Re: pgsql: Use GRANT system to manage access to sensitive functions - Mailing list pgsql-committers

From Michael Paquier
Subject Re: pgsql: Use GRANT system to manage access to sensitive functions
Date
Msg-id CAB7nPqTN1aPjV_yGE=rtBoSNEszeh9__vOwdV7RLtFb0BPZWWA@mail.gmail.com
Whole thread Raw
In response to pgsql: Use GRANT system to manage access to sensitive functions  (Stephen Frost <sfrost@snowman.net>)
List pgsql-committers
On Thu, Apr 7, 2016 at 10:45 AM, Stephen Frost <sfrost@snowman.net> wrote:
> Use GRANT system to manage access to sensitive functions
>
> Now that pg_dump will properly dump out any ACL changes made to
> functions which exist in pg_catalog, switch to using the GRANT system
> to manage access to those functions.
>
> This means removing 'if (!superuser()) ereport()' checks from the
> functions themselves and then REVOKEing EXECUTE right from 'public' for
> these functions in system_views.sql.

+1.
--
Michael


pgsql-committers by date:

Previous
From: Stephen Frost
Date:
Subject: pgsql: In pg_dump, split "dump" into "dump" and "dump_contains"
Next
From: Tom Lane
Date:
Subject: Re: pgsql: Use GRANT system to manage access to sensitive functions