> On Dec 9, 2021, at 7:47 AM, Robert Haas <robertmhaas@gmail.com> wrote:
>
> 1 and 2B seem to require changing the same code, or related code. 1A
> seems to require a completely different set of changes. If I'm right
> about that, it seems like a good reason for doing 1+2B first and
> leaving 2A for a separate patch.
There are unresolved problems with 2A and 3 which were discussed upthread. I don't want to include fixes for them in
thispatch, as it greatly expands the scope of this patch, and is a logically separate effort. We can come back to
thoseproblems after this first patch is committed.
Specifically, a non-superuser owner can perform ALTER SUBSCRIPTION and do things that are morally equivalent to
creatinga new subscription. This is problematic where things like the connection string are concerned, because it
meansthe non-superuser owner can connect out to entirely different servers, without any access control checks to make
surethe owner should be able to connect to these servers.
This problem already exists, right now. I'm not fixing it in this first patch, but I'm also not making it any worse.
The solution Jeff Davis proposed seems right to me. We change subscriptions to use a foreign server rather than a
freeformconnection string. When creating or altering a subscription, the role performing the action must have
privilegeson any foreign server they use.
—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company