ; Thu, 20 Dec 2007 10:30:18 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.182]) (amavisd-maia, port 10024) with ESMTP id 48017-07 for ; Thu, 20 Dec 2007 10:30:06 -0400 (AST) Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.185]) by postgresql.org (Postfix) with ESMTP id 426062E34CD for ; Thu, 20 Dec 2007 10:30:09 -0400 (AST) Received: by nf-out-0910.google.com with SMTP id f5so1547754nfh.23 for ; Thu, 20 Dec 2007 06:30:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=aivevkN5JXGFes6p7/HnxMxuUHELr4w1qe4D3gqfoqs=; b=k9H8L1rNZVrq1RvsP7cTTEFCWI6ZwUcbM99wb5MftEJNTbNSol0+O0kLwQ65a5ssNbF2XjOWVvM9ke2MMxfi37H1ZwM0RZbLIdmZ6b/2ZhU652Syn3J7RUxavoeAUQGdCs27iON+LyVLAPjm10Ewpw8N9dPFs5NkLfKiymchgeU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ljXv4CQxOJRZPWrRABRLEgeqtDqCUtyNItv4ogmaAepQ0ueHh92R9hz1Fc75hjBg+X8ZcP+4VbG6CtM7+ew2PEWrLSdWpu9iDE1W4CldGIKF65v03e9lyYcpXg+TU7xw3ngr7iBZsY4YYOpKXAaDrbgJxi7RncAN7KU3X9NNHhA= Received: by 10.78.145.14 with SMTP id s14mr61764hud.58.1198161007077; Thu, 20 Dec 2007 06:30:07 -0800 (PST) Received: by 10.78.18.2 with HTTP; Thu, 20 Dec 2007 06:30:07 -0800 (PST) Message-ID: Date: Thu, 20 Dec 2007 09:30:07 -0500 From: "Merlin Moncure" To: "Roberts, Jon" Subject: Re: viewing source code Cc: "Alvaro Herrera" , "Trevor Talbot" , "Joshua D. Drake" , "Kris Jurka" , "Jonah H. Harris" , "Bill Moran" , pgsql-performance@postgresql.org In-Reply-To: <1A6E6D554222284AB25ABE3229A92762112A42@nrtexcus702.int.asurion.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <1A6E6D554222284AB25ABE3229A92762112A42@nrtexcus702.int.asurion.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200712/307 X-Sequence-Number: 28123 On Dec 20, 2007 9:07 AM, Roberts, Jon wrote: > So your suggestion is first to come up with a query that dynamically checks > permissions and create a view for it. Secondly, change pgAdmin to reference > this view in place of pg_proc. Actually, it should be extended to all This solution will not work. It requires cooperation from pgAdmin which is not going to happen and does nothing about psql or direct queries from within pgadmin. Considered from a security/obfuscation perspective, its completely ineffective. As I've said many times, there are only two solutions to this problem: 1. disable permissions to pg_proc and deal with the side effects (mainly, pgadmin being broken). 2. wrap procedure languages in encrypted handler (pl/pgsql_s) so that the procedure code is encrypted in pg_proc. this is an ideal solution, but the most work. merlin