Horton

docs: mention "pg_read_all_stats" in "track_activities" description

Ian Lawrence Barwick <barwick@gmail.com>

View thread View on postgr.es
From: Ian Lawrence Barwick <barwick@gmail.com>
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2022-05-20T06:17:29Z
Lists: pgsql-hackers

Attachments

Hi

Regarding the visibility of query information, the description for
"track_activities" [1] says:

> Note that even when enabled, this information is not visible to all users,
> only to superusers and the user owning the session being reported on, so it
> should not represent a security risk.

[1] https://www.postgresql.org/docs/current/runtime-config-statistics.html#GUC-TRACK-ACTIVITIES

It seems reasonable to mention here that the information is also visible to
members of "pg_read_all_stats", similar to what is done in the
pg_stat_statements
docs [2].

[2] https://www.postgresql.org/docs/current/pgstatstatements.html#PGSTATSTATEMENTS-COLUMNS

Suggested wording:

> Note that even when enabled, this information is only visible to superusers,
> members of the <literal>pg_read_all_stats</literal> role and the user owning
> the session being reported on, so it should not represent a security risk.

Patch (for HEAD) with suggested wording attached; the change should
IMO be applied
all the way back to v10 (though as-is the patch only applies to HEAD,
can provide
others if needed).


Regards

Ian Barwick


-- 
EnterpriseDB: https://www.enterprisedb.com

Commits

  1. doc: Reword description of roles able to view track_activities's info

  2. doc: Mention pg_read_all_stats in description of track_activities