Horton

Re: First draft of the PG 15 release notes

Bruce Momjian <bruce@momjian.us>

View thread View on postgr.es
From: Bruce Momjian <bruce@momjian.us>
To: Mark Dilger <mark.dilger@enterprisedb.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Date: 2022-05-11T01:46:42Z
Lists: pgsql-hackers 
On Tue, May 10, 2022 at 03:12:18PM -0700, Mark Dilger wrote:
> 
> 
> > On May 10, 2022, at 8:44 AM, Bruce Momjian <bruce@momjian.us> wrote:
> > 
> > I have completed the first draft of the PG 15 release notes and you can
> > see the results here
> 
> 
> Thanks, Bruce!  This release note:
> 
> 	• Prevent logical replication into tables where the subscription owner is subject to the table's row-level security policies (Mark Dilger)
> 
> ... should mention, independent of any RLS considerations, subscriptions are now applied under the privilege of the subscription owner.  I don't think we can fit it in the release note, but the basic idea is that:
> 
> 	CREATE SUBSCRIPTION ... CONNECTION '...' PUBLICATION ... WITH (enabled = false);
> 	ALTER SUBSCRIPTION ... OWNER TO nonsuperuser_whoever;
> 	ALTER SUBSCRIPTION ... ENABLE;
> 
> can be used to replicate a subscription without sync or apply workers operating as superuser.  That's the main advantage.  Previously, subscriptions always ran with superuser privilege, which creates security concerns if the publisher is malicious (or foolish).  Avoiding any unintentional bypassing of RLS was just a necessary detail to close the security loophole, not the main point of the security enhancement.

Oh, interesting.  New text:

	<!--
	Author: Jeff Davis <jdavis@postgresql.org>
	2022-01-07 [a2ab9c06e] Respect permissions within logical replication.
	-->
	
	<listitem>
	<para>
	Allow logical replication to run as the owner of the publication (Mark Dilger)
	</para>
	
	<para>
	Because row-level security policies are not checked, only
	superusers, roles with bypassrls, and table owners can replicate
	into tables with row-level security policies.
	</para>
	</listitem>

How is this?

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Indecision is a decision.  Inaction is an action.  Mark Batterson

Commits

  1. Doc: last minute adjustment to the release notes

  2. Doc: more tweaking of v15 release notes.

  3. Doc: further adjust notes about pg_upgrade_output.d.

  4. Doc: add list of major features to the v15 release notes.

  5. relnotes: update item about public schema permission change

  6. relnotes: update ordered partition scan item

  7. relnotes: add Heikki to UTF8 item

  8. relnotes: improve UTF8 text item in relation to ASCII

  9. relnotes: add null logical replication item

  10. relnotes: adjust several logical replication items and FK text

  11. relnotes: mention non-exclusive backup mode was deprecated

  12. relnotes: add author to in-memory sorts item

  13. relnotes: update for non-exclusive backup mode removal

  14. relnote: improve sorting entries

  15. relnotes: adjustments from Álvaro Herrera

  16. relnotes: update foreign key partition and add sort items

  17. relnotes: more adjustments

  18. relnotes: logical replication permissions checked by subscrib.

  19. relnotes: adjustments

  20. relnotes: remove sequence replication and update 'postgres -C'

  21. relnote: extensive updates

  22. relnotes: "training" -> "trailing"

  23. Standardize references to Zstandard as <productname>

  24. pgstat: Update docs to match the shared memory stats reality.

  25. Raise a WARNING for missing publications.

  26. Skip empty transactions for logical replication.

  27. Optionally disable subscriptions on error.

  28. Allow root-owned SSL private keys in libpq, not only the backend.

  29. Use COPY FREEZE in pgbench for faster benchmark table population.