Re: [HACKERS] logical replication access control patches

Поиск
Список
Период
Сортировка
От Stephen Frost
Тема Re: [HACKERS] logical replication access control patches
Дата
Msg-id 20170218230607.GZ9812@tamriel.snowman.net
обсуждение исходный текст
Ответ на [HACKERS] logical replication access control patches  (Peter Eisentraut <peter.eisentraut@2ndquadrant.com>)
Ответы Re: [HACKERS] logical replication access control patches  (Peter Eisentraut <peter.eisentraut@2ndquadrant.com>)
Список pgsql-hackers
Peter,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> 0002 Add PUBLICATION privilege
>
> Add a new privilege kind to tables to determine whether they can be
> added to a publication.

I'm not convinced that it really makes sense to have PUBLICATION of a
table be independent from the rights an owner of a table has.  We don't
allow other ALTER commands on objects based on GRANT'able rights, in
general, so I'm not really sure that it makes sense to do so here.

The downside of adding these privileges is that we're burning through
the last few bits in the ACLMASK for a privilege that doesn't really
seem like it's something that would be GRANT'd in general usage.

I have similar reservations regarding the proposed SUBSCRIPTION
privilege.

I'm certainly all for removing the need for users to be the superuser
for such commands, just not sure that they should be GRANT'able
privileges instead of privileges which the owner of the relation or
database has.

Thanks!

Stephen

В списке pgsql-hackers по дате отправления:

Предыдущее
От: Petr Jelinek
Дата:
Сообщение: Re: [HACKERS] Provide list of subscriptions and publications inpsql's completion
Следующее
От: Stephen Frost
Дата:
Сообщение: Re: [HACKERS] Allow pg_dumpall to work without pg_authid