diff options
| author | Simon Riggs <simon@2ndQuadrant.com> | 2017-03-30 14:18:53 -0400 |
|---|---|---|
| committer | Simon Riggs <simon@2ndQuadrant.com> | 2017-03-30 14:18:53 -0400 |
| commit | 25fff40798fc4ac11a241bfd9ab0c45c085e2212 (patch) | |
| tree | 3c2e3eb741f814bba8eaa593d17811b86b8d2a00 /contrib/pg_stat_statements/pg_stat_statements.c | |
| parent | e984ef5861df4bc9733b36271d05763e82de7c04 (diff) | |
Default monitoring roles
Three nologin roles with non-overlapping privs are created by default
* pg_read_all_settings - read all GUCs.
* pg_read_all_stats - pg_stat_*, pg_database_size(), pg_tablespace_size()
* pg_stat_scan_tables - may lock/scan tables
Top level role - pg_monitor includes all of the above by default, plus others
Author: Dave Page
Reviewed-by: Stephen Frost, Robert Haas, Peter Eisentraut, Simon Riggs
Diffstat (limited to 'contrib/pg_stat_statements/pg_stat_statements.c')
| -rw-r--r-- | contrib/pg_stat_statements/pg_stat_statements.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/contrib/pg_stat_statements/pg_stat_statements.c b/contrib/pg_stat_statements/pg_stat_statements.c index cd4c16e9d2c..c3002618524 100644 --- a/contrib/pg_stat_statements/pg_stat_statements.c +++ b/contrib/pg_stat_statements/pg_stat_statements.c @@ -62,6 +62,7 @@ #include <unistd.h> #include "access/hash.h" +#include "catalog/pg_authid.h" #include "executor/instrument.h" #include "funcapi.h" #include "mb/pg_wchar.h" @@ -1391,7 +1392,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo, MemoryContext per_query_ctx; MemoryContext oldcontext; Oid userid = GetUserId(); - bool is_superuser = superuser(); + bool is_allowed_role = false; char *qbuffer = NULL; Size qbuffer_size = 0; Size extent = 0; @@ -1399,6 +1400,9 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo, HASH_SEQ_STATUS hash_seq; pgssEntry *entry; + /* Superusers or members of pg_read_all_stats members are allowed */ + is_allowed_role = is_member_of_role(GetUserId(), DEFAULT_ROLE_READ_ALL_STATS); + /* hash table must exist already */ if (!pgss || !pgss_hash) ereport(ERROR, @@ -1541,7 +1545,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo, values[i++] = ObjectIdGetDatum(entry->key.userid); values[i++] = ObjectIdGetDatum(entry->key.dbid); - if (is_superuser || entry->key.userid == userid) + if (is_allowed_role || entry->key.userid == userid) { if (api_version >= PGSS_V1_2) values[i++] = Int64GetDatumFast(queryid); |