Add default roles for file/program access
Stephen Frost <sfrost@snowman.net>
Add default roles for file/program access This patch adds new default roles named 'pg_read_server_files', 'pg_write_server_files', 'pg_execute_server_program' which allow an administrator to GRANT to a non-superuser role the ability to access server-side files or run programs through PostgreSQL (as the user the database is running as). Having one of these roles allows a non-superuser to use server-side COPY to read, write, or with a program, and to use file_fdw (if installed by a superuser and GRANT'd USAGE on it) to read from files or run a program. The existing misc file functions are also changed to allow a user with the 'pg_read_server_files' default role to read any files on the filesystem, matching the privileges given to that role through COPY and file_fdw from above. Reviewed-By: Michael Paquier Discussion: https://postgr.es/m/20171231191939.GR2416%40tamriel.snowman.net
Files
| Path | Change | +/− |
|---|---|---|
| contrib/file_fdw/file_fdw.c | modified | +33 −18 |
| contrib/file_fdw/output/file_fdw.source | modified | +1 −1 |
| doc/src/sgml/file-fdw.sgml | modified | +5 −3 |
| doc/src/sgml/func.sgml | modified | +19 −8 |
| doc/src/sgml/ref/copy.sgml | modified | +6 −2 |
| doc/src/sgml/user-manag.sgml | modified | +27 −1 |
| src/backend/commands/copy.c | modified | +32 −14 |
| src/backend/utils/adt/genfile.c | modified | +16 −0 |
| src/include/catalog/pg_authid.h | modified | +6 −0 |
Documentation touched
Discussion
- Add default role 'pg_access_server_files' 30 messages · 2017-12-31 → 2018-04-06