On 10/16/2015 09:28 AM, Andres Freund wrote: > Alternatively you can just have a elevate_user() function that does the > logging and escalating? That seems like the same amount of code and it'd > work with released versions of postgres? > > Sure, that has some disadvantages over your approach, but for the > presented use case with humans needing to escalate I don't see any.
Hmmm, do you mean essentially skip the "GRANT postgres to joe" and use a SECURITY DEFINER C function that does the set role to postgres under the covers with "GRANT EXECUTE on FUNCTION elevate_user() to joe"? Being able to use something like that on existing versions would be very nice, but it feels kind of grotty. Or maybe you mean something else? Joe -- Crunchy Data - http://crunchydata.com PostgreSQL Support for Secure Enterprises Consulting, Training, & Open Source Development
signature.asc
Description: OpenPGP digital signature
