On 4 Apr. 2017 14:22, "Andres Freund" <and...@anarazel.de> wrote:
On 2017-01-05 03:12:09 +0000, Tsunakawa, Takayuki wrote: > From: pgsql-hackers-ow...@postgresql.org > > [mailto:pgsql-hackers-ow...@postgresql.org] On Behalf Of Magnus Hagander > > For the pg_ctl changes, we're going from removing all privilieges from the > > token, to removing none. Are there any other privileges that we should be > > worried about? I think you may be correct in that it's overkill to do it, > > but I think we need some more specifics to decide that. > > This page lists the privileges. Is there anyhing you are concerned about? > > https://msdn.microsoft.com/ja-jp/library/windows/desktop/ bb530716(v=vs.85).aspx Aren't like nearly all of them a concern? We gone from having some containment (not being to create users, shut the system down, ...), to none. I do however think there's a fair argument to be made that other platforms do not have a similar containment (no root, but sudo etc is still possible), and that the containment isn't super strong. TBH, anyone who cares about security and runs Win7 or Win2k8 or newer should be using virtual service accounts and managed service accounts. https://technet.microsoft.com/en-us/library/dd548356 Those are more like Unix service accounts. Notably they don't need a password, getting rid of some of the management pain that led us to abandon the 'postgres' system user on Windows. Now that older platforms are EoL and even the oldest that added this feature are also near EoL or in extended maintenance, I think installers should switch to these by default instead of using NETWORK SERVICE. Then the issue of priv dropping would be a lesser concern anyway.
