Heikki Linnakangas <hlinnaka@iki.fi> writes:
> What kind of security restrictions do we want for prepared transactions?
> Who has the right to finish a transaction that was started by user A? At
> least the original user, I suppose, but who else?
I would say the original user, any superuser, and nobody else. This
conforms to Postgres' usual practices (compare to the right to DROP
an object).
> Do we need a "GRANT TRANSACTION" command to give permission to finish 2PC
> transcations?
Overkill.
> Another approach I've been thinking about is to allow anyone that knows
> the (user-supplied) global transaction identifier to finish the
> transaction, and hide the gids of running transactions from regular users.
Security-by-obscurity isn't really security, and I think that hiding the
GIDs is likely to make things noticeably more painful to manage.
regards, tom lane
