Re: [HACKERS] logical replication access control patches - Mailing list pgsql-hackers

From Stephen Frost
Subject Re: [HACKERS] logical replication access control patches
Date
Msg-id 20170218230607.GZ9812@tamriel.snowman.net
Whole thread Raw
In response to [HACKERS] logical replication access control patches  (Peter Eisentraut <peter.eisentraut@2ndquadrant.com>)
Responses Re: [HACKERS] logical replication access control patches  (Peter Eisentraut <peter.eisentraut@2ndquadrant.com>)
List pgsql-hackers
Peter,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> 0002 Add PUBLICATION privilege
>
> Add a new privilege kind to tables to determine whether they can be
> added to a publication.

I'm not convinced that it really makes sense to have PUBLICATION of a
table be independent from the rights an owner of a table has.  We don't
allow other ALTER commands on objects based on GRANT'able rights, in
general, so I'm not really sure that it makes sense to do so here.

The downside of adding these privileges is that we're burning through
the last few bits in the ACLMASK for a privilege that doesn't really
seem like it's something that would be GRANT'd in general usage.

I have similar reservations regarding the proposed SUBSCRIPTION
privilege.

I'm certainly all for removing the need for users to be the superuser
for such commands, just not sure that they should be GRANT'able
privileges instead of privileges which the owner of the relation or
database has.

Thanks!

Stephen

pgsql-hackers by date:

Previous
From: Petr Jelinek
Date:
Subject: Re: [HACKERS] Provide list of subscriptions and publications inpsql's completion
Next
From: Stephen Frost
Date:
Subject: Re: [HACKERS] Allow pg_dumpall to work without pg_authid