Re: almost-super-user problems that we haven't fixed yet

2023-01-20 Thread Robert Haas
On Fri, Jan 20, 2023 at 4:02 PM Nathan Bossart wrote: > On Fri, Jan 20, 2023 at 03:42:03PM -0500, Robert Haas wrote: > > Thanks to you both. I have committed these patches. > > Thanks! Does this need a catversion bump? I was surprised by this question because I thought I'd included one. But it

Re: almost-super-user problems that we haven't fixed yet

2023-01-20 Thread Nathan Bossart
On Fri, Jan 20, 2023 at 03:42:03PM -0500, Robert Haas wrote: > Thanks to you both. I have committed these patches. Thanks! Does this need a catversion bump? -- Nathan Bossart Amazon Web Services: https://aws.amazon.com

Re: almost-super-user problems that we haven't fixed yet

2023-01-20 Thread Robert Haas
On Fri, Jan 20, 2023 at 1:10 PM Nathan Bossart wrote: > > Thanks, this is fixed now with the latest patches. > > Thank you for reviewing. Thanks to you both. I have committed these patches. -- Robert Haas EDB: http://www.enterprisedb.com

Re: almost-super-user problems that we haven't fixed yet

2023-01-20 Thread Nathan Bossart
On Fri, Jan 20, 2023 at 07:04:58PM +0530, tushar wrote: > On 1/19/23 6:28 PM, tushar wrote: >> There is  one typo , for the doc changes, it is  mentioned >> "pg_use_reserved_backends" but i think it supposed to be >> "pg_use_reserved_connections" >> under Table 22.1. Predefined Roles. > > Thanks,

Re: almost-super-user problems that we haven't fixed yet

2023-01-20 Thread tushar
On 1/19/23 6:28 PM, tushar wrote: There is  one typo , for the doc changes, it is  mentioned "pg_use_reserved_backends" but i think it supposed to be "pg_use_reserved_connections" under Table 22.1. Predefined Roles. Thanks, this is fixed now with the latest patches. -- regards,tushar

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread Robert Haas
On Thu, Jan 19, 2023 at 2:46 PM Nathan Bossart wrote: > > Thanks. I'd move it to the inner indentation level so it's closer to > > the test at issue. > > I meant for it to cover the call to HaveNFreeProcs() as well since the same > idea applies. I left it the same for now, but if you still think

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread Nathan Bossart
On Thu, Jan 19, 2023 at 02:17:35PM -0500, Robert Haas wrote: > On Thu, Jan 19, 2023 at 12:54 PM Nathan Bossart > wrote: >> > OK. Might be worth a short comment. >> >> I added one. > > Thanks. I'd move it to the inner indentation level so it's closer to > the test at issue. I meant for it to

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread Robert Haas
On Thu, Jan 19, 2023 at 12:54 PM Nathan Bossart wrote: > > OK. Might be worth a short comment. > > I added one. Thanks. I'd move it to the inner indentation level so it's closer to the test at issue. I would also suggest reordering the documentation and the postgresql.conf.sample file so that

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread Nathan Bossart
On Thu, Jan 19, 2023 at 11:40:53AM -0500, Robert Haas wrote: > On Wed, Jan 18, 2023 at 4:14 PM Nathan Bossart > wrote: >> On Wed, Jan 18, 2023 at 02:51:38PM -0500, Robert Haas wrote: >> > Should (nfree < SuperuserReservedBackends) be using <=, or am I confused? >> >> I believe < is correct. At

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread Robert Haas
On Wed, Jan 18, 2023 at 4:14 PM Nathan Bossart wrote: > On Wed, Jan 18, 2023 at 02:51:38PM -0500, Robert Haas wrote: > > Should (nfree < SuperuserReservedBackends) be using <=, or am I confused? > > I believe < is correct. At this point, the new backend will have already > claimed a proc struct,

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread Robert Haas
On Thu, Jan 19, 2023 at 9:21 AM tushar wrote: > that is not true because the superuser can still able to connect, It is true, but because superusers have all privileges. -- Robert Haas EDB: http://www.enterprisedb.com

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread tushar
On Thu, Jan 19, 2023 at 6:50 PM tushar wrote: > and in the error message too > > [edb@centos7tushar bin]$ ./psql postgres -U r2 > > psql: error: connection to server on socket "/tmp/.s.PGSQL.5432" failed: > FATAL: remaining connection slots are reserved for roles with privileges > of

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread tushar
On Thu, Jan 19, 2023 at 6:28 PM tushar wrote: > On 1/19/23 2:44 AM, Nathan Bossart wrote: > > On Wed, Jan 18, 2023 at 02:51:38PM -0500, Robert Haas wrote: > >> Should (nfree < SuperuserReservedBackends) be using <=, or am I > confused? > > I believe < is correct. At this point, the new backend

Re: almost-super-user problems that we haven't fixed yet

2023-01-19 Thread tushar
On 1/19/23 2:44 AM, Nathan Bossart wrote: On Wed, Jan 18, 2023 at 02:51:38PM -0500, Robert Haas wrote: Should (nfree < SuperuserReservedBackends) be using <=, or am I confused? I believe < is correct. At this point, the new backend will have already claimed a proc struct, so if the number of

Re: almost-super-user problems that we haven't fixed yet

2023-01-18 Thread Nathan Bossart
On Wed, Jan 18, 2023 at 02:51:38PM -0500, Robert Haas wrote: > Should (nfree < SuperuserReservedBackends) be using <=, or am I confused? I believe < is correct. At this point, the new backend will have already claimed a proc struct, so if the number of remaining free slots equals the number of

Re: almost-super-user problems that we haven't fixed yet

2023-01-18 Thread Robert Haas
On Wed, Jan 18, 2023 at 2:00 PM Nathan Bossart wrote: > On Wed, Jan 18, 2023 at 11:28:57AM -0500, Robert Haas wrote: > > In general, looks good. I think this will often call HaveNFreeProcs > > twice, though, and that would be better to avoid, e.g. > > I should have thought of this. This is fixed

Re: almost-super-user problems that we haven't fixed yet

2023-01-18 Thread Nathan Bossart
On Wed, Jan 18, 2023 at 11:28:57AM -0500, Robert Haas wrote: > In general, looks good. I think this will often call HaveNFreeProcs > twice, though, and that would be better to avoid, e.g. I should have thought of this. This is fixed in v2. > In the common case where we hit neither limit, this

Re: almost-super-user problems that we haven't fixed yet

2023-01-18 Thread Robert Haas
On Tue, Jan 17, 2023 at 7:15 PM Nathan Bossart wrote: > Great. Here is a first attempt at the patch. In general, looks good. I think this will often call HaveNFreeProcs twice, though, and that would be better to avoid, e.g. if (!am_superuser && !am_walsender && (SuperuserReservedBackends +

Re: almost-super-user problems that we haven't fixed yet

2023-01-17 Thread Nathan Bossart
On Tue, Jan 17, 2023 at 02:59:31PM -0500, Robert Haas wrote: > On Tue, Jan 17, 2023 at 1:42 PM Nathan Bossart > wrote: >> If we create a new batch of reserved connections, only roles with >> privileges of pg_use_reserved_connections would be able to connect if the >> number of remaining slots is

Re: almost-super-user problems that we haven't fixed yet

2023-01-17 Thread Robert Haas
On Tue, Jan 17, 2023 at 1:42 PM Nathan Bossart wrote: > Alright. The one design question I have is whether this should be a new > set of reserved connections or replace superuser_reserved_connections > entirely. I think it should definitely be something new, not a replacement. > If we create a

Re: almost-super-user problems that we haven't fixed yet

2023-01-17 Thread Nathan Bossart
On Mon, Jan 16, 2023 at 09:06:10PM -0500, Robert Haas wrote: > On Mon, Jan 16, 2023 at 5:37 PM Nathan Bossart > wrote: >> On Mon, Jan 16, 2023 at 02:29:56PM -0500, Robert Haas wrote: >> > 4. You can reserve a small number of connections for the superuser >> > with superuser_reserved_connections,

Re: almost-super-user problems that we haven't fixed yet

2023-01-16 Thread Robert Haas
On Mon, Jan 16, 2023 at 5:37 PM Nathan Bossart wrote: > On Mon, Jan 16, 2023 at 02:29:56PM -0500, Robert Haas wrote: > > 4. You can reserve a small number of connections for the superuser > > with superuser_reserved_connections, but there's no way to do a > > similar thing for any other user. As

Re: almost-super-user problems that we haven't fixed yet

2023-01-16 Thread Nathan Bossart
On Mon, Jan 16, 2023 at 02:29:56PM -0500, Robert Haas wrote: > 4. You can reserve a small number of connections for the superuser > with superuser_reserved_connections, but there's no way to do a > similar thing for any other user. As mentioned above, a CREATEROLE > user could set connection

almost-super-user problems that we haven't fixed yet

2023-01-16 Thread Robert Haas
Due to cf5eb37c5ee0cc54c80d95c1695d7fca1f7c68cb, e5b8a4c098ad6add39626a14475148872cd687e0, and prior commits touching related code, it should now be possible to consider handing out CREATEROLE as a reasonable alternative to handing out SUPERUSER. Prior to cf5eb37c5ee0cc54c80d95c1695d7fca1f7c68cb,