Skip site navigation (1) Skip section navigation (2)

Re: Largeobject Access Controls (r2460)

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>
Cc: Takahiro Itagaki <itagaki(dot)takahiro(at)oss(dot)ntt(dot)co(dot)jp>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Jaime Casanova <jcasanov(at)systemguards(dot)com(dot)ec>, Greg Smith <greg(at)2ndquadrant(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Largeobject Access Controls (r2460)
Date: 2009-12-11 15:39:22
Message-ID: 200912111539.nBBFdNi06066@momjian.us (view raw or flat)
Thread:
Lists: pgsql-hackers
KaiGai Kohei wrote:
> Takahiro Itagaki wrote:
> > KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com> wrote:
> > 
> >> Tom Lane wrote:
> >>> Takahiro Itagaki <itagaki(dot)takahiro(at)oss(dot)ntt(dot)co(dot)jp> writes:
> >>>>    <structname>pg_largeobject</structname> should not be readable by the
> >>>>    public, since the catalog contains data in large objects of all users.
> >>> This is going to be a problem, because it will break applications that
> >>> expect to be able to read pg_largeobject.  Like, say, pg_dump.
> >> Is it a right behavior, even if we have permission checks on large objects?
> > 
> > Can we use column-level access control here?
> > 
> >    REVOKE ALL ON pg_largeobject FROM PUBLIC;
> > => GRANT SELECT (loid) ON pg_largeobject TO PUBLIC;
> 
> Indeed, it seems to me reasonable.
> 
> > We use "SELECT loid FROM pg_largeobject LIMIT 1" in pg_dump. We could
> > replace pg_largeobject_metadata instead if we try to fix only pg_dump,
> > but it's no wonder that any other user applications use such queries.
> > I think to allow reading loid is a balanced solution.
> 
> Right, I also remind this query has to be fixed up by other reason right now.
> If all the large objects are empty, this query can return nothing, even if
> large object entries are in pg_largeobject_metadata.

"metadata" seems very vague.  Can't we come up with a more descriptive
name?

Also, how will this affect pg_migrator?  pg_migrator copies
pg_largeobject and its index from the old to the new server.  Is the
format inside pg_largeobject changed by this patch?  What happens when
there is no entry in pg_largeobject_metadata for a specific row?

-- 
  Bruce Momjian  <bruce(at)momjian(dot)us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + If your life is a hard drive, Christ can be your backup. +

In response to

Responses

pgsql-hackers by date

Next:From: KaiGai KoheiDate: 2009-12-11 15:59:04
Subject: Re: Largeobject Access Controls (r2460)
Previous:From: Stephen FrostDate: 2009-12-11 15:24:52
Subject: Re: Adding support for SE-Linux security

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group