Postgres Pro
Downloads
Home   >   mailing lists

Re: non-superusers are allowed to drop the replication user, but are not allowed to alter or even create them, is that ok? - Mailing list pgsql-hackers

From Ashutosh Sharma
Subject Re: non-superusers are allowed to drop the replication user, but are not allowed to alter or even create them, is that ok?
Date
Msg-id CAE9k0PkquR=MD9gPE3KmXnt+qyv-ff=VCKrJMq9HoVpSVuXw8w@mail.gmail.com
Whole thread Raw
In response to Re: non-superusers are allowed to drop the replication user, but are not allowed to alter or even create them, is that ok?  (Mark Dilger <mark.dilger@enterprisedb.com>)
Responses Re: non-superusers are allowed to drop the replication user, but are not allowed to alter or even create them, is that ok?
List pgsql-hackers
Tree view
On Thu, Sep 30, 2021 at 8:40 PM Mark Dilger <mark.dilger@enterprisedb.com> wrote:


> On Sep 30, 2021, at 3:07 AM, Ashutosh Sharma <ashu.coek88@gmail.com> wrote:
>
> While working on one of the internal projects I noticed that currently in Postgres, we do not allow normal users to alter attributes of the replication user. However we do allow normal users to drop replication users or to even rename it using the alter command. Is that behaviour ok? If yes, can someone please help me understand how and why this is okay.

The definition of CREATEROLE is a bit of a mess.  Part of the problem is that roles do not have owners, which makes the permissions to drop roles work differently than for other object types.  I have a patch pending [1] for the version 15 development cycle that fixes this and other problems.  I'd appreciate feedback on the design and whether it addresses your concerns.

[1] https://commitfest.postgresql.org/34/3223/

Thanks Mark. I'll take a look at this thread in detail to see if it addresses the issue raised here. Although from the first email it seems like the proposal is about allowing normal users to set some of the GUC params that can only be set by the superusers.

With Regards,
Ashutosh Sharma.

pgsql-hackers by date:

Previous
From: Amit Kapila
Date:
Subject: Re: Diagnostic comment in LogicalIncreaseXminForSlot
Next
From: Ashutosh Sharma
Date:
Subject: Re: non-superusers are allowed to drop the replication user, but are not allowed to alter or even create them, is that ok?