Re: Information of pg_stat_ssl visible to all users - Mailing list pgsql-hackers

From Stephen Frost
Subject Re: Information of pg_stat_ssl visible to all users
Date
Msg-id 20150706134850.GM12131@tamriel.snowman.net
Whole thread Raw
In response to Re: Information of pg_stat_ssl visible to all users  (Magnus Hagander <magnus@hagander.net>)
List pgsql-hackers
* Magnus Hagander (magnus@hagander.net) wrote:
> On Thu, Jul 2, 2015 at 10:06 PM, Andres Freund <andres@anarazel.de> wrote:
>
> > On 2015-07-02 16:52:01 -0300, Alvaro Herrera wrote:
> > > If there's interest in closing these holes, this might be a first
> >
> > I don't think such an isolated attempt buys us anything except maybe
> > unsatisfied users.
> >
> > I can see a benefit in allowing to restrict information about users and
> > such in other clusters, but changing stat_ssl seeems to be an
> > inconsequentially small problem on that path.
>
>
> We discussed earlier having a "monitoring" role or attribute or something
> like that, and I think this would be another case of that. We definitely
> want to go towards something like that, but that's not happening in 9.5...

Agreed, but if we make this visible to all in 9.5 then we're going to
have a tough time restricting it to just the monitoring role in 9.6, I'm
afraid...

We realize it's a problem, for my 2c, I'd rather not double-down on it
by providing more information which should really be limited to
privileged users.
Thanks,
    Stephen

pgsql-hackers by date:

Previous
From: Jan de Visser
Date:
Subject: Re: Idea: closing the loop for "pg_ctl reload"
Next
From: Stephen Frost
Date:
Subject: Re: [PATCH v1] GSSAPI encryption support