Re: proposal: hide application_name from other users - Mailing list pgsql-hackers

From Josh Berkus
Subject Re: proposal: hide application_name from other users
Date
Msg-id 52E955A5.5070602@agliodbs.com
Whole thread Raw
In response to proposal: hide application_name from other users  (Harold Giménez <harold@heroku.com>)
List pgsql-hackers
On 01/29/2014 10:19 AM, Simon Riggs wrote:
> No specific reason that I can recall but replication is heavily
> protected by layers of security.
> 
> pg_stat_replication is a join with pg_stat_activity, so some of the
> info is open, some closed. It seems possible to relax that.

I'm all for the idea of "restrict, then open up".  That is, it made
sense to start with data restricted, but then unrestrict is as we know
it's OK.  Going the other way generally isn't possible, as this patch
demonstrates.

> Presumably the current patch is returned with feedback? Or can we fix
> these problems by inventing a new user aspect called MONITOR (similar
> to REPLICATION)? We can grant application_name and replication details
> to that.

Yeah, except I don't see doing the MONITOR thing for 9.4.  We'd need a
spec for it first.

-- 
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com



pgsql-hackers by date:

Previous
From: Pavel Stehule
Date:
Subject: Re: pg_sleep_enhancements.patch
Next
From: Vik Fearing
Date:
Subject: Re: pg_sleep_enhancements.patch