Re: [HACKERS] Default Roles (was: Additional role attributes)

2016-04-08 Thread Stephen Frost
Noah, Fujii, all, * Noah Misch (n...@leadboat.com) wrote: > At the C level, have a pgstattuple function and a pgstattuple_v1_4 function. > Let them differ only in that the former has a superuser check. Binary > upgrades will use the former, and fresh CREATE EXTENSION shall use the latter. Attach

Re: [HACKERS] Default Roles (was: Additional role attributes)

2016-04-05 Thread Stephen Frost
Noah, * Noah Misch (n...@leadboat.com) wrote: > On Sun, Apr 03, 2016 at 10:27:02PM -0400, Stephen Frost wrote: > > * Fujii Masao (masao.fu...@gmail.com) wrote: > > > Currently only superusers can call pgstattuple(). > > > > I started looking into this. > > > > If we were starting from a green fi

Re: [HACKERS] Default Roles (was: Additional role attributes)

2016-04-04 Thread Noah Misch
On Sun, Apr 03, 2016 at 10:27:02PM -0400, Stephen Frost wrote: > * Fujii Masao (masao.fu...@gmail.com) wrote: > > Currently only superusers can call pgstattuple(). > > I started looking into this. > > If we were starting from a green field, the pg_dump dump catalog ACLs > patch would work just fi

Re: [HACKERS] Default Roles (was: Additional role attributes)

2016-04-03 Thread Stephen Frost
Fujii, * Fujii Masao (masao.fu...@gmail.com) wrote: > On Tue, Jul 14, 2015 at 3:46 AM, Stephen Frost wrote: > > Possibly, but I'd need to look at them more closely than I have time to > > right now. Can you provide a use-case? That would certainly help. > > I have seen the monitoring system wh

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-11-17 Thread Michael Paquier
On Wed, Nov 18, 2015 at 5:36 AM, Stephen Frost wrote: > Michael, > > * Michael Paquier (michael.paqu...@gmail.com) wrote: >> Will there be any work on this patch for this commit fest or not? This >> is being carried around for a couple of months now with not much >> progress. This thread is idle f

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-11-17 Thread Stephen Frost
Michael, * Michael Paquier (michael.paqu...@gmail.com) wrote: > Will there be any work on this patch for this commit fest or not? This > is being carried around for a couple of months now with not much > progress. This thread is idle for 4 months now. This thread and the other one kind of merged.

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-11-16 Thread Michael Paquier
Stephen, On Tue, Jul 14, 2015 at 9:22 PM, Fujii Masao wrote: > > On Tue, Jul 14, 2015 at 3:46 AM, Stephen Frost wrote: > > Fujii, > > > > * Fujii Masao (masao.fu...@gmail.com) wrote: > >> he documents of the functions which the corresponding default roles > >> are added by this patch need to be

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-07-14 Thread Fujii Masao
On Tue, Jul 14, 2015 at 3:46 AM, Stephen Frost wrote: > Fujii, > > * Fujii Masao (masao.fu...@gmail.com) wrote: >> he documents of the functions which the corresponding default roles >> are added by this patch need to be updated. For example, the description >> of pg_xlog_replay_pause() says "Paus

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-07-13 Thread Stephen Frost
Fujii, * Fujii Masao (masao.fu...@gmail.com) wrote: > he documents of the functions which the corresponding default roles > are added by this patch need to be updated. For example, the description > of pg_xlog_replay_pause() says "Pauses recovery immediately (restricted > to superusers).". I think

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-07-13 Thread Fujii Masao
On Wed, May 13, 2015 at 12:07 PM, Stephen Frost wrote: > All, > > This patch gets smaller and smaller. > > Upon reflection I realized that, with default roles, it's entirely > unnecssary to change how the permission checks happen today- we can > simply add checks to them to be looking at role memb

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-13 Thread Tom Lane
Robert Haas writes: > Now, if six people who are all well-known PostgreSQL contributors show > up and they all say "I looked at the latest version of this carefully > and I'm confident you've got it right", then go ahead: push it. But > don't make the mistake of thinking that because you're confi

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-13 Thread Robert Haas
On Wed, May 13, 2015 at 11:50 AM, Stephen Frost wrote: > * Robert Haas (robertmh...@gmail.com) wrote: >> Yes: let's punt this to 9.6. The decisions you're making here are way >> too significant to be making a couple of days before feature freeze, >> and this patch has changed massively since it w

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-13 Thread Stephen Frost
* Robert Haas (robertmh...@gmail.com) wrote: > Yes: let's punt this to 9.6. The decisions you're making here are way > too significant to be making a couple of days before feature freeze, > and this patch has changed massively since it was first submitted. > There isn't time now for people who wan

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-13 Thread Bruce Momjian
On Wed, May 13, 2015 at 10:16:39AM -0400, Robert Haas wrote: > On Tue, May 12, 2015 at 11:07 PM, Stephen Frost wrote: > > Thoughts? Comments? Suggestions? > > Yes: let's punt this to 9.6. The decisions you're making here are way > too significant to be making a couple of days before feature fr

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-13 Thread Robert Haas
On Tue, May 12, 2015 at 11:07 PM, Stephen Frost wrote: > Thoughts? Comments? Suggestions? Yes: let's punt this to 9.6. The decisions you're making here are way too significant to be making a couple of days before feature freeze, and this patch has changed massively since it was first submitted

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-12 Thread Stephen Frost
All, This patch gets smaller and smaller. Upon reflection I realized that, with default roles, it's entirely unnecssary to change how the permission checks happen today- we can simply add checks to them to be looking at role membership also. That's removed the last of my concerns regarding any A

Re: [HACKERS] Default Roles (was: Additional role attributes)

2015-05-09 Thread Stephen Frost
All, * Stephen Frost (sfr...@snowman.net) wrote: > Starting a new thread, as suggested by Robert, for consideration of > adding default roles for sets of administrative functions, therefore > removing the need for superuser-level roles in many use-cases. [...] > This is part 2 and really the "gu

[HACKERS] Default Roles (was: Additional role attributes)

2015-05-07 Thread Stephen Frost
All, Starting a new thread, as suggested by Robert, for consideration of adding default roles for sets of administrative functions, therefore removing the need for superuser-level roles in many use-cases. This reserves the prefix 'pg_' as being for default roles. Having these default roles also