Re: Security implications of config-file-location patch - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Security implications of config-file-location patch
Date
Msg-id 12127.1097245128@sss.pgh.pa.us
Whole thread Raw
In response to Re: Security implications of config-file-location patch  ("Zeugswetter Andreas DAZ SD" <ZeugswetterA@spardat.at>)
List pgsql-hackers
"Zeugswetter Andreas DAZ SD" <ZeugswetterA@spardat.at> writes:
>> Good point.  Should we obscure pg_tablespace similarly to 
>> what we do for pg_shadow?

> Hmm, I can not see how a person with file access could not easily find the 
> file for a specific table without pg_tablespace anyway (since oid names will 
> be quite unique). Without file access, what malicious act is he going to do 
> with that info ? 

> I think hiding that info would not really be safer, thus not worth it.

Do you also feel that there's no need to hide the values of the GUC
variables pgdata etc?
        regards, tom lane


pgsql-hackers by date:

Previous
From: Euler Taveira de Oliveira
Date:
Subject: Re: initdb crash
Next
From: Bruce Momjian
Date:
Subject: Problem with CIDR data type restrictions