From 1574783b4ced0356fbc626af1a1a469faa6b41e1 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Wed, 6 Apr 2016 21:45:32 -0400 Subject: Use GRANT system to manage access to sensitive functions Now that pg_dump will properly dump out any ACL changes made to functions which exist in pg_catalog, switch to using the GRANT system to manage access to those functions. This means removing 'if (!superuser()) ereport()' checks from the functions themselves and then REVOKEing EXECUTE right from 'public' for these functions in system_views.sql. Reviews by Alexander Korotkov, Jose Luis Tallon --- doc/src/sgml/backup.sgml | 8 ++++++-- doc/src/sgml/func.sgml | 19 ++++++++++--------- doc/src/sgml/monitoring.sgml | 12 ++++++++---- 3 files changed, 24 insertions(+), 15 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/backup.sgml b/doc/src/sgml/backup.sgml index 9092cf8fe33..8c65df2b15a 100644 --- a/doc/src/sgml/backup.sgml +++ b/doc/src/sgml/backup.sgml @@ -826,7 +826,9 @@ test ! -f /mnt/server/archivedir/00000001000000A900000065 && cp pg_xlog/ - Connect to the database as a superuser and issue the command: + Connect to the database as a user with rights to run pg_start_backup + (superuser, or a user who has been granted EXECUTE on the function) + and issue the command: SELECT pg_start_backup('label'); @@ -877,7 +879,9 @@ SELECT pg_start_backup('label', true); - Again connect to the database as a superuser, and issue the command: + Again connect to the database as a user with rights to run + pg_stop_backup (superuser, or a user who has been granted EXECUTE on + the function), and issue the command: SELECT pg_stop_backup(); diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index 2ce89bb030f..15b6b4eb3d5 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -17339,8 +17339,9 @@ SELECT set_config('log_statement_stats', 'off', false); The functions shown in send control signals to - other server processes. Use of these functions is usually restricted - to superusers, with noted exceptions. + other server processes. Use of these functions is restricted to + superusers by default but access may be granted to others with the + GRANT, with noted exceptions. @@ -17490,7 +17491,7 @@ SELECT set_config('log_statement_stats', 'off', false); pg_create_restore_point(name text)pg_lsn - Create a named point for performing restore (restricted to superusers) + Create a named point for performing restore (restricted to superusers by default, but other users can be granted EXECUTE to run the function) @@ -17518,21 +17519,21 @@ SELECT set_config('log_statement_stats', 'off', false); pg_start_backup(label text , fast boolean , exclusive boolean ) pg_lsn - Prepare for performing on-line backup (restricted to superusers or replication roles) + Prepare for performing on-line backup (restricted to superusers by default, but other users can be granted EXECUTE to run the function) pg_stop_backup() pg_lsn - Finish performing exclusive on-line backup (restricted to superusers or replication roles) + Finish performing exclusive on-line backup (restricted to superusers by default, but other users can be granted EXECUTE to run the function) pg_stop_backup(exclusive boolean) setof record - Finish performing exclusive or non-exclusive on-line backup (restricted to superusers or replication roles) + Finish performing exclusive or non-exclusive on-line backup (restricted to superusers by default, but other users can be granted EXECUTE to run the function) @@ -17553,7 +17554,7 @@ SELECT set_config('log_statement_stats', 'off', false); pg_switch_xlog() pg_lsn - Force switch to a new transaction log file (restricted to superusers) + Force switch to a new transaction log file (restricted to superusers by default, but other users can be granted EXECUTE to run the function) @@ -17821,7 +17822,7 @@ postgres=# SELECT * FROM pg_xlogfile_name_offset(pg_stop_backup()); pg_xlog_replay_pause() void - Pauses recovery immediately (restricted to superusers). + Pauses recovery immediately (restricted to superusers by default, but other users can be granted EXECUTE to run the function). @@ -17829,7 +17830,7 @@ postgres=# SELECT * FROM pg_xlogfile_name_offset(pg_stop_backup()); pg_xlog_replay_resume() void - Restarts recovery if it was paused (restricted to superusers). + Restarts recovery if it was paused (restricted to superusers by default, but other users can be granted EXECUTE to run the function). diff --git a/doc/src/sgml/monitoring.sgml b/doc/src/sgml/monitoring.sgml index 105d5415347..5ab3accf9d2 100644 --- a/doc/src/sgml/monitoring.sgml +++ b/doc/src/sgml/monitoring.sgml @@ -2289,7 +2289,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset all statistics counters for the current database to zero - (requires superuser privileges) + (requires superuser privileges by default, but EXECUTE for this + function can be granted to others.) @@ -2298,7 +2299,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset some cluster-wide statistics counters to zero, depending on the - argument (requires superuser privileges). + argument (requires superuser privileges by default, but EXECUTE for + this functiion can be granted to others). Calling pg_stat_reset_shared('bgwriter') will zero all the counters shown in the pg_stat_bgwriter view. Calling pg_stat_reset_shared('archiver') will zero all the @@ -2311,7 +2313,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset statistics for a single table or index in the current database to - zero (requires superuser privileges) + zero (requires superuser privileges by default, but EXECUTE for this + function can be granted to others) @@ -2320,7 +2323,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset statistics for a single function in the current database to - zero (requires superuser privileges) + zero (requires superuser privileges by default, but EXECUTE for this + function can be granted to others) -- cgit v1.2.3