From: pgsql-hackers-owner@postgresql.org
> [mailto:pgsql-hackers-owner@postgresql.org] On Behalf Of Andres Freund
> As I asked before, why can't we delete all privs and add the explicitly
> needed once back (using AdjustTokenPrivileges)?
I tried it with pg_ctl.c attached to an earlier mail today, i.e. delete all privs with
CreateRestrictedToken(DISABLE_ALL_PRIVILEGE)and enable Lock Pages in Memory with AdjustTokenPrivileges(). But it
didn'twork; AdjustTokenPrivileges() failed to enable the priv. It's probably that CreateRestrictedToken() deletes
(unassigns?)the privs from the access token, so subsequent AdjustTokenPrivileges() can no longer enable the priv.
Regards
Takayuki Tsunakawa