Re: Patch for - Allow server logs to be remotely read - Mailing list pgsql-patches

From Tom Lane
Subject Re: Patch for - Allow server logs to be remotely read
Date
Msg-id 27342.1149777398@sss.pgh.pa.us
Whole thread Raw
In response to Re: Patch for - Allow server logs to be remotely read  (Bruce Momjian <pgman@candle.pha.pa.us>)
Responses Re: Patch for - Allow server logs to be remotely read  (Bruce Momjian <pgman@candle.pha.pa.us>)
Re: Patch for - Allow server logs to be remotely read  (Andreas Pflug <pgadmin@pse-consulting.de>)
List pgsql-patches
Bruce Momjian <pgman@candle.pha.pa.us> writes:
> Tom Lane wrote:
>> I wonder if we should take pg_read_file (and the rest of genfile.c)
>> back out of the backend and stick them into contrib/adminpack.

> I thought about that but what we have in the backend now is read-only
> which basically could be done using COPY, so I don't see any security
> value to moving them out.  They are super-user only just like COPY.

The you-can-do-it-with-COPY argument doesn't apply to pg_ls_dir, nor to
pg_stat_file, and I find it unconvincing even for pg_read_file.  COPY
isn't at all friendly for trying to read binary files, for instance.
Even for plain ASCII text you'd have to try to find a delimiter
character not present anywhere in the file, and backslashes in the file
would get corrupted.

But the basic point here is that someone who wants filesystem access
from the database is going to install adminpack anyway.  Why should
someone who *doesn't* want filesystem access from the database be
forced to have some capabilities of that type installed anyway?

            regards, tom lane

pgsql-patches by date:

Previous
From: Bruce Momjian
Date:
Subject: Re: Patch for - Allow server logs to be remotely read
Next
From: Bruce Momjian
Date:
Subject: Re: Patch for - Allow server logs to be remotely read