From: | Dave Page <dpage(at)pgadmin(dot)org> |
---|---|
To: | Peter Eisentraut <peter(dot)eisentraut(at)2ndquadrant(dot)com> |
Cc: | Robert Haas <robertmhaas(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Monitoring roles patch |
Date: | 2017-03-22 14:50:34 |
Message-ID: | CA+OCxoy1JCtThQ_=Q-O_a3LiTN9=htocH1d3p=xp7d+EPmy7jQ@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Wed, Mar 22, 2017 at 12:55 PM, Peter Eisentraut
<peter(dot)eisentraut(at)2ndquadrant(dot)com> wrote:
> On 3/22/17 07:48, Dave Page wrote:
>> With the patch, complex monitoring systems can easily be setup with
>> something like:
>>
>> CREATE ROLE monitoring_user LOGIN;
>> GRANT pg_monitor TO monitoring_role;
>
> That assumes that we have thought of all the ways in which people might
> want to monitor things.
Right - it was discussed here, and at other meetings. We may not have
everything but either users can GRANT anything we need that we missed
later, or we can add them in a future release.
> If we do it via GRANTs instead, then users can easily extend it.
They can do that anyway.
> If we instead change the hardcoded superuser checks to hardcoded
> some-other-role checks, then the whole system instantly becomes unusable
> the moment someone wants to monitor something we haven't thought of.
I haven't replaced the checks, I've made them superuser || pg_monitor.
Nothing is going to break if we haven't thought of something.
--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
From | Date | Subject | |
---|---|---|---|
Next Message | Andres Freund | 2017-03-22 14:52:40 | Re: WIP: Faster Expression Processing v4 |
Previous Message | Andres Freund | 2017-03-22 14:43:56 | Re: Metadata about relation creation & full scans. |