On Thursday, April 05, 2012 05:39:19 PM Tom Lane wrote:
> Andres Freund <andres@anarazel.de> writes:
> >> The point is to avoid the risk that someone else could connect to the
> >> database at the same time you're doing work on it.
> >
> > I got that. I just fail to see what the advantage of using two pipes
> > instead of one socket as every other plain connection would be?
>
> Yeah, that would be a small pain in the neck, but it eliminates a huge
> pile of practical difficulties, like your blithe assumption that you can
> find a "private directory" somewhere (wrong) or disallow access to other
> people (also wrong, if they are using the same account as you).
I don't think this needs to protect against malicious intent of a user running
with the *same* privileges as the postmaster. That one can simply delete the
whole cluster anyway. For everybody else you can just create a directory in
PGDATA and revoke all permissions on it for everybody but the owner.
For named pipes you could just create a random name with permissions only for
the current user (thats possible in the same call) and be done with it.
Andres