From: | Jim Nasby <Jim(dot)Nasby(at)BlueTreble(dot)com> |
---|---|
To: | Andres Freund <andres(at)anarazel(dot)de>, Joe Conway <mail(at)joeconway(dot)com> |
Cc: | PostgreSQL-development <pgsql-hackers(at)postgreSQL(dot)org> |
Subject: | Re: Proposal: SET ROLE hook |
Date: | 2015-10-17 16:15:34 |
Message-ID: | 56227426.1070006@BlueTreble.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On 10/16/15 12:51 PM, Andres Freund wrote:
>> >Hmmm, do you mean essentially skip the "GRANT postgres to joe" and use a
>> >SECURITY DEFINER C function that does the set role to postgres under the
>> >covers with "GRANT EXECUTE on FUNCTION elevate_user() to joe"?
> Yes.
>
>> >Being able to use something like that on existing versions would be
>> >very nice, but it feels kind of grotty.
> Hm. To me it doesn't feel too bad - security definer functions are there
> to allow to do things that users would normally not be allowed to do...
Tons of environments can't use C functions, and ignoring that it still
feels ugly.
How much harder would it be to add SET ROLE to event triggers? (Could be
done in conjunction with the hook; they serve different purposes.)
--
Jim Nasby, Data Architect, Blue Treble Consulting, Austin TX
Experts in Analytics, Data Architecture and PostgreSQL
Data in Trouble? Get it in Treble! http://BlueTreble.com
From | Date | Subject | |
---|---|---|---|
Next Message | Andrew Dunstan | 2015-10-17 16:17:59 | Re: plpython is broken for recursive use |
Previous Message | Andres Freund | 2015-10-17 14:57:33 | Re: Allow ssl_renegotiation_limit in PG 9.5 |