Horton
Menu

Re: running logical replication as the subscription owner

Jelte Fennema <postgres@jeltef.nl>

View thread
From: Jelte Fennema <postgres@jeltef.nl>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Jeff Davis <pgsql@j-davis.com>, PostgreSQL-development <pgsql-hackers@postgresql.org>, Andres Freund <andres@anarazel.de>, Noah Misch <noah@leadboat.com>
Date: 2023-05-15T13:57:15Z
Lists: pgsql-hackers 
On Fri, 24 Mar 2023 at 19:37, Robert Haas <robertmhaas@gmail.com> wrote:
> > > > I think there's some important tests missing related to this:
> > > > 1. Ensuring that SECURITY_RESTRICTED_OPERATION things are enforced
> > > > when the user **does not** have SET ROLE permissions to the
> > > > subscription owner, e.g. don't allow SET ROLE from a trigger.
> > > > 2. Ensuring that SECURITY_RESTRICTED_OPERATION things are not enforced
> > > > when the user **does** have SET ROLE permissions to the subscription
> > > > owner, e.g. allows SET ROLE from trigger.
> > > Yeah, if we stick with the current approach we should probably add
> > > tests for that stuff.
> >
> > Even if we don't, we should still have tests showing that the security restrictions that we intend to put in place actually do their job.
>
> Yeah, I just don't want to write the tests and then decide to change
> the behavior and then have to write them over again. It's not so much
> fun that I'm yearning to do it twice.

I forgot to follow up on this before, but based on the bug found by
Amit. I think it would be good to still add these tests.

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Honor run_as_owner option in tablesync worker.

  2. Document new pg_subscription columns.

  3. Add a run_as_owner option to subscriptions.

  4. Perform logical replication actions as the table owner.

  5. Add new predefined role pg_create_subscription.

  6. Respect permissions within logical replication.

  7. Empty search_path in logical replication apply worker and walsender.

  8. Empty search_path in Autovacuum and non-psql/pgbench clients.