Skip site navigation (1) Skip section navigation (2)

Re: Largeobject Access Controls (r2460)

From: KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>
To: Takahiro Itagaki <itagaki(dot)takahiro(at)oss(dot)ntt(dot)co(dot)jp>
Cc: Jaime Casanova <jcasanov(at)systemguards(dot)com(dot)ec>, Greg Smith <greg(at)2ndquadrant(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Largeobject Access Controls (r2460)
Date: 2009-12-11 03:02:41
Message-ID: 4B21B651.6060108@ak.jp.nec.com (view raw or flat)
Thread:
Lists: pgsql-hackers
Takahiro Itagaki wrote:
> KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com> wrote:
> 
>>> we still allow "SELECT * FROM pg_largeobject" ...right?
>> It can be solved with revoking any privileges from anybody in the initdb
>> phase. So, we should inject the following statement for setup_privileges().
>>
>>   REVOKE ALL ON pg_largeobject FROM PUBLIC;
> 
> OK, I'll add the following description in the documentation of pg_largeobject.
> 
>    <structname>pg_largeobject</structname> should not be readable by the
>    public, since the catalog contains data in large objects of all users.
>    <structname>pg_largeobject_metadata</> is a publicly readable catalog
>    that only contains identifiers of large objects.

It makes sense to me.

>> {"lo_compat_privileges", PGC_SUSET, COMPAT_OPTIONS_PREVIOUS,
>>     gettext_noop("Turn on/off privilege checks on large objects."),
> 
> The description is true, but gives a confusion because
> "lo_compat_privileges = on" means "privilege checks are turned off".
> 
>   short desc: Enables backward compatibility in privilege checks on large objects
>   long desc: When turned on, privilege checks on large objects are disabled.
> 
> Are those descriptions appropriate?

The long description is a bit confusable, because it does not disable all the
privilege checks, such as lo_export/lo_import which already checks superuser
privilege on execution in the earlier releases.

What's your opinion about:

  long desc: When turned on, privilege checks on large objects perform with
             backward compatibility as 8.4.x or earlier releases.

Thanks,
-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>

In response to

Responses

pgsql-hackers by date

Next:From: Tom LaneDate: 2009-12-11 03:25:44
Subject: Re: explain output infelicity in psql
Previous:From: Robert HaasDate: 2009-12-11 03:02:09
Subject: Re: explain output infelicity in psql

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group