> On Dec 9, 2021, at 7:47 AM, Robert Haas <robertmh...@gmail.com> wrote:
>
> 1 and 2B seem to require changing the same code, or related code. 1A
> seems to require a completely different set of changes. If I'm right
> about that, it seems like a good reason for doing 1+2B first and
> leaving 2A for a separate patch.
There are unresolved problems with 2A and 3 which were discussed upthread. I
don't want to include fixes for them in this patch, as it greatly expands the
scope of this patch, and is a logically separate effort. We can come back to
those problems after this first patch is committed.
Specifically, a non-superuser owner can perform ALTER SUBSCRIPTION and do
things that are morally equivalent to creating a new subscription. This is
problematic where things like the connection string are concerned, because it
means the non-superuser owner can connect out to entirely different servers,
without any access control checks to make sure the owner should be able to
connect to these servers.
This problem already exists, right now. I'm not fixing it in this first patch,
but I'm also not making it any worse.
The solution Jeff Davis proposed seems right to me. We change subscriptions to
use a foreign server rather than a freeform connection string. When creating
or altering a subscription, the role performing the action must have privileges
on any foreign server they use.
—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
