Re: Non-superuser subscription owners

2021-11-16 Thread Mark Dilger
> On Nov 16, 2021, at 12:06 PM, Andrew Dunstan wrote: > > There doesn't seem to be a CF item for it but I'm > inclined to commit it in a couple of days time. https://commitfest.postgresql.org/36/3414/ — Mark Dilger EnterpriseDB: http://www.enterprisedb.com The Enterprise PostgreSQL Company

Re: Non-superuser subscription owners

2021-11-16 Thread Andrew Dunstan
On 11/3/21 15:50, Mark Dilger wrote: >> On Nov 1, 2021, at 10:58 AM, Mark Dilger >> wrote: >> >> ALTER SUBSCRIPTION..[ENABLE | DISABLE] do not synchronously start or stop >> subscription workers. The ALTER command updates the catalog's subenabled >> field, but workers only lazily respond to

Re: Non-superuser subscription owners

2021-11-16 Thread Mark Dilger
> On Nov 16, 2021, at 10:08 AM, Jeff Davis wrote: > > On Mon, 2021-11-01 at 10:58 -0700, Mark Dilger wrote: >> It is unclear . >> >> Thoughts? > > What if we just say that OWNER TO must be done by a superuser, changing > from one superuser to another, just like today? That would

Re: Non-superuser subscription owners

2021-11-16 Thread Jeff Davis
On Mon, 2021-11-01 at 10:58 -0700, Mark Dilger wrote: > It is unclear that I can make ALTER SUBSCRIPTION..OWNER TO > synchronous without redesigning the way workers respond to > pg_subscription catalog updates generally. That may be a good > project to eventually tackle, but I don't see that it

Re: Non-superuser subscription owners

2021-11-03 Thread Mark Dilger
ll pick up the new permissions before applying the next record. I think that is consistent enough with reasonable expectations. The first two patches are virtually unchanged. The third updates the behavior of the apply workers, and updates the documentation to match. v2-0001-Handle-non-superuser-s

Re: Non-superuser subscription owners

2021-11-02 Thread Robert Haas
On Mon, Nov 1, 2021 at 6:44 PM Mark Dilger wrote: > > ALTER SUBSCRIPTION..[ENABLE | DISABLE] do not synchronously start or stop > > subscription workers. The ALTER command updates the catalog's subenabled > > field, but workers only lazily respond to that. Disabling and enabling the > >

Re: Non-superuser subscription owners

2021-11-01 Thread Mark Dilger
> On Nov 1, 2021, at 10:58 AM, Mark Dilger wrote: > > ALTER SUBSCRIPTION..[ENABLE | DISABLE] do not synchronously start or stop > subscription workers. The ALTER command updates the catalog's subenabled > field, but workers only lazily respond to that. Disabling and enabling the >

Re: Non-superuser subscription owners

2021-11-01 Thread Mark Dilger
> On Nov 1, 2021, at 7:18 AM, Andrew Dunstan wrote: > > w.r.t. this: > > + On the subscriber, the subscription owner's privileges are > re-checked for > + each change record when applied, but beware that a change of > ownership for a > + subscription may not be noticed immediately by

Re: Non-superuser subscription owners

2021-11-01 Thread Andrew Dunstan
On 10/20/21 14:40, Mark Dilger wrote: > These patches have been split off the now deprecated monolithic "Delegating > superuser tasks to new security roles" thread at [1]. > > The purpose of these patches is to allow non-superuser subscription owners > without risk o

Re: Non-superuser subscription owners

2021-10-25 Thread Ronan Dunklau
Le mercredi 20 octobre 2021, 20:40:39 CEST Mark Dilger a écrit : > These patches have been split off the now deprecated monolithic "Delegating > superuser tasks to new security roles" thread at [1]. > > The purpose of these patches is to allow non-superuser subscription

Non-superuser subscription owners

2021-10-20 Thread Mark Dilger
These patches have been split off the now deprecated monolithic "Delegating superuser tasks to new security roles" thread at [1]. The purpose of these patches is to allow non-superuser subscription owners without risk of them overwriting tables they lack privilege to write directly.

<    1   2   3