Subject: [Pljava-dev] Re: PL Java Security (sqlj / owner postgres)
Date: Sun, 06 Feb 2005 19:34:17 +0100
Message-ID: <thhal-0rvvhAnsHxicVXA4ct4CXP2LxR71l4D@mailblocks.com> (raw)
In-Reply-To: <7f8505697a91bdeed3b0889c17f2000e@cnet.pha.comstar.cz>
References: <7f8505697a91bdeed3b0889c17f2000e@cnet.pha.comstar.cz>
<42066329.7000004@mailblocks.com>
<thhal-0rfvhAnkHxiclI3SmP3fez3YF6Iga7U@mailblocks.com>
Ing. Filip Hrbek wrote:
>
> > Filip,
> > > SQLJ Schema security:
> > > -----------------------------------
> > > The SQLJ schema is authorized to user postgres.
> > >
> > Why? In my installation, I don\'t have a postgres user. Is
> \"postgres\" a
> > non-superuser in your setup?
>
> Yes, you are right. There is no reason to have a \"postgres\" user. I
> am just used to have it as a default (and the only) superuser.
>
> I wrote the \"checkIfConnectedAsSuperuser\" method in the source (I
> can see it already in CVS :-), this check should be sufficient. The
> SQLJ schema and its object can be owned by another supersuser who is
> deploying pl/Java, not only by the default \"postgres\" user. The only
> important thing is that the SQLJ objects owner has the superuser flag
> \"on\".
Ok, great. I removed the use of "postgres" user. I also added so that
only user that have CREATE permissions on a schema can do set_classpath
on that schema. I added a note about security inthe userguide.html.
- thomas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pljava-dev@postgresql.org
Subject: Re: [Pljava-dev] Re: PL Java Security (sqlj / owner postgres)
In-Reply-To: <thhal-0rvvhAnsHxicVXA4ct4CXP2LxR71l4D@mailblocks.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox