Re: Two-phase commit security restrictions - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Two-phase commit security restrictions
Date
Msg-id 15495.1097685302@sss.pgh.pa.us
Whole thread Raw
In response to Two-phase commit security restrictions  (Heikki Linnakangas <hlinnaka@iki.fi>)
List pgsql-hackers
Heikki Linnakangas <hlinnaka@iki.fi> writes:
> What kind of security restrictions do we want for prepared transactions? 
> Who has the right to finish a transaction that was started by user A? At 
> least the original user, I suppose, but who else?

I would say the original user, any superuser, and nobody else.  This
conforms to Postgres' usual practices (compare to the right to DROP
an object).

> Do we need a "GRANT TRANSACTION" command to give permission to finish 2PC 
> transcations?

Overkill.

> Another approach I've been thinking about is to allow anyone that knows 
> the (user-supplied) global transaction identifier to finish the 
> transaction, and hide the gids of running transactions from regular users. 

Security-by-obscurity isn't really security, and I think that hiding the
GIDs is likely to make things noticeably more painful to manage.
        regards, tom lane


pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Why we still see some reports of "could not access transaction status"
Next
From: David Garamond
Date:
Subject: Re: Two-phase commit security restrictions