Re: per-row security - Mailing list pgsql-general

From Christopher Browne
Subject Re: per-row security
Date
Msg-id 87hcxbhvkh.fsf@wolfe.cbbrowne.com
Whole thread Raw
In response to Re: [pgsql-general] Daily digest v1.6578 (20 messages)  (Marc Munro <marc@bloodnok.com>)
List pgsql-general
ajs@crankycanuck.ca (Andrew Sullivan) wrote:
> On Mon, Nov 06, 2006 at 01:40:18PM -0800, Marc Munro wrote:
>> You will of course be replicating the underlying tables and not the
>> views, so your replication user will have to have full access to the
>> unsecured data.  This is natural and should not be a concern but may be
>> worth explicitly documenting.
>
> In Slony, the replication user has to be a superuser anyway, so it
> would have access to that data no matter what.

When Slony-II work was ongoing, replication was taking place from a
deeper level inside the DB engine such that that took place as perhaps
even a "superduperuser."

A replication mechanism which captured updates from transaction logs
would have "effectively more than superuser access", too.
--
select 'cbbrowne' || '@' || 'gmail.com';
http://linuxfinances.info/info/languages.html
Rules of the Evil  Overlord #71. "If I  decide to test  a lieutenant's
loyalty and see if he/she should be  made a trusted lieutenant, I will
have a crack squad of marksmen standing by in case  the answer is no."
<http://www.eviloverlord.com/>

pgsql-general by date:

Previous
From: "Joshua D. Drake"
Date:
Subject: Out of town next week
Next
From: Reece Hart
Date:
Subject: Re: R and postgres