Thread: pgsql: Default monitoring roles

pgsql: Default monitoring roles

From
Simon Riggs
Date:
Default monitoring roles

Three nologin roles with non-overlapping privs are created by default
* pg_read_all_settings - read all GUCs.
* pg_read_all_stats - pg_stat_*, pg_database_size(), pg_tablespace_size()
* pg_stat_scan_tables - may lock/scan tables

Top level role - pg_monitor includes all of the above by default, plus others

Author: Dave Page
Reviewed-by: Stephen Frost, Robert Haas, Peter Eisentraut, Simon Riggs

Branch
------
master

Details
-------
http://git.postgresql.org/pg/commitdiff/25fff40798fc4ac11a241bfd9ab0c45c085e2212

Modified Files
--------------
contrib/pg_buffercache/Makefile                    |  5 +--
.../pg_buffercache/pg_buffercache--1.2--1.3.sql    |  7 +++++
contrib/pg_buffercache/pg_buffercache.control      |  2 +-
contrib/pg_freespacemap/Makefile                   |  4 +--
.../pg_freespacemap/pg_freespacemap--1.1--1.2.sql  |  7 +++++
contrib/pg_freespacemap/pg_freespacemap.control    |  2 +-
contrib/pg_stat_statements/Makefile                |  7 +++--
.../pg_stat_statements--1.4--1.5.sql               |  6 ++++
contrib/pg_stat_statements/pg_stat_statements.c    |  8 +++--
.../pg_stat_statements/pg_stat_statements.control  |  2 +-
contrib/pg_visibility/Makefile                     |  3 +-
contrib/pg_visibility/pg_visibility--1.1--1.2.sql  | 13 ++++++++
contrib/pg_visibility/pg_visibility.control        |  2 +-
contrib/pgrowlocks/pgrowlocks.c                    |  9 ++++--
contrib/pgstattuple/pgstattuple--1.4--1.5.sql      |  9 ++++++
doc/src/sgml/catalogs.sgml                         |  8 +++--
doc/src/sgml/func.sgml                             | 23 ++++++++------
doc/src/sgml/pgbuffercache.sgml                    |  5 +--
doc/src/sgml/pgfreespacemap.sgml                   |  5 +--
doc/src/sgml/pgrowlocks.sgml                       |  7 +++++
doc/src/sgml/pgstatstatements.sgml                 |  9 +++---
doc/src/sgml/pgstattuple.sgml                      |  3 +-
doc/src/sgml/pgvisibility.sgml                     |  5 ++-
doc/src/sgml/user-manag.sgml                       | 36 ++++++++++++++++++++++
src/backend/catalog/system_views.sql               |  6 ++++
src/backend/replication/walreceiver.c              |  3 +-
src/backend/utils/adt/dbsize.c                     | 20 ++++++++----
src/backend/utils/adt/pgstatfuncs.c                |  6 ++--
src/backend/utils/misc/guc.c                       | 21 ++++++++-----
src/include/catalog/pg_authid.h                    |  8 +++++
30 files changed, 196 insertions(+), 55 deletions(-)


Re: pgsql: Default monitoring roles

From
Erik Rijkers
Date:
On 2017-03-30 20:20, Simon Riggs wrote:
> Default monitoring roles


The buildfarm is showing red (the same errors that I get...):


pgrowlocks.c: In function ‘pgrowlocks’:
pgrowlocks.c:105:65: error: expected ‘)’ before ‘;’ token
     is_member_of_role(GetUserId(), DEFAULT_ROLE_STAT_SCAN_TABLES);
                                                                  ^
[...]




Re: pgsql: Default monitoring roles

From
Simon Riggs
Date:
On 30 March 2017 at 19:31, Erik Rijkers <er@xs4all.nl> wrote:
> On 2017-03-30 20:20, Simon Riggs wrote:
>>
>> Default monitoring roles
>
>
>
> The buildfarm is showing red (the same errors that I get...):
>
>
> pgrowlocks.c: In function ‘pgrowlocks’:
> pgrowlocks.c:105:65: error: expected ‘)’ before ‘;’ token
>     is_member_of_role(GetUserId(), DEFAULT_ROLE_STAT_SCAN_TABLES);
>                                                                  ^
> [...]

Weird. make check-world just skipped that directory. I guess for Dave also.

Bug fixed, but will look at makefile

--
Simon Riggs                http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


Re: pgsql: Default monitoring roles

From
Dave Page
Date:
On Thu, Mar 30, 2017 at 2:57 PM, Simon Riggs <simon@2ndquadrant.com> wrote:
> On 30 March 2017 at 19:31, Erik Rijkers <er@xs4all.nl> wrote:
>> On 2017-03-30 20:20, Simon Riggs wrote:
>>>
>>> Default monitoring roles
>>
>>
>>
>> The buildfarm is showing red (the same errors that I get...):
>>
>>
>> pgrowlocks.c: In function ‘pgrowlocks’:
>> pgrowlocks.c:105:65: error: expected ‘)’ before ‘;’ token
>>     is_member_of_role(GetUserId(), DEFAULT_ROLE_STAT_SCAN_TABLES);
>>                                                                  ^
>> [...]
>
> Weird. make check-world just skipped that directory. I guess for Dave also.
>
> Bug fixed, but will look at makefile

Yes, Stephen and I were just trying to figure out how that happened. I
ran make check from within /contrib before I sent the patch, and that
passes just fine. I guess maybe it doesn't build modules that don't
have any tests.

--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company