From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
---|---|
To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
Cc: | "Brightwell, Adam" <adam(dot)brightwell(at)crunchydatasolutions(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Directory/File Access Permissions for COPY and Generic File Access Functions |
Date: | 2014-10-16 15:15:55 |
Message-ID: | CA+Tgmoa9U2WDjGoAchf7=7togSxkQbsX5=yw2DLyrsVePQ0YSw@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Wed, Oct 15, 2014 at 11:34 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> "Brightwell, Adam" <adam(dot)brightwell(at)crunchydatasolutions(dot)com> writes:
>> The attached patch for review implements a directory permission system that
>> allows for providing a directory read/write capability to directories for
>> COPY TO/FROM and Generic File Access Functions to non-superusers.
>
> TBH, this sounds like it's adding a lot of mechanism and *significant*
> risk of unforeseen security issues in order to solve a problem that we
> do not need to solve. The field demand for such a feature is just about
> indistinguishable from zero.
I am also not convinced that we need this. If we need to allow
non-superusers COPY permission at all, can we just exclude certain
"unsafe" directories (like the data directory, and tablespaces) and
let them access anything else? Or can we have a whitelist of
directories stored as a PGC_SUSER GUC? This seems awfully heavyweight
for what it is.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
From | Date | Subject | |
---|---|---|---|
Next Message | Robert Haas | 2014-10-16 15:19:14 | Re: Better support of exported snapshots with pg_dump |
Previous Message | Robert Haas | 2014-10-16 15:11:16 | Re: Review of GetUserId() Usage |