Re: [HACKERS] SuperUser check in pg_stat_statements

[Feike Steenbergen]

You can create a Security Definer Funtion which can then be executed by
then non-superuser monitoring role:

(Assuming you have a role monitoring and pg_stat_statements is installed in
schema public)

    -- connected as a superuser
    CREATE FUNCTION pg_stat_statements()
    RETURNS SETOF pg_stat_statements
    LANGUAGE SQL
    SET search_path='public'
    SECURITY DEFINER
    AS
    $BODY$
    SELECT *
      FROM pg_stat_statements;
    $BODY$;

    REVOKE ALL ON FUNCTION pg_stat_statements() FROM public;
    GRANT EXECUTE ON FUNCTION pg_stat_statements() TO monitoring;

    -- connected as monitoring
    SELECT * FROM pg_stat_statements();